From 81905f1afc2e1fd5d8d7bcbb0e76b4f38dca5988 Mon Sep 17 00:00:00 2001 From: Ilias Stamatis Date: Fri, 28 Aug 2026 14:51:28 +0100 Subject: [PATCH 1/2] guest_configs: Sync microvm Kconfigs with AL upstream Refresh the CI guest kernel configs from the Amazon Linux microVM kernel srpm configs. Notable changes are PCIe hotplug support on all versions, and for 6.1 TUN, VXLAN, GENEVE, socket diag, CHECKPOINT_RESTORE and Landlock. Signed-off-by: Ilias Stamatis --- .../microvm-kernel-ci-aarch64-5.10.config | 25 ++++-------- .../microvm-kernel-ci-aarch64-6.1.config | 35 ++++++++++------- .../microvm-kernel-ci-aarch64-6.18.config | 7 +++- .../microvm-kernel-ci-x86_64-5.10.config | 14 ++++--- .../microvm-kernel-ci-x86_64-6.1.config | 39 +++++++++++-------- .../microvm-kernel-ci-x86_64-6.18.config | 9 ++++- 6 files changed, 73 insertions(+), 56 deletions(-) diff --git a/resources/guest_configs/microvm-kernel-ci-aarch64-5.10.config b/resources/guest_configs/microvm-kernel-ci-aarch64-5.10.config index 53fd0d9489f..f5aeb4bc727 100644 --- a/resources/guest_configs/microvm-kernel-ci-aarch64-5.10.config +++ b/resources/guest_configs/microvm-kernel-ci-aarch64-5.10.config @@ -11,7 +11,6 @@ CONFIG_AS_IS_GNU=y CONFIG_AS_VERSION=23502 CONFIG_LLD_VERSION=0 CONFIG_CC_CAN_LINK=y -CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_IRQ_WORK=y @@ -215,7 +214,6 @@ CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y CONFIG_BPF_UNPRIV_DEFAULT_OFF=y CONFIG_USERMODE_DRIVER=y CONFIG_BPF_PRELOAD=y -CONFIG_BPF_PRELOAD_UMD=y CONFIG_USERFAULTFD=y CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y CONFIG_RSEQ=y @@ -274,6 +272,7 @@ CONFIG_FIX_EARLYCON_MEM=y CONFIG_PGTABLE_LEVELS=4 CONFIG_ARCH_SUPPORTS_UPROBES=y CONFIG_ARCH_PROC_KCORE_TEXT=y +CONFIG_BROKEN_GAS_INST=y # # Platform selection @@ -420,8 +419,6 @@ CONFIG_KUSER_HELPERS=y # CONFIG_ARM64_HW_AFDBM=y CONFIG_ARM64_PAN=y -CONFIG_AS_HAS_LSE_ATOMICS=y -CONFIG_ARM64_LSE_ATOMICS=y CONFIG_ARM64_USE_LSE_ATOMICS=y CONFIG_ARM64_VHE=y # end of ARMv8.1 architectural features @@ -438,10 +435,6 @@ CONFIG_ARM64_CNP=y # # ARMv8.3 architectural features # -CONFIG_ARM64_PTR_AUTH=y -CONFIG_CC_HAS_BRANCH_PROT_PAC_RET=y -CONFIG_CC_HAS_SIGN_RETURN_ADDRESS=y -CONFIG_AS_HAS_PAC=y CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y # end of ARMv8.3 architectural features @@ -449,27 +442,20 @@ CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y # ARMv8.4 architectural features # CONFIG_ARM64_AMU_EXTN=y -CONFIG_AS_HAS_ARMV8_4=y -CONFIG_ARM64_TLB_RANGE=y # end of ARMv8.4 architectural features # # ARMv8.5 architectural features # CONFIG_ARM64_BTI=y -CONFIG_CC_HAS_BRANCH_PROT_PAC_RET_BTI=y CONFIG_ARM64_E0PD=y CONFIG_ARCH_RANDOM=y -CONFIG_ARM64_AS_HAS_MTE=y -CONFIG_ARM64_MTE=y # end of ARMv8.5 architectural features CONFIG_ARM64_SVE=y # CONFIG_ARM64_PSEUDO_NMI is not set CONFIG_RELOCATABLE=y # CONFIG_RANDOMIZE_BASE is not set -CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y -CONFIG_STACKPROTECTOR_PER_TASK=y # end of Kernel Features # @@ -927,7 +913,6 @@ CONFIG_ARCH_HAS_PTE_DEVMAP=y CONFIG_ZONE_DEVICE=y CONFIG_DEV_PAGEMAP_OPS=y # CONFIG_DEVICE_PRIVATE is not set -CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y # CONFIG_PERCPU_STATS is not set # CONFIG_GUP_BENCHMARK is not set # CONFIG_READ_ONLY_THP_FOR_FS is not set @@ -1276,7 +1261,6 @@ CONFIG_NF_DEFRAG_IPV6=y # CONFIG_NF_CONNTRACK_BRIDGE is not set # CONFIG_BRIDGE_NF_EBTABLES is not set CONFIG_BPFILTER=y -CONFIG_BPFILTER_UMH=y # CONFIG_IP_DCCP is not set # CONFIG_IP_SCTP is not set # CONFIG_RDS is not set @@ -1446,6 +1430,7 @@ CONFIG_PCI_DOMAINS=y CONFIG_PCI_DOMAINS_GENERIC=y CONFIG_PCI_SYSCALL=y CONFIG_PCIEPORTBUS=y +CONFIG_HOTPLUG_PCI_PCIE=y # CONFIG_PCIEAER is not set CONFIG_PCIEASPM=y CONFIG_PCIEASPM_DEFAULT=y @@ -1465,7 +1450,10 @@ CONFIG_PCI_ECAM=y # CONFIG_PCI_PASID is not set # CONFIG_PCI_P2PDMA is not set CONFIG_PCI_LABEL=y -# CONFIG_HOTPLUG_PCI is not set +CONFIG_HOTPLUG_PCI=y +# CONFIG_HOTPLUG_PCI_ACPI is not set +# CONFIG_HOTPLUG_PCI_CPCI is not set +# CONFIG_HOTPLUG_PCI_SHPC is not set # # PCI controller drivers @@ -3366,3 +3354,4 @@ CONFIG_CC_HAS_SANCOV_TRACE_PC=y # CONFIG_MEMTEST is not set # end of Kernel Testing and Coverage # end of Kernel hacking +CONFIG_MICROVM=y \ No newline at end of file diff --git a/resources/guest_configs/microvm-kernel-ci-aarch64-6.1.config b/resources/guest_configs/microvm-kernel-ci-aarch64-6.1.config index 1ebc78ff2c9..09273749aaa 100644 --- a/resources/guest_configs/microvm-kernel-ci-aarch64-6.1.config +++ b/resources/guest_configs/microvm-kernel-ci-aarch64-6.1.config @@ -192,7 +192,7 @@ CONFIG_IPC_NS=y CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y -# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set CONFIG_RELAY=y @@ -238,6 +238,7 @@ CONFIG_KALLSYMS=y # CONFIG_KALLSYMS_ALL is not set CONFIG_KALLSYMS_BASE_RELATIVE=y CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +CONFIG_KCMP=y CONFIG_RSEQ=y # CONFIG_EMBEDDED is not set CONFIG_HAVE_PERF_EVENTS=y @@ -361,6 +362,7 @@ CONFIG_ARM64_ERRATUM_2457168=y CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD=y CONFIG_ARM64_ERRATUM_2966298=y CONFIG_ARM64_ERRATUM_3194386=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y @@ -987,10 +989,10 @@ CONFIG_SKB_EXTENSIONS=y # Networking options # CONFIG_PACKET=y -# CONFIG_PACKET_DIAG is not set +CONFIG_PACKET_DIAG=y CONFIG_UNIX=y CONFIG_AF_UNIX_OOB=y -# CONFIG_UNIX_DIAG