board configs: disable unprivileged BPF #9082
Open
+33
−32
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
neheb
requested review from
AGM1968,
ColorfulRhino,
HeyMeco,
JohnTheCoolingFan,
PanderMusubi,
SuperKali,
TheSnowfield,
Tonymac32,
ahoneybun,
amazingfate,
brentr,
catalinii,
chainsx,
chraac,
efectn,
ginkage,
igorpecovnik,
janprunk,
joekhoobyar,
krachlatte,
lanefu,
leggewie,
paolosabatino,
prahal,
pyavitz,
rpardini,
schwar3kat,
sgjava,
teknoid and
vidplace7
as code owners
Contributor
WalkthroughEnables the kernel config option Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
bot
added
02
Contributor
Author
|
No idea what mode change 120000 => 100644 config/kernel/linux-rockchip-rk3588-current.config is about. |
github-actions
bot
added
size/medium
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
config/kernel/linux-sunxi64-edge.config (1)
7-9: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y here cleanly enforces unprivileged BPF default‑offWith
CONFIG_BPF_JIT=yalready set, addingCONFIG_BPF_UNPRIV_DEFAULT_OFF=yis exactly what’s needed to keep BPF available for privileged users while disabling unprivileged eBPF and matching the PR’s vulnerability‑mitigation goal. Note that this defconfig is auto‑generated, so if future tooling regenerates configs, the corresponding automation should also ensure this option stays enabled. Based on learnings, …config/kernel/linux-sunxi64-current.config (1)
7-10: CONFIG_BPF_UNPRIV_DEFAULT_OFF addition looks correctEnabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yalongsideCONFIG_BPF_SYSCALL/CONFIG_BPF_JITmatches the PR goal of disabling unprivileged BPF by default and should clear the spectre_v2 vulnerability message. Just ensure this config came from the normal Armbian kernel-config generation flow so it won’t be lost on the next automated regen.config/kernel/linux-meson64-edge.config (1)
7-11: Meson64 edge: BPF unprivileged default-off is consistently enabledAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent with the rest of the BPF settings and aligns this defconfig with the other families in the PR. As with the other configs, just confirm this was produced via the usual kernel-config tooling so it persists across future automated regenerations.config/kernel/linux-mvebu64-current.config (1)
9-13: mvebu64 current: unprivileged BPF default-off flag is correctly enabledSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere cleanly implements the intended security posture for this family, in line with the other defconfigs touched by the PR. Again, worth double-checking that this change is captured by the standard Armbian kernel config generation process so it survives future regen of these files.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (33)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-current.config(0 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)
💤 Files with no reviewable changes (1)
- config/kernel/linux-rockchip-rk3588-current.config
🧰 Additional context used
🧠 Learnings (24)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: rpardini
Repo: armbian/build PR: 8879
File: config/sources/families/uefi-x86.conf:0-0
Timestamp: 2025-11-06T15:36:04.682Z
Learning: As of PR #8879, the uefi-x86 family in the Armbian build system now includes kernel patches for the first time. The current and edge branches for uefi-x86 are specifically configured for Apple T2-based x86 machines, including T2-specific patches from the linux-t2 project and custom kernel configuration options for Apple hardware drivers.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: HackingGate
Repo: armbian/build PR: 8665
File: config/boards/photonicat2.csc:4-4
Timestamp: 2025-10-26T10:41:35.118Z
Learning: In the Armbian build system, rk3576 boards consistently use BOARDFAMILY="rk35xx" for both vendor and edge kernel targets. The rk35xx family configuration sources rockchip64_common.inc, which provides edge and current kernel branch definitions, making these branches available even though they're not defined directly in rk35xx.conf.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Learnt from: amazingfate
Repo: armbian/build PR: 8619
File: config/sources/families/rockchip.conf:222-230
Timestamp: 2025-09-14T06:32:29.806Z
Learning: In the Armbian build system, the write_uboot_platform() function implementations follow different patterns across Rockchip family files. The newer standard (used in rockchip64_common.inc and rk3506) includes 'status=none' parameter in dd commands, while older implementations (rk3288, rk322x) use an older pattern without this parameter. The rk3506 implementation correctly follows the current Rockchip family standard.
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rockchip64-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-rockchip-rk3588-edge.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-bcm2711-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rockchip64-current.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.config
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-bcm2711-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rockchip64-current.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rockchip64-current.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-edge.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-odroidxu4-edge.config
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-bcm2711-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rockchip64-current.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-bcm2711-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rockchip64-current.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-bcm2711-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rockchip64-current.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
config/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-bcm2711-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-bcm2711-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rockchip64-current.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-sunxi-edge.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-bcm2711-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rockchip64-current.configconfig/kernel/linux-bcm2711-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-08-11T22:00:13.411Z
Learnt from: rafayahmed317
Repo: armbian/build PR: 8484
File: config/kernel/linux-rk35xx-vendor.config:904-906
Timestamp: 2025-08-11T22:00:13.411Z
Learning: In the linux-rk35xx-vendor kernel, the LTE driver options (CONFIG_LTE, CONFIG_LTE_RM310, CONFIG_LTE_EM05) are defined as boolean in drivers/net/lte/Kconfig and cannot be built as modules - they must be either built-in (=y) or disabled.
