feat: add support to Debian kernel source builds and kernel patches by fkondej · Pull Request #97 · flashbots/flashbots-images

fkondej · 2026-02-17T16:48:28Z

No description provided.

…cript

alexhulbert · 2026-02-17T16:52:57Z

buildernet/kernel/config.d/03-bbr-net-fq

@bakhtin Are these three files things we want to include on all of our debian-based kernels?

if they work for all our projects then yes. We can also merge all 3 fragments into one.

@alexhulbert should I move into kernel and merge these files? For now they are under buildernet/kernel/config.d/

Yes, they should be moved to the kernel directory and added to the defaults. The buildernet folder is deleted by my PR anyway, since we're going to swap it out with the real one from the buildernet branch.

alexhulbert · 2026-02-17T20:59:59Z

buildernet/kernel/config.d/01-sane-defaults

+CONFIG_CRYPTO_SHA256_SSSE3=y
+CONFIG_CRYPTO_SHA512_SSSE3=y
+CONFIG_CRYPTO_SIMD=y
+# CONFIG_DEFAULT_CUBIC is not set


@bakhtin I'm worried that these are just comments and they won't actually override anything. Perhaps we should set them to =n manually?

I haven't edited any of the kernel configs manually, they are all produced with the in-tree helper scripts after tweaking the parameters with menuconfig. I don't fully understand how these parameters are later parsed by the kernel build scripts but I can confirm that final image has a default congestion algorithm set to bbr.

I also discourage to edit kernel configs manually as you don't know the full dependency chain of every parameter. The order the parameters appear in the config also seem to matter.

According to https://www.spinics.net/lists/kernel/msg4259558.html:

"Kconfig accepts both '# CONFIG_FOO is not set' and 'CONFIG_FOO=n' as a valid input."

So these do correctly disable the options.

I can't find a good docs about this, but e.g. this: zephyrproject-rtos/zephyr#5443 (comment).

And I agree with @bakhtin to not edit generated config fragments manually. @alexhulbert can you confirm you're good with this?

I'm still not 100% convinced. Could you explicitly test that adding a "# XYZ is not set" line after a XYZ=y line disables the option on a parameter whose default is false?

bakhtin

Good start. But so far this looks a bit bloated and too verbose.

bakhtin · 2026-02-18T10:25:26Z

buildernet/kernel/config.d/01-sane-defaults

+CONFIG_CRYPTO_SHA256_SSSE3=y
+CONFIG_CRYPTO_SHA512_SSSE3=y
+CONFIG_CRYPTO_SIMD=y
+# CONFIG_DEFAULT_CUBIC is not set


I haven't edited any of the kernel configs manually, they are all produced with the in-tree helper scripts after tweaking the parameters with menuconfig. I don't fully understand how these parameters are later parsed by the kernel build scripts but I can confirm that final image has a default congestion algorithm set to bbr.

I also discourage to edit kernel configs manually as you don't know the full dependency chain of every parameter. The order the parameters appear in the config also seem to matter.

bakhtin · 2026-02-18T10:26:40Z

buildernet/kernel/config.d/03-bbr-net-fq

if they work for all our projects then yes. We can also merge all 3 fragments into one.

kernel/mkosi.build

bakhtin · 2026-02-18T11:32:43Z

kernel/mkosi.build

+        rm -f "$build_dir/.version"
+
+        mkosi-chroot --chdir "$chroot_build_dir" make olddefconfig
+        mkosi-chroot --chdir "$chroot_build_dir" make -j "$(nproc 2>/dev/null || echo 2)" bzImage ARCH=x86_64 CONFIG_EFI_STUB=y


@alexhulbert I remember we agreed to build a DEB package with the kernel and install it normally in the mkosi.conf file as a normal package.

@fkondej If you're gonna do this make sure to not build unnecessary artifacts. In trunk/buildernet I have this: export DEB_BUILD_PROFILES='nodoc noudeb pkg.linux.nosource pkg.linux.notools pkg.linux.nokerneldbg pkg.linux.nokerneldbginfo pkg.linux.nometa' to avoid building extra dependencies.

Agreed on DEB package

Done. building .deb with DEB_BUILD_PROFILES. The .deb is copied to $PACKAGEDIR and installed via VolatilePackages.

@bakhtin I'm pretty sure the DEB_BUILD_PROFILES line is doing nothing. Those build profiles are hardcoded directly into the debian control file, so they're ignored if you call make bindeb-pkg directly. Also, when calling that make target directly, KDEB_SOURCENAME defaults to linux-upstream. So I think the correct line here is DEB_BUILD_PROFILES='pkg.linux-upstream.nokernelheaders pkg.linux-upstream.nokerneldbg'. The other ones aren't relevant anyway since the bindeb-pkg target doesn't make doc/udeb/etc deb files.

bakhtin · 2026-02-18T11:34:17Z

buildernet/mkosi.conf

 [Build]
 Environment=LIGHTHOUSE_BINARY RETH_BINARY RBUILDER_BINARY
+            KERNEL_VERSION_DEBIAN=6.16
+            KERNEL_CONFIG_SNIPPETS_BUILDERNET=kernel/configs/debian/01-sane-defaults,kernel/configs/debian/02-disable-unneeded,kernel/configs/debian/03-bbr-net-fq


If would be easier to just have a script to find all the snippets in some well-known directory to avoid adding a new one here every time.