is not set +CONFIG_UNIX_DIAG=y # CONFIG_TLS is not set CONFIG_XFRM=y CONFIG_XFRM_ALGO=y @@ -1015,6 +1017,7 @@ CONFIG_IP_PNP_BOOTP=y CONFIG_IP_PNP_RARP=y # CONFIG_NET_IPIP is not set # CONFIG_NET_IPGRE_DEMUX is not set +CONFIG_NET_IP_TUNNEL=y CONFIG_IP_MROUTE_COMMON=y CONFIG_IP_MROUTE=y CONFIG_IP_MROUTE_MULTIPLE_TABLES=y @@ -1022,6 +1025,7 @@ CONFIG_IP_PIMSM_V1=y CONFIG_IP_PIMSM_V2=y CONFIG_SYN_COOKIES=y # CONFIG_NET_IPVTI is not set +CONFIG_NET_UDP_TUNNEL=y # CONFIG_NET_FOU is not set # CONFIG_INET_AH is not set # CONFIG_INET_ESP is not set @@ -1029,7 +1033,7 @@ CONFIG_SYN_COOKIES=y CONFIG_INET_TABLE_PERTURB_ORDER=16 CONFIG_INET_DIAG=y CONFIG_INET_TCP_DIAG=y -# CONFIG_INET_UDP_DIAG is not set +CONFIG_INET_UDP_DIAG=y # CONFIG_INET_RAW_DIAG is not set CONFIG_INET_DIAG_DESTROY=y CONFIG_TCP_CONG_ADVANCED=y @@ -1155,7 +1159,7 @@ CONFIG_NETFILTER_XTABLES_COMPAT=y # # Xtables combined modules # -# CONFIG_NETFILTER_XT_MARK is not set +CONFIG_NETFILTER_XT_MARK=y # CONFIG_NETFILTER_XT_CONNMARK is not set # @@ -1419,7 +1423,7 @@ CONFIG_VSOCKETS=y # CONFIG_VSOCKETS_LOOPBACK is not set CONFIG_VIRTIO_VSOCKETS=y CONFIG_VIRTIO_VSOCKETS_COMMON=y -# CONFIG_NETLINK_DIAG is not set +CONFIG_NETLINK_DIAG=y CONFIG_MPLS=y # CONFIG_NET_MPLS_GSO is not set # CONFIG_MPLS_ROUTING is not set @@ -1466,6 +1470,7 @@ CONFIG_FIB_RULES=y # CONFIG_NET_IFE is not set CONFIG_LWTUNNEL=y CONFIG_LWTUNNEL_BPF=y +CONFIG_DST_CACHE=y CONFIG_GRO_CELLS=y CONFIG_NET_SOCK_MSG=y CONFIG_PAGE_POOL=y @@ -1483,6 +1488,7 @@ CONFIG_PCI_DOMAINS=y CONFIG_PCI_DOMAINS_GENERIC=y CONFIG_PCI_SYSCALL=y CONFIG_PCIEPORTBUS=y +CONFIG_HOTPLUG_PCI_PCIE=y # CONFIG_PCIEAER is not set CONFIG_PCIEASPM=y CONFIG_PCIEASPM_DEFAULT=y @@ -1504,7 +1510,10 @@ CONFIG_PCI_ECAM=y CONFIG_PCI_LABEL=y CONFIG_VGA_ARB=y CONFIG_VGA_ARB_MAX_GPUS=16 -# CONFIG_HOTPLUG_PCI is not set +CONFIG_HOTPLUG_PCI=y +# CONFIG_HOTPLUG_PCI_ACPI is not set +# CONFIG_HOTPLUG_PCI_CPCI is not set +# CONFIG_HOTPLUG_PCI_SHPC is not set # # PCI controller drivers @@ -1857,14 +1866,14 @@ CONFIG_NET_CORE=y # CONFIG_NET_TEAM is not set # CONFIG_MACVLAN is not set # CONFIG_IPVLAN is not set -# CONFIG_VXLAN is not set -# CONFIG_GENEVE is not set +CONFIG_VXLAN=y +CONFIG_GENEVE=y # CONFIG_BAREUDP is not set # CONFIG_GTP is not set # CONFIG_AMT is not set # CONFIG_MACSEC is not set # CONFIG_NETCONSOLE is not set -# CONFIG_TUN is not set +CONFIG_TUN=y # CONFIG_TUN_VNET_CROSS_LE is not set CONFIG_VETH=y CONFIG_VIRTIO_NET=y @@ -2983,7 +2992,7 @@ CONFIG_SECURITY_WRITABLE_HOOKS=y CONFIG_SECURITYFS=y CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_NETWORK_XFRM=y -# CONFIG_SECURITY_PATH is not set +CONFIG_SECURITY_PATH=y CONFIG_LSM_MMAP_MIN_ADDR=65536 CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y CONFIG_HARDENED_USERCOPY=y @@ -3004,12 +3013,12 @@ CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256 # CONFIG_SECURITY_YAMA is not set # CONFIG_SECURITY_SAFESETID is not set # CONFIG_SECURITY_LOCKDOWN_LSM is not set -# CONFIG_SECURITY_LANDLOCK is not set +CONFIG_SECURITY_LANDLOCK=y # CONFIG_INTEGRITY is not set # CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" # # Kernel hardening options diff --git a/resources/guest_configs/microvm-kernel-ci-aarch64-6.18.config b/resources/guest_configs/microvm-kernel-ci-aarch64-6.18.config index 3d0089a641f..8dac0ead7e3 100644 --- a/resources/guest_configs/microvm-kernel-ci-aarch64-6.18.config +++ b/resources/guest_configs/microvm-kernel-ci-aarch64-6.18.config @@ -1643,6 +1643,7 @@ CONFIG_PCI_DOMAINS=y CONFIG_PCI_DOMAINS_GENERIC=y CONFIG_PCI_SYSCALL=y CONFIG_PCIEPORTBUS=y +CONFIG_HOTPLUG_PCI_PCIE=y # CONFIG_PCIEAER is not set CONFIG_PCIEASPM=y CONFIG_PCIEASPM_DEFAULT=y @@ -1671,7 +1672,11 @@ CONFIG_PCIE_BUS_DEFAULT=y # CONFIG_PCIE_BUS_PEER2PEER is not set CONFIG_VGA_ARB=y CONFIG_VGA_ARB_MAX_GPUS=16 -# CONFIG_HOTPLUG_PCI is not set +CONFIG_HOTPLUG_PCI=y +# CONFIG_HOTPLUG_PCI_ACPI is not set +# CONFIG_HOTPLUG_PCI_CPCI is not set +# CONFIG_HOTPLUG_PCI_OCTEONEP is not set +# CONFIG_HOTPLUG_PCI_SHPC is not set # # PCI controller drivers diff --git a/resources/guest_configs/microvm-kernel-ci-x86_64-5.10.config b/resources/guest_configs/microvm-kernel-ci-x86_64-5.10.config index f1fecd2e9f4..ff2c540e5a7 100644 --- a/resources/guest_configs/microvm-kernel-ci-x86_64-5.10.config +++ b/resources/guest_configs/microvm-kernel-ci-x86_64-5.10.config @@ -11,7 +11,6 @@ CONFIG_AS_IS_GNU=y CONFIG_AS_VERSION=23502 CONFIG_LLD_VERSION=0 CONFIG_CC_CAN_LINK=y -CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_IRQ_WORK=y @@ -239,7 +238,6 @@ CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y CONFIG_BPF_UNPRIV_DEFAULT_OFF=y CONFIG_USERMODE_DRIVER=y CONFIG_BPF_PRELOAD=y -CONFIG_BPF_PRELOAD_UMD=y CONFIG_USERFAULTFD=y CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y CONFIG_RSEQ=y @@ -1239,7 +1237,6 @@ CONFIG_NF_DEFRAG_IPV6=y # CONFIG_NF_CONNTRACK_BRIDGE is not set # CONFIG_BRIDGE_NF_EBTABLES is not set CONFIG_BPFILTER=y -CONFIG_BPFILTER_UMH=y # CONFIG_IP_DCCP is not set # CONFIG_IP_SCTP is not set # CONFIG_RDS is not set @@ -1407,6 +1404,7 @@ CONFIG_HAVE_PCI=y CONFIG_PCI=y CONFIG_PCI_DOMAINS=y CONFIG_PCIEPORTBUS=y +CONFIG_HOTPLUG_PCI_PCIE=y # CONFIG_PCIEAER is not set CONFIG_PCIEASPM=y CONFIG_PCIEASPM_DEFAULT=y @@ -1426,7 +1424,10 @@ CONFIG_PCI_LOCKLESS_CONFIG=y # CONFIG_PCI_PASID is not set # CONFIG_PCI_P2PDMA is not set CONFIG_PCI_LABEL=y -# CONFIG_HOTPLUG_PCI