Applied to files:
config/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-11-08T06:39:24.527Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8886
File: patch/kernel/rk35xx-vendor-6.1/dt/rk3528-nanopi-rev01.dts:9-9
Timestamp: 2025-11-08T06:39:24.527Z
Learning: In Armbian's Rockchip vendor kernel branches (rk35xx-vendor), device tree files may not require the same headers as mainline Linux. For example, input key definitions like KEY_BACK and KEY_VOLUMEUP may be handled differently in BSP kernels and don't necessarily need explicit includes like <dt-bindings/input/input.h> that would be required in mainline kernel device trees.
Applied to files:
config/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-10-11T19:52:54.648Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8746
File: config/kernel/linux-filogic-edge.config:344-470
Timestamp: 2025-10-11T19:52:54.648Z
Learning: The chainsx/linux-filogic kernel (legacy branch) for BPI-R4 uses out-of-tree proprietary drivers (CONFIG_NET_DSA_AN8855, CONFIG_AIROHA_EN8801SC_PHY, CONFIG_AIR_AN8855_PHY, CONFIG_MDIO_AN8855, CONFIG_MFD_AIROHA_AN8855). The frank-w/BPI-Router-Linux kernel (current and edge branches) uses mainline kernel drivers instead: CONFIG_NET_DSA_MT7530 for the DSA switch and CONFIG_MEDIATEK_2P5GE_PHY for PHY support. These provide equivalent functionality for BPI-R4 networking.
Applied to files:
config/kernel/linux-rk322x-edge.configconfig/kernel/linux-rk322x-current.config
📚 Learning: 2025-09-14T06:32:29.806Z
Learnt from: amazingfate
Repo: armbian/build PR: 8619
File: config/sources/families/rockchip.conf:222-230
Timestamp: 2025-09-14T06:32:29.806Z
Learning: In the Armbian build system, the write_uboot_platform() function implementations follow different patterns across Rockchip family files. The newer standard (used in rockchip64_common.inc and rk3506) includes 'status=none' parameter in dd commands, while older implementations (rk3288, rk322x) use an older pattern without this parameter. The rk3506 implementation correctly follows the current Rockchip family standard.
Applied to files:
config/kernel/linux-rockchip64-current.config
📚 Learning: 2025-10-26T12:56:29.185Z
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Applied to files:
config/kernel/linux-rk322x-current.config
📚 Learning: 2025-10-26T10:41:35.118Z
Learnt from: HackingGate
Repo: armbian/build PR: 8665
File: config/boards/photonicat2.csc:4-4
Timestamp: 2025-10-26T10:41:35.118Z
Learning: In the Armbian build system, rk3576 boards consistently use BOARDFAMILY="rk35xx" for both vendor and edge kernel targets. The rk35xx family configuration sources rockchip64_common.inc, which provides edge and current kernel branch definitions, making these branches available even though they're not defined directly in rk35xx.conf.
Applied to files:
config/kernel/linux-rockchip64-edge.configconfig/kernel/linux-rockchip-edge.config
📚 Learning: 2025-10-23T19:48:42.980Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8812
File: config/kernel/linux-sm8250-edge.config:498-501
Timestamp: 2025-10-23T19:48:42.980Z
Learning: For Armbian EDGE kernel configs, CONFIG_ATH12K=m alone is sufficient for PCI-based Wi-Fi 7 devices (e.g., WCN785x/QCN9274). A separate CONFIG_ATH12K_PCI option is not required, as confirmed by maintainer testing.
Applied to files:
config/kernel/linux-rockchip64-edge.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.config
🔇 Additional comments (28)
config/kernel/linux-mvebu64-legacy.config (1)
10-10: LGTM! Security configuration correctly applied.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yproperly restricts unprivileged BPF access by default, addressing the vulnerability warning described in the PR objectives. The placement afterCONFIG_BPF_SYSCALLandCONFIG_BPF_JITis correct, and the change aligns with the uniform security hardening being applied across all affected board configurations.config/kernel/linux-rk35xx-vendor.config (1)
10-10: LGTM! Security configuration correctly applied.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yproperly restricts unprivileged BPF access by default. The change is consistent with the security hardening being applied uniformly across all board configurations in this PR and correctly addresses the Spectre v2 vulnerability warning mentioned in the PR description.config/kernel/linux-mvebu-legacy.config (1)
103-103: LGTM! Security hardening applied correctly.The change to enable
CONFIG_BPF_UNPRIV_DEFAULT_OFFis correct and addresses the security concern described in the PR. This prevents unprivileged users from using eBPF by default, which resolves the "Vulnerable: Unprivileged eBPF enabled" warning in the CPU vulnerability output.config/kernel/linux-rk322x-current.config (1)
104-104: Security improvement approved.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yrestricts unprivileged users from loading BPF programs by default, which addresses the Spectre v2 vulnerability warning mentioned in the PR description. This is a sound security hardening measure for ARM board configurations.Note that applications requiring unprivileged BPF access (e.g., certain performance monitoring tools) will now require CAP_BPF or CAP_SYS_ADMIN capabilities. Ensure this aligns with the expected use cases for rk322x platforms.