Done: env vars KERNEL_CONFIG_SNIPPETS* and KERNEL_PATCHES* points now to directories */kernel/config.d and */kernel/patches, and the build script auto-discovers all files in there.

@bakhtin @alexhulbert does this match what you wanted?

…hash

…ries

alexhulbert · 2026-02-20T16:05:47Z

base/mkosi.conf

+# KERNEL_VERSION must match a linux-source package available in this snapshot
+Mirror=https://snapshot.debian.org/archive/debian/20251113T083151Z/


This isn't accurate since the base module doesn't prescribe an explicit timestamp. This comment should probably be removed to avoid confusion.

alexhulbert · 2026-02-20T16:08:31Z

base/mkosi.conf


 CleanPackageMetadata=true
+# Kernel .deb is built by kernel/mkosi.build and placed in $PACKAGEDIR
+VolatilePackages=linux-image-6.16.3-mkosi-cloud


This can't be hardcoded

alexhulbert · 2026-02-20T16:08:58Z

base/mkosi.conf

+              dpkg-dev
+              debhelper
+              libdw-dev
+              python3


Are you sure we need python3 to build the Debian kernel?

alexhulbert · 2026-02-20T16:09:54Z

bob-common/mkosi.conf

 [Build]
-Environment=KERNEL_CONFIG_SNIPPETS=kernel/snippets/ubuntu.config KERNEL_CONFIG_SNIPPETS_BOB=bob-common/kernel.config
+Environment=KERNEL_CONFIG_SNIPPETS_BOB=bob-common/kernel/config.d
+            KERNEL_PATCHES_BOB=bob-common/kernel/patches


We don't have bob kernel patches

alexhulbert · 2026-02-20T16:10:25Z

bob-l1.conf

-
-[Distribution]
-Mirror=https://snapshot.debian.org/archive/debian/20251113T083151Z/
-
-[Build]
-ToolsTreeMirror=https://snapshot.debian.org/archive/debian/20251113T083151Z/


These shouldn't be removed. This snapshot should have new enough kernels.

alexhulbert · 2026-02-20T18:55:28Z

kernel/mkosi.build

+    export LOCALVERSION  # e.g. -mkosi-cloud → kernel version becomes 6.16.3-mkosi-cloud
+    # TODO: Explore whether these profiles apply to upstream bindeb-pkg:
+    # https://github.com/torvalds/linux/blob/master/scripts/package/mkdebian
+    export DEB_BUILD_PROFILES='nodoc noudeb pkg.linux.nosource pkg.linux.notools pkg.linux.nokerneldbg pkg.linux.nokerneldbginfo pkg.linux.nometa'


Replace with pkg.linux-upstream.nokernelheaders pkg.linux-upstream.nokerneldbg (see my comment above in the thread with Artyom)

alexhulbert · 2026-02-20T19:03:10Z

kernel/mkosi.build

+        rm -f "$build_dir/.version"
+
+        mkosi-chroot --chdir "$chroot_build_dir" make olddefconfig
+        mkosi-chroot --chdir "$chroot_build_dir" make -j "$(nproc 2>/dev/null || echo 2)" bzImage ARCH=x86_64 CONFIG_EFI_STUB=y


@bakhtin I'm pretty sure the DEB_BUILD_PROFILES line is doing nothing. Those build profiles are hardcoded directly into the debian control file, so they're ignored if you call make bindeb-pkg directly. Also, when calling that make target directly, KDEB_SOURCENAME defaults to linux-upstream. So I think the correct line here is DEB_BUILD_PROFILES='pkg.linux-upstream.nokernelheaders pkg.linux-upstream.nokerneldbg'. The other ones aren't relevant anyway since the bindeb-pkg target doesn't make doc/udeb/etc deb files.

alexhulbert · 2026-02-20T19:08:48Z

kernel/config.d/00-no-modules

@@ -0,0 +1 @@
+# CONFIG_MODULES is not set


Missing trailing newline. This is very important for the merge script so that the first line of one file isn't combined with the last line of another file

alexhulbert · 2026-02-20T19:17:59Z

kernel/mkosi.build

+        echo "ERROR: merge_config.sh not found in kernel source" >&2
+        exit 1
+    fi
+    cloud_config_xz="$BUILDROOT/usr/src/linux-config-${KERNEL_VERSION}/config.amd64_none_cloud-amd64.xz"


Even though we're going to hardcode the cloud flavor into an env var at the top of this file, this should still reference the flavor and not separately hardcode the word cloud

alexhulbert · 2026-02-20T19:27:19Z

kernel/mkosi.build

-cp "$kernel_file" "$DESTDIR/usr/lib/modules/$KERNEL_VERSION/vmlinuz"
-rm -f "$config_file"
+    # Clean up unwanted build artifacts
+    rm -f "$BUILDROOT/build"/*.deb "$BUILDROOT/build"/*.buildinfo "$BUILDROOT/build"/*.changes


This could potentially delete artifacts written by other modules. The kernel should be built in a subdirectory of /build and the whole subdirectory should be cleaned up when its done

fkondej added 10 commits February 13, 2026 16:30

feat: add top level if/else

d28fc9e

feat: move KERNEL_VERSION_DEBIAN into mkosi.conf

14194c5

feat: refactor kernel snippet collection into shared array

505f9c9

feat: add patch paths collection and include patch contents in cache key

00f6b20

feat: add reusable apply patches

ae04345

feat: calculate cache hash and pull base kernel from debian source

8d