is not set +CONFIG_HOTPLUG_PCI=y +# CONFIG_HOTPLUG_PCI_ACPI is not set +# CONFIG_HOTPLUG_PCI_CPCI is not set +# CONFIG_HOTPLUG_PCI_SHPC is not set # # PCI controller drivers @@ -1873,7 +1874,7 @@ CONFIG_HW_RANDOM_VIRTIO=y # CONFIG_HW_RANDOM_XIPHERA is not set # CONFIG_APPLICOM is not set # CONFIG_MWAVE is not set -CONFIG_DEVMEM=y +# CONFIG_DEVMEM is not set # CONFIG_DEVKMEM is not set # CONFIG_NVRAM is not set # CONFIG_RAW_DRIVER is not set @@ -3302,7 +3303,7 @@ CONFIG_TRACING_SUPPORT=y # CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set # CONFIG_SAMPLES is not set CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y -CONFIG_STRICT_DEVMEM=y +# CONFIG_DEVMEM is not set # CONFIG_IO_STRICT_DEVMEM is not set # @@ -3344,3 +3345,4 @@ CONFIG_CC_HAS_SANCOV_TRACE_PC=y # CONFIG_MEMTEST is not set # end of Kernel Testing and Coverage # end of Kernel hacking +CONFIG_MICROVM=y \ No newline at end of file diff --git a/resources/guest_configs/microvm-kernel-ci-x86_64-6.1.config b/resources/guest_configs/microvm-kernel-ci-x86_64-6.1.config index f56e15c3f10..406c9298d72 100644 --- a/resources/guest_configs/microvm-kernel-ci-x86_64-6.1.config +++ b/resources/guest_configs/microvm-kernel-ci-x86_64-6.1.config @@ -217,7 +217,7 @@ CONFIG_IPC_NS=y CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y -# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set CONFIG_RELAY=y @@ -267,6 +267,7 @@ CONFIG_KALLSYMS=y CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y CONFIG_KALLSYMS_BASE_RELATIVE=y CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +CONFIG_KCMP=y CONFIG_RSEQ=y # CONFIG_EMBEDDED is not set CONFIG_HAVE_PERF_EVENTS=y @@ -922,6 +923,7 @@ CONFIG_USE_PERCPU_NUMA_NODE_ID=y CONFIG_HAVE_SETUP_PER_CPU_AREA=y CONFIG_FRONTSWAP=y # CONFIG_CMA is not set +# CONFIG_MEM_SOFT_DIRTY is not set CONFIG_GENERIC_EARLY_IOREMAP=y CONFIG_DEFERRED_STRUCT_PAGE_INIT=y CONFIG_PAGE_IDLE_FLAG=y @@ -972,10 +974,10 @@ CONFIG_SKB_EXTENSIONS=y # Networking options # CONFIG_PACKET=y -# CONFIG_PACKET_DIAG is not set +CONFIG_PACKET_DIAG=y CONFIG_UNIX=y CONFIG_AF_UNIX_OOB=y -# CONFIG_UNIX_DIAG is not set +CONFIG_UNIX_DIAG=y # CONFIG_TLS is not set CONFIG_XFRM=y CONFIG_XFRM_ALGO=y @@ -1001,6 +1003,7 @@ CONFIG_IP_PNP_BOOTP=y CONFIG_IP_PNP_RARP=y # CONFIG_NET_IPIP is not set # CONFIG_NET_IPGRE_DEMUX is not set +CONFIG_NET_IP_TUNNEL=y CONFIG_IP_MROUTE_COMMON=y CONFIG_IP_MROUTE=y CONFIG_IP_MROUTE_MULTIPLE_TABLES=y @@ -1008,6 +1011,7 @@ CONFIG_IP_PIMSM_V1=y CONFIG_IP_PIMSM_V2=y CONFIG_SYN_COOKIES=y # CONFIG_NET_IPVTI is not set +CONFIG_NET_UDP_TUNNEL=y # CONFIG_NET_FOU is not set # CONFIG_INET_AH is not set # CONFIG_INET_ESP is not set @@ -1015,7 +1019,7 @@ CONFIG_SYN_COOKIES=y