config/kernel/linux-rockchip64-edge.config (1)
11-11: LGTM! Security improvement.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFFhardens the system by disabling unprivileged BPF access by default, which addresses the Spectre v2 vulnerability warning mentioned in the PR description and reduces the attack surface.config/kernel/linux-rk322x-edge.config (1)
95-107: EnablingCONFIG_BPF_UNPRIV_DEFAULT_OFFhere is correct and aligns with the PR’s security goal.This defconfig already has
CONFIG_BPF/CONFIG_BPF_SYSCALL/CONFIG_BPF_JITenabled; addingCONFIG_BPF_UNPRIV_DEFAULT_OFF=yis the right way to defaultunprivileged_bpf_disabledto 2, disabling unprivilegedbpf()while keeping privileged BPF and admin opt‑in via sysctl available. Behavior change is intentional and consistent with fixing the Spectre v2 vulnerability status output.You may want to quickly boot a test image from this kernel and confirm that:
/sys/devices/system/cpu/vulnerabilities/spectre_v2no longer reports “Vulnerable: Unprivileged eBPF enabled”, andsysctl kernel.unprivileged_bpf_disableddefaults to2and can be set to0on demand.config/kernel/linux-sunxi-legacy.config (1)
8-10: Consistent unprivileged BPF default‑off behavior for sunxi-legacy as well.Setting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext toCONFIG_BPF_JIT=ygives this kernel the same “unprivileged BPF disabled by default” behavior as the other defconfigs, which matches the PR objective and should likewise clear the misleading Spectre v2 message. No conflicts with existing BPF options.Please verify on at least one sunxi-legacy board that:
kernel.unprivileged_bpf_disableddefaults to2, and- any workloads relying on unprivileged BPF (e.g., non‑root BPF tooling) are either updated to run with the necessary capabilities or explicitly re‑enable it via sysctl.
config/kernel/linux-sunxi64-legacy.config (1)
9-9: LGTM! Security hardening applied correctly.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFFrestricts unprivileged BPF access by default, addressing the CPU vulnerability warning mentioned in the PR objectives. This change is consistent with the existing BPF configuration options and improves the security posture.config/kernel/linux-imx6-edge.config (1)
12-12: LGTM! Security hardening applied correctly.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFFrestricts unprivileged BPF access by default, mitigating the security concern described in the PR. This change is properly aligned with the existing BPF configuration and enhances system security.config/kernel/linux-rockchip64-current.config (1)
11-11: LGTM – Security enhancement addressing vulnerability reporting.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ycorrectly restricts unprivileged BPF access by default, which addresses the misleading vulnerability warning and aligns with security hardening best practices. BPF functionality remains available for privileged operations sinceCONFIG_BPF_SYSCALLandCONFIG_BPF_JITare still enabled.Note: This change may affect any existing unprivileged BPF programs on affected systems, though such use cases are uncommon in embedded ARM environments.
config/kernel/linux-rockchip-edge.config (1)
10-10: LGTM – Consistent security enhancement for edge kernel.The change correctly enables
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yfor the edge kernel (6.17), maintaining consistency with the current kernel configuration. This restricts unprivileged BPF access while preserving privileged BPF functionality, addressing the vulnerability reporting issue uniformly across kernel versions.config/kernel/linux-virtual-current.config (1)
90-103: BPF_UNPRIV_DEFAULT_OFF=y correctly hardens unpriv BPF for this virtual kernelEnabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere cleanly aligns the virtual arm64 kernel with the PR goal: unprivilegedbpf()is disabled by default, which in turn removes theVulnerable: Unprivileged eBPF enabledSpectre v2 status while keeping privileged BPF/JIT functionality intact.Given that
config/kernel/*files are auto-generated overlays, please just ensure this option is preserved in your kernel-config generation workflow (e.g., when bumping or regenerating configs), rather than being accidentally dropped on the next auto-regeneration. Based on learnings, this is where such options are expected to live.config/kernel/linux-mvebu-edge.config (1)
10-10: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y here correctly enforces unprivileged BPF default‑offThis is consistent with the surrounding BPF settings (JIT and cgroup/netfilter BPF remain enabled) and with the PR’s goal of disabling unprivileged eBPF by default on mvebu edge; no further changes needed in this file.
Please verify a test kernel for an mvebu edge board to confirm
/sys/devices/system/cpu/vulnerabilities/spectre_v2no longer reports “Unprivileged eBPF enabled” and that root-initiated BPF usage still works as expected.config/kernel/linux-meson64-current.config (1)
10-10: Meson64: unprivileged BPF default‑off is enabled as intendedWith
CONFIG_BPF_SYSCALL=yandCONFIG_BPF_JIT=yalready set, addingCONFIG_BPF_UNPRIV_DEFAULT_OFF=ycleanly disables unprivileged BPF by default while preserving BPF functionality for privileged callers; this matches the PR’s stated mitigation goal.Recommend building and booting a meson64 current kernel to confirm both the Spectre V2 vulnerability string and basic privileged BPF workflows behave as expected.
config/kernel/linux-sunxi-current.config (1)
9-9: Sunxi: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y aligns with the cross‑family policySetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext to the existingCONFIG_BPF_JIT=ybrings sunxi current in line with the rest of the defconfigs that disable unprivileged BPF by default while keeping BPF available to privileged code.Please confirm on a sunxi current image that the Spectre V2 vulnerability output no longer reports “Unprivileged eBPF enabled” and that root‑driven BPF use (tc/xdp, cgroup BPF, etc.) continues to function.