CONFIG_INET_TABLE_PERTURB_ORDER=16 CONFIG_INET_DIAG=y CONFIG_INET_TCP_DIAG=y -# CONFIG_INET_UDP_DIAG is not set +CONFIG_INET_UDP_DIAG=y # CONFIG_INET_RAW_DIAG is not set CONFIG_INET_DIAG_DESTROY=y CONFIG_TCP_CONG_ADVANCED=y @@ -1142,7 +1146,7 @@ CONFIG_NETFILTER_XTABLES_COMPAT=y # # Xtables combined modules # -# CONFIG_NETFILTER_XT_MARK is not set +CONFIG_NETFILTER_XT_MARK=y # CONFIG_NETFILTER_XT_CONNMARK is not set # @@ -1406,7 +1410,7 @@ CONFIG_VSOCKETS=y # CONFIG_VSOCKETS_LOOPBACK is not set CONFIG_VIRTIO_VSOCKETS=y CONFIG_VIRTIO_VSOCKETS_COMMON=y -# CONFIG_NETLINK_DIAG is not set +CONFIG_NETLINK_DIAG=y CONFIG_MPLS=y # CONFIG_NET_MPLS_GSO is not set # CONFIG_MPLS_ROUTING is not set @@ -1468,6 +1472,7 @@ CONFIG_HAVE_PCI=y CONFIG_PCI=y CONFIG_PCI_DOMAINS=y CONFIG_PCIEPORTBUS=y +CONFIG_HOTPLUG_PCI_PCIE=y # CONFIG_PCIEAER is not set CONFIG_PCIEASPM=y CONFIG_PCIEASPM_DEFAULT=y @@ -1489,7 +1494,10 @@ CONFIG_PCI_LOCKLESS_CONFIG=y CONFIG_PCI_LABEL=y CONFIG_VGA_ARB=y CONFIG_VGA_ARB_MAX_GPUS=16 -# CONFIG_HOTPLUG_PCI is not set +CONFIG_HOTPLUG_PCI=y +# CONFIG_HOTPLUG_PCI_ACPI is not set +# CONFIG_HOTPLUG_PCI_CPCI is not set +# CONFIG_HOTPLUG_PCI_SHPC is not set # # PCI controller drivers @@ -1792,14 +1800,14 @@ CONFIG_NET_CORE=y # CONFIG_NET_TEAM is not set # CONFIG_MACVLAN is not set # CONFIG_IPVLAN is not set -# CONFIG_VXLAN is not set -# CONFIG_GENEVE is not set +CONFIG_VXLAN=y +CONFIG_GENEVE=y # CONFIG_BAREUDP is not set # CONFIG_GTP is not set # CONFIG_AMT is not set # CONFIG_MACSEC is not set # CONFIG_NETCONSOLE is not set -# CONFIG_TUN is not set +CONFIG_TUN=y # CONFIG_TUN_VNET_CROSS_LE is not set CONFIG_VETH=y CONFIG_VIRTIO_NET=y @@ -1962,7 +1970,7 @@ CONFIG_HW_RANDOM_VIRTIO=y # CONFIG_HW_RANDOM_XIPHERA is not set # CONFIG_APPLICOM is not set # CONFIG_MWAVE is not set -CONFIG_DEVMEM=y +# CONFIG_DEVMEM is not set # CONFIG_NVRAM is not set CONFIG_DEVPORT=y # CONFIG_HPET is not set @@ -2912,7 +2920,7 @@ CONFIG_SECURITY_WRITABLE_HOOKS=y CONFIG_SECURITYFS=y CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_NETWORK_XFRM=y -# CONFIG_SECURITY_PATH is not set +CONFIG_SECURITY_PATH=y CONFIG_LSM_MMAP_MIN_ADDR=65536 CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y CONFIG_HARDENED_USERCOPY=y @@ -2933,11 +2941,11 @@ CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256 # CONFIG_SECURITY_YAMA is not set # CONFIG_SECURITY_SAFESETID is not set # CONFIG_SECURITY_LOCKDOWN_LSM is not set -# CONFIG_SECURITY_LANDLOCK is not set +CONFIG_SECURITY_LANDLOCK=y # CONFIG_INTEGRITY is not set CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" # # Kernel hardening options @@ -3508,8 +3516,7 @@ CONFIG_TRACING_SUPPORT=y CONFIG_HAVE_SAMPLE_FTRACE_DIRECT=y