config/kernel/linux-mvebu64-edge.config (1)
8-11: BPF unprivileged default‑off is correctly enabled for mvebu64 edgeHere
CONFIG_BPF_SYSCALL=y,CONFIG_BPF_JIT=y, andCONFIG_BPF_UNPRIV_DEFAULT_OFF=yform a consistent set: privileged BPF remains available, while unprivileged BPF is disabled by default, which is exactly what this PR targets.config/kernel/linux-sunxi-edge.config (1)
7-9: 32‑bit sunxi edge now matches unprivileged BPF policy of other familiesAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext toCONFIG_BPF_JIT=ybrings this 32‑bit sunxi defconfig in line with the rest of the PR’s kernels by disabling unprivileged BPF while preserving JIT and privileged use.config/kernel/linux-odroidxu4-current.config (1)
7-10: Odroid XU4 current defconfig correctly disables unprivileged BPF by defaultWith
CONFIG_BPF_SYSCALL=yandCONFIG_BPF_JIT=yalready enabled, settingCONFIG_BPF_UNPRIV_DEFAULT_OFF=yis the correct way to turn off unprivileged eBPF by default on this kernel and should address the misleading Spectre v2 “Unprivileged eBPF enabled” vulnerability message.config/kernel/linux-rockchip-rk3588-edge.config (1)
92-106: EnablingCONFIG_BPF_UNPRIV_DEFAULT_OFFmatches the PR’s security goalSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent withCONFIG_BPF_SYSCALL=yand correctly makes unprivileged BPF disabled by default on rk3588 edge kernels, which should clear the “Vulnerable: Unprivileged eBPF enabled” spectre_v2 message while still allowing admins to re-enable it via the sysctl if they explicitly choose to.If not already done in this PR, ensure the same option is set for the corresponding
*-current/other rk3588 kernel configs so behavior is consistent across branches for this family.config/kernel/linux-bcm2711-edge.config (1)
10-10: LGTM - Security hardening applied correctly.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFFrestricts unprivileged users from using BPF by default, which addresses the Spectre v2 mitigation warning mentioned in the PR description. This change is consistent across all board configurations in this PR and is an appropriate security hardening measure.config/kernel/linux-rockchip-current.config (1)
11-11: LGTM - Consistent security hardening.The change correctly enables
CONFIG_BPF_UNPRIV_DEFAULT_OFFto restrict unprivileged BPF access, addressing the security concern outlined in the PR. This is consistent with the changes across all 29 board configuration files.config/kernel/linux-bcm2711-legacy.config (1)
10-10: LGTM - Security hardening applied to legacy kernel.The change appropriately enables
CONFIG_BPF_UNPRIV_DEFAULT_OFFin the legacy kernel configuration, ensuring consistent security posture across all kernel variants. This addresses the vulnerability warning mentioned in the PR description.config/kernel/linux-imx6-current.config (1)
10-13: EnablingCONFIG_BPF_UNPRIV_DEFAULT_OFFhere is correct and consistent with the PR goalWith BPF and JIT already enabled, setting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yis the right way to default‑disable unprivileged eBPF while preserving privileged BPF usage and should address the misleading spectre_v2 vulnerability status. No config dependency issues are apparent in this context.config/kernel/linux-thead-legacy.config (1)
181-183:CONFIG_BPF_UNPRIV_DEFAULT_OFF=yis a safe, aligned hardening change hereGiven
CONFIG_BPF=yandCONFIG_BPF_SYSCALL=y, turning onCONFIG_BPF_UNPRIV_DEFAULT_OFFcorrectly defaults unprivileged eBPF off on this thead legacy kernel as well, matching the rest of the platforms in the PR and improving the reported vulnerability status without impacting privileged BPF use.config/kernel/linux-imx6-legacy.config (1)
101-111: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y correctly enforces unprivileged eBPF default‑offSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere resolves the incorrect Spectre v2 vulnerability report showing "Unprivileged eBPF enabled" on ARM32 and ARM64 devices. While eBPF remains available to privileged users (root/CAP_BPF), unprivileged access is now default‑disabled, which eliminates the false vulnerability warning.config/kernel/linux-odroidxu4-edge.config (1)
9-9: Security improvement: unprivileged BPF disabled by default.This change appropriately restricts unprivileged BPF access while maintaining privileged BPF functionality (CONFIG_BPF_SYSCALL remains enabled). This addresses the misleading Spectre v2 vulnerability warning and aligns with security best practices.
config/kernel/linux-bcm2711-current.config (1)
10-10: Security improvement: unprivileged BPF disabled by default.Enabling CONFIG_BPF_UNPRIV_DEFAULT_OFF enhances security by restricting unprivileged BPF access while preserving privileged BPF functionality. This change is consistent with the security posture improvements across all affected configurations.
config/kernel/linux-mvebu-current.config (1)
10-10: Security improvement: unprivileged BPF disabled by default.This change correctly restricts unprivileged BPF access by default, addressing the security concern outlined in the PR objectives. The configuration maintains privileged BPF functionality for administrative use while mitigating potential security risks from unprivileged access.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
config/kernel/linux-rockchip-current.config (1)
9-11: CONFIG_BPF_UNPRIV_DEFAULT_OFF here looks correct and matches the PR goalWith
CONFIG_BPF_SYSCALL=yandCONFIG_BPF_JIT=yalready enabled, settingCONFIG_BPF_UNPRIV_DEFAULT_OFF=yis the right way to keep BPF available for privileged users while disabling unprivileged eBPF by default, which aligns with the spectre_v2 mitigation/output fix. Also, doing this inconfig/kernel/*(family-level config) matches prior guidance to avoid board-level kernel tweaks. Based on learnings, this is the appropriate place and shape for the change.If you want this to survive future automated config regenerations, you could also wire this into the kernel-config generation tooling (e.g.,
armbian-kernel.sh) so subsequent rewrites keepCONFIG_BPF_UNPRIV_DEFAULT_OFF=y.config/kernel/linux-mvebu-edge.config (1)
9-10: Change cleanly enforces unprivileged eBPF default‑off on mvebuAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext toCONFIG_BPF_JIT=yachieves the intended “unprivileged BPF off by default” behavior here as well, staying consistent with the rest of the PR and leaving privileged BPF use intact.If you plan more kernel‑wide security policy tweaks later, consider wiring this into the kernel‑config generation tooling (rather than only editing the overlay configs) so future automated rewrites can’t accidentally revert it, but this specific change looks fine as‑is.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (32)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (22)
- config/kernel/linux-mvebu64-edge.config
- config/kernel/linux-sunxi-edge.config
- config/kernel/linux-rockchip64-current.config
- config/kernel/linux-mvebu64-legacy.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-meson64-edge.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-virtual-current.config
- config/kernel/linux-rk35xx-vendor.config
- config/kernel/linux-odroidxu4-current.config
- config/kernel/linux-sunxi64-current.config
- config/kernel/linux-thead-legacy.config
- config/kernel/linux-mvebu-current.config
- config/kernel/linux-sunxi64-legacy.config
- config/kernel/linux-rockchip-edge.config
- config/kernel/linux-imx6-edge.config
- config/kernel/linux-odroidxu4-edge.config
- config/kernel/linux-rockchip-rk3588-edge.config
- config/kernel/linux-mvebu-legacy.config
- config/kernel/linux-rk322x-current.config
- config/kernel/linux-bcm2711-legacy.config
- config/kernel/linux-imx6-legacy.config
🧰 Additional context used
🧠 Learnings (18)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:96-169
Timestamp: 2025-10-03T11:42:46.660Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), deletion of kernel config files does not need to be handled. The workflow intentionally only captures ACMR (added/copied/modified/renamed) changes and does not need to propagate deletions to the aggregator.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:217-220
Timestamp: 2025-10-04T17:59:19.369Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), the workflow is designed to rewrite existing kernel configs only. New/untracked files can be safely ignored, so using `git diff --quiet` (which ignores untracked files) is the correct approach for detecting changes rather than `git status --porcelain`.
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-sunxi-current.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-sunxi-current.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-sunxi-current.config
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-meson64-current.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
config/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-imx6-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip64-edge.configconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-rk322x-edge.configconfig/kernel/linux-meson64-current.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-sunxi-current.config
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Applied to files:
config/kernel/linux-rockchip64-edge.configconfig/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-10-11T19:52:54.648Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8746
File: config/kernel/linux-filogic-edge.config:344-470
Timestamp: 2025-10-11T19:52:54.648Z
Learning: The chainsx/linux-filogic kernel (legacy branch) for BPI-R4 uses out-of-tree proprietary drivers (CONFIG_NET_DSA_AN8855, CONFIG_AIROHA_EN8801SC_PHY, CONFIG_AIR_AN8855_PHY, CONFIG_MDIO_AN8855, CONFIG_MFD_AIROHA_AN8855). The frank-w/BPI-Router-Linux kernel (current and edge branches) uses mainline kernel drivers instead: CONFIG_NET_DSA_MT7530 for the DSA switch and CONFIG_MEDIATEK_2P5GE_PHY for PHY support. These provide equivalent functionality for BPI-R4 networking.
Applied to files:
config/kernel/linux-rk322x-edge.config
🔇 Additional comments (8)
config/kernel/linux-mvebu64-current.config (1)
9-11: Consistent BPF hardening for mvebu64 (LGTM)Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yalongsideCONFIG_BPF_SYSCALL=y/CONFIG_BPF_JIT=ygives the expected “unprivileged BPF disabled by default” behaviour while keeping privileged BPF support. This is consistent with the other families in the PR and with the stated objective of silencing the incorrect “Unprivileged eBPF enabled” vulnerability message.config/kernel/linux-sunxi-current.config (1)
8-9: Sunxi current: unprivileged BPF default‑off is appropriateAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yon top of existing BPF support is in line with the rest of the families and should give the intended “unprivileged BPF disabled by default” behaviour without impacting privileged BPF users.config/kernel/linux-sunxi64-edge.config (1)
7-8: Sunxi64 edge: BPF_UNPRIV_DEFAULT_OFF=y is consistent and safeSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere aligns the 6.16 sunxi64 edge kernel with the rest of the configs in this PR, disabling unprivileged eBPF by default while keeping BPF functionality for privileged callers. No conflicting options are visible in this defconfig.config/kernel/linux-meson64-current.config (1)
10-10: LGTM - Security improvement.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ycorrectly disables unprivileged eBPF access by default, resolving the misleading CPU vulnerability warning. This change improves the security posture while maintaining eBPF functionality for privileged operations.config/kernel/linux-rk322x-edge.config (1)
95-107: BPF unprivileged default‑off here is consistent and low‑riskSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yalongsideCONFIG_BPF=yandCONFIG_BPF_JIT=ycorrectly makes unprivileged eBPF default‑off while preserving all privileged BPF functionality, which aligns with the PR’s Spectre v2 mitigation intent and the rest of this config. No conflicts visible in the surrounding BPF/netfilter options.config/kernel/linux-rockchip64-edge.config (1)
11-11: LGTM - Security hardening improvement.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yis a security improvement that addresses the misleading Spectre v2 vulnerability warning. This setting ensures unprivileged BPF is disabled by default as intended.config/kernel/linux-imx6-current.config (1)
12-12: LGTM - Consistent security improvement across platforms.The change matches the fix applied to other kernel configs in this PR. Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yproperly addresses the unprivileged BPF security concern for the imx6 platform.config/kernel/linux-sunxi-legacy.config (1)
9-9: LGTM! Security improvement properly disables unprivileged BPF by default.Enabling
CONFIG_BPF_UNPRIV_DEFAULT_OFFcorrectly disables unprivileged BPF by default, which fixes the misleading vulnerability warning and improves security posture by reducing the kernel attack surface. Users can still enable unprivileged BPF at runtime via sysctl if needed.
tabrisnet
changed the title
Collaborator
|
If this is so important, wouldn't it make more sense to just modify Second, did you try running |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 3489 🏁 Script executed: Length of output: 0 🏁 Script executed: Length of output: 177 🏁 Script executed: Length of output: 50 @tabrisnet: You're absolutely correct! Based on the Armbian build system architecture, modifying I examined the Recommended approach: Add function armbian_kernel_config__600_enable_ebpf_and_btf_info() {
if [[ "${KERNEL_BTF}" == "no" ]]; then
display_alert "Disabling eBPF and BTF info for kernel" "as requested by KERNEL_BTF=no" "info"
opts_y+=("DEBUG_INFO_NONE")
opts_n+=("DEBUG_INFO" "DEBUG_INFO_DWARF5" "DEBUG_INFO_BTF" "DEBUG_INFO_BTF_MODULES")
else
# ... existing memory check logic ...
display_alert "Enabling eBPF and BTF info" "for fully BTF & CO-RE enabled kernel" "info"
opts_n+=("DEBUG_INFO_NONE")
opts_y+=(
"BPF_JIT" "BPF_JIT_DEFAULT_ON" "FTRACE_SYSCALLS" "PROBE_EVENTS_BTF_ARGS" "BPF_KPROBE_OVERRIDE"
"DEBUG_INFO" "DEBUG_INFO_DWARF5" "DEBUG_INFO_BTF" "DEBUG_INFO_BTF_MODULES"
"BPF_UNPRIV_DEFAULT_OFF" # Add this line - disable unprivileged BPF by default
)
fi
}Benefits:
@neheb: The mode change you noticed is because 🧠 Learnings used |
Fixes wrong CPU vulnerability output:
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation:Vulnerable:
Unprivileged eBPF enabled
It's enabled but CONFIG_BPF_UNPRIV_DEFAULT_OFF being unset causes the
warning.
This warning happens on ARM32 and ARM64 devices.
Edited with:
find -name "*.config" -exec sed -i 's/# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set/CONFIG_BPF_UNPRIV_DEFAULT_OFF=y/g' '{}' \;
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Contributor
Author
|
@tabrisnet I think this is what you meant. |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (4)
config/kernel/linux-sunxi-current.config (1)
8-11: Sunxi: BPF_UNPRIV_DEFAULT_OFF addition matches the cross‑family policyEnabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext toCONFIG_BPF_JIT=yis consistent with the other defconfigs in this PR and with the stated objective to have unprivileged eBPF off by default on ARM32 as well.Process/automation considerations for these config changes are already covered in the comment on
linux-mvebu64-current.config.config/kernel/linux-odroidxu4-current.config (1)
7-11: Odroid XU4: consistent BPF_UNPRIV_DEFAULT_OFF enablementThis mirrors the other families by pairing
CONFIG_BPF_SYSCALL=y/CONFIG_BPF_JIT=ywithCONFIG_BPF_UNPRIV_DEFAULT_OFF=y, so the unprivileged eBPF default is uniform on this SoC too.Automation vs manual‑edit guidance for kernel configs is already noted in the first file’s comment.
config/kernel/linux-mvebu-edge.config (1)
8-12: mvebu edge: align edge/current with BPF_UNPRIV_DEFAULT_OFF=ySetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere keeps the edge mvebu kernel in sync with the current variant and with the repository‑wide policy established in this PR.The note about generating these config deltas via the standard rewrite tooling instead of manual edits is already given on
linux-mvebu64-current.config.config/kernel/linux-rockchip-current.config (1)
11-11: Manual config edit is redundant (same issue as other config files).This manual addition follows the same pattern as the other config files in this PR. As explained in the PR comments, the proper approach is to rely on the
armbian-kernel.shchange and regenerate configs automatically viarewrite-kernel-config, rather than manually editing config files with sed.Based on learnings about Armbian's automated kernel config generation process.
🧹 Nitpick comments (1)
config/kernel/linux-virtual-current.config (1)
90-103: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y matches the PR goal; just ensure it’s driven via the central config machineryEnabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent with the intent to have unprivileged eBPF disabled by default while keeping BPF/JIT available for privileged users, and should help avoid the misleading Spectre v2 “Unprivileged eBPF enabled” status on this kernel.Given these
.configfiles are auto-generated overlays, please double‑check that:
lib/functions/compilation/armbian-kernel.sh(e.g.armbian_kernel_config__600_enable_ebpf_and_btf_info) is also settingBPF_UNPRIV_DEFAULT_OFF, andrewrite-kernel-confighas been run so this file reflects the scripted change rather than a one‑off manual edit.That keeps this setting stable across future config rewrites and avoids drift.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (33)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)lib/functions/compilation/armbian-kernel.sh(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (21)
- config/kernel/linux-rockchip-edge.config
- config/kernel/linux-rockchip64-edge.config
- config/kernel/linux-imx6-legacy.config
- config/kernel/linux-sunxi-edge.config
- config/kernel/linux-rockchip64-current.config
- config/kernel/linux-rockchip-rk3588-edge.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-imx6-edge.config
- config/kernel/linux-mvebu-legacy.config
- config/kernel/linux-sunxi64-legacy.config
- config/kernel/linux-bcm2711-legacy.config
- config/kernel/linux-rk35xx-vendor.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-sunxi-legacy.config
- config/kernel/linux-odroidxu4-edge.config
- config/kernel/linux-sunxi64-edge.config
- config/kernel/linux-imx6-current.config
- config/kernel/linux-mvebu64-edge.config
- config/kernel/linux-mvebu64-legacy.config
- config/kernel/linux-rk322x-edge.config
- config/kernel/linux-thead-legacy.config
🧰 Additional context used
🧠 Learnings (20)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:217-220
Timestamp: 2025-10-04T17:59:19.369Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), the workflow is designed to rewrite existing kernel configs only. New/untracked files can be safely ignored, so using `git diff --quiet` (which ignores untracked files) is the correct approach for detecting changes rather than `git status --porcelain`.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:96-169
Timestamp: 2025-10-03T11:42:46.660Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), deletion of kernel config files does not need to be handled. The workflow intentionally only captures ACMR (added/copied/modified/renamed) changes and does not need to propagate deletions to the aggregator.
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:48:09.091Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the user prefers flexible grep patterns over anchored ones for BTRFS configuration checks, but agrees to use quiet grep (-q) to avoid polluting build logs.
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-09-22T21:59:36.334Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:200-200
Timestamp: 2025-09-22T21:59:36.334Z
Learning: Functions named with the pattern `armbian_kernel_config__*` in lib/functions/compilation/armbian-kernel.sh are automatically discovered and invoked by Armbian's extension system via metaprogramming using `compgen -A function`, without requiring explicit registration or calls.
Applied to files:
lib/functions/compilation/armbian-kernel.sh
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-26T12:56:29.185Z
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rk322x-current.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-odroidxu4-current.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-odroidxu4-current.config
📚 Learning: 2025-11-08T06:39:24.527Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8886
File: patch/kernel/rk35xx-vendor-6.1/dt/rk3528-nanopi-rev01.dts:9-9
Timestamp: 2025-11-08T06:39:24.527Z
Learning: In Armbian's Rockchip vendor kernel branches (rk35xx-vendor), device tree files may not require the same headers as mainline Linux. For example, input key definitions like KEY_BACK and KEY_VOLUMEUP may be handled differently in BSP kernels and don't necessarily need explicit includes like <dt-bindings/input/input.h> that would be required in mainline kernel device trees.
Applied to files:
config/kernel/linux-rockchip-current.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-mvebu-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi-current.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Applied to files:
config/kernel/linux-meson64-edge.config
🔇 Additional comments (6)
config/kernel/linux-mvebu64-current.config (1)
9-12: CONFIG_BPF_UNPRIV_DEFAULT_OFF placement is correctThis aligns with the PR goal of disabling unprivileged eBPF by default while keeping BPF enabled for privileged use. The change is consistently applied across all 37 kernel config families in the codebase, confirming it came from the automated
rewrite-kernel-configworkflow rather than manual editing.config/kernel/linux-meson64-current.config (1)
10-10: LGTM! Security configuration correctly applied.The addition of
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yproperly disables unprivileged BPF by default, which resolves the incorrect CPU vulnerability output mentioned in the PR description. The placement alongside other BPF-related options (afterCONFIG_BPF_JIT=y) is logical and consistent.Based on the PR comments and AI summary, this PR follows the recommended approach of updating both
lib/functions/compilation/armbian-kernel.sh(for future config generation) and existing config files (for immediate deployment), which ensures consistency across all platforms.config/kernel/linux-sunxi64-current.config (1)
9-9: LGTM! Consistent security configuration.The
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ysetting is correctly applied, consistent with other platform configurations in this PR. This ensures unprivileged BPF is disabled by default on sunxi64 platforms.config/kernel/linux-rk322x-current.config (1)
95-107: BPF_UNPRIV_DEFAULT_OFF correctly enabled for rk322xSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent withCONFIG_BPF=yandCONFIG_BPF_JIT=y, and achieves the PR’s goal of default‑disabling unprivileged BPF on this kernel family. No conflicts or regressions are apparent.config/kernel/linux-mvebu-current.config (1)
6-15: Unprivileged BPF default‑off enabled for mvebu as intendedAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ybesideCONFIG_BPF_JIT=ycleanly applies the “unprivileged eBPF disabled by default” policy to the mvebu defconfig and is consistent with the rest of the networking/BPF setup.lib/functions/compilation/armbian-kernel.sh (1)
123-123: LGTM! This is the correct approach.Adding
BPF_UNPRIV_DEFAULT_OFFto the opts_y array in the eBPF/BTF configuration function is the proper way to enable this option across all Armbian kernel configs. This change will automatically apply the setting when kernel configs are regenerated through the automated process.The placement alongside other BPF-related options is appropriate, and this single change should eliminate the need for manual edits to individual config files.
Based on learnings about Armbian's kernel config automation and the PR discussion recommendation.
| CONFIG_BPF_JIT=y | ||
| CONFIG_BPF_JIT_ALWAYS_ON=y | ||
| # CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set | ||
| CONFIG_BPF_UNPRIV_DEFAULT_OFF=y |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Search for any reference to BPF_UNPRIV_DEFAULT_OFF in the codebase
rg -i "BPF_UNPRIV_DEFAULT_OFF" --max-count=20Repository: armbian/build
Length of output: 6936
🏁 Script executed:
# Search for linux-meson64-edge.config to understand its structure
fd -t f "linux-meson64-edge.config" | head -5Repository: armbian/build
Length of output: 96
🏁 Script executed:
# Check if armbian-kernel.sh exists and search for relevant changes
fd -t f "armbian-kernel.sh" | head -5Repository: armbian/build
Length of output: 100
🏁 Script executed:
# Find where BPF_UNPRIV_DEFAULT_OFF is referenced in armbian-kernel.sh
rg -A 5 -B 5 "BPF_UNPRIV_DEFAULT_OFF" lib/functions/compilation/armbian-kernel.shRepository: armbian/build
Length of output: 501
🏁 Script executed:
# Look for opts_y array definition in armbian-kernel.sh
rg -A 20 "opts_y\s*=" lib/functions/compilation/armbian-kernel.sh | head -50Repository: armbian/build
Length of output: 39
🏁 Script executed:
# Check the linux-meson64-edge.config file around the BPF_UNPRIV_DEFAULT_OFF line to understand context
head -20 config/kernel/linux-meson64-edge.configRepository: armbian/build
Length of output: 533
🏁 Script executed:
# Check git history for when BPF_UNPRIV_DEFAULT_OFF was added to armbian-kernel.sh
git log --oneline -S "BPF_UNPRIV_DEFAULT_OFF" -- lib/functions/compilation/armbian-kernel.sh | head -10Repository: armbian/build
Length of output: 105
🏁 Script executed:
# Get more details on when it was added
git log -p -S "BPF_UNPRIV_DEFAULT_OFF" -- lib/functions/compilation/armbian-kernel.sh | head -100Repository: armbian/build
Length of output: 39
🏁 Script executed:
# Get the commit details for when BPF_UNPRIV_DEFAULT_OFF was added
git show 47db71fa --statRepository: armbian/build
Length of output: 50370
🏁 Script executed:
# Check if there are any recent manual edits to linux-meson64-edge.config
git log -p --follow -S "CONFIG_BPF_UNPRIV_DEFAULT_OFF" -- config/kernel/linux-meson64-edge.config | head -150Repository: armbian/build
Length of output: 39
🏁 Script executed:
# Get recent commits to armbian-kernel.sh to see if BPF_UNPRIV_DEFAULT_OFF is a recent addition
git log --oneline -20 -- lib/functions/compilation/armbian-kernel.shRepository: armbian/build
Length of output: 105
Manual config edits will be overwritten by the automated rewrite process.
The CONFIG_BPF_UNPRIV_DEFAULT_OFF=y entries added via sed to config files are redundant since BPF_UNPRIV_DEFAULT_OFF is already configured in the opts_y array in armbian-kernel.sh. When rewrite-kernel-config runs, it will regenerate these files from the automated build process, overwriting the manual sed edits.
Recommended action: Remove the manual sed edits to config files; the kernel config rewrite workflow will properly apply the setting through armbian-kernel.sh.
🤖 Prompt for AI Agents
In config/kernel/linux-meson64-edge.config around line 10, the manual insertion
of CONFIG_BPF_UNPRIV_DEFAULT_OFF=y is redundant and will be overwritten by the
automated rewrite; remove the manual sed edits that add this line from the repo
(or revert this file to the autogenerated state) and rely on the existing
BPF_UNPRIV_DEFAULT_OFF entry in the opts_y array inside armbian-kernel.sh so the
rewrite-kernel-config workflow applies the setting consistently.
Collaborator
looks reasonable, but again have you tried running |
Contributor
Author
|
looks to be from 5.16. So it looks like these configs are holdovers from before then. |
Collaborator
|
We run a massive |
Contributor
Author
|
After some configuration (my repo was still on master), I started https://github.com/neheb/build/actions/runs/20253971351 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes wrong CPU vulnerability output:
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation:Vulnerable: Unprivileged eBPF enabled
It's enabled but CONFIG_BPF_UNPRIV_DEFAULT_OFF being unset causes the warning.
This warning happens on ARM32 and ARM64 devices.
Edited with:
find -name "*.config" -exec sed -i 's/# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set/CONFIG_BPF_UNPRIV_DEFAULT_OFF=y/g' '{}' ;
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.