CONFIG_HAVE_SAMPLE_FTRACE_DIRECT_MULTI=y CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y -CONFIG_STRICT_DEVMEM=y -# CONFIG_IO_STRICT_DEVMEM is not set +# CONFIG_STRICT_DEVMEM is not set # # x86 Debugging diff --git a/resources/guest_configs/microvm-kernel-ci-x86_64-6.18.config b/resources/guest_configs/microvm-kernel-ci-x86_64-6.18.config index 9e8553abf9a..8022e6aa517 100644 --- a/resources/guest_configs/microvm-kernel-ci-x86_64-6.18.config +++ b/resources/guest_configs/microvm-kernel-ci-x86_64-6.18.config @@ -376,12 +376,12 @@ CONFIG_X86_DEBUGCTLMSR=y CONFIG_IA32_FEAT_CTL=y CONFIG_X86_VMX_FEATURE_NAMES=y # CONFIG_PROCESSOR_SELECT is not set -CONFIG_BROADCAST_TLB_FLUSH=y CONFIG_CPU_SUP_INTEL=y CONFIG_CPU_SUP_AMD=y CONFIG_CPU_SUP_HYGON=y CONFIG_CPU_SUP_CENTAUR=y CONFIG_CPU_SUP_ZHAOXIN=y +CONFIG_BROADCAST_TLB_FLUSH=y CONFIG_HPET_TIMER=y CONFIG_DMI=y # CONFIG_GART_IOMMU is not set @@ -1644,6 +1644,7 @@ CONFIG_GENERIC_PCI_IOMAP=y CONFIG_PCI=y CONFIG_PCI_DOMAINS=y CONFIG_PCIEPORTBUS=y +CONFIG_HOTPLUG_PCI_PCIE=y # CONFIG_PCIEAER is not set CONFIG_PCIEASPM=y CONFIG_PCIEASPM_DEFAULT=y @@ -1671,7 +1672,11 @@ CONFIG_PCIE_BUS_DEFAULT=y # CONFIG_PCIE_BUS_PEER2PEER is not set CONFIG_VGA_ARB=y CONFIG_VGA_ARB_MAX_GPUS=16 -# CONFIG_HOTPLUG_PCI is not set +CONFIG_HOTPLUG_PCI=y +# CONFIG_HOTPLUG_PCI_ACPI is not set +# CONFIG_HOTPLUG_PCI_CPCI is not set +# CONFIG_HOTPLUG_PCI_OCTEONEP is not set +# CONFIG_HOTPLUG_PCI_SHPC is not set # # PCI controller drivers From 692d3fbc566174e5cc437fe561f386cfb89185a9 Mon Sep 17 00:00:00 2001 From: Ilias Stamatis Date: Fri, 28 Aug 2026 16:21:34 +0100 Subject: [PATCH 2/2] guest_configs: Drop redundant Kconfig overrides CONFIG_SQUASHFS_ZSTD in ci.config and CONFIG_FRAME_POINTER in debug.config are already enabled by every microvm-kernel-ci base config, so setting them again has no effect. Signed-off-by: Ilias Stamatis --- resources/guest_configs/ci.config | 1 - resources/guest_configs/debug.config | 1 - 2 files changed, 2 deletions(-) diff --git a/resources/guest_configs/ci.config b/resources/guest_configs/ci.config index 88418877163..472aac4fa2f 100644 --- a/resources/guest_configs/ci.config +++ b/resources/guest_configs/ci.config @@ -1,7 +1,6 @@ CONFIG_IKCONFIG=y CONFIG_IKCONFIG_PROC=y CONFIG_MSDOS_PARTITION=y -CONFIG_SQUASHFS_ZSTD=y # aarch64 only TBD split into a separate file CONFIG_DEVMEM=y CONFIG_STRICT_DEVMEM=y diff --git a/resources/guest_configs/debug.config b/resources/guest_configs/debug.config index 5ce5aaf3241..aec5b74de18 100644 --- a/resources/guest_configs/debug.config +++ b/resources/guest_configs/debug.config @@ -1,4 +1,3 @@ -CONFIG_FRAME_POINTER=y # CONFIG_KGDB=y # CONFIG_KGDB_SERIAL_CONSOLE=y CONFIG_DEBUG_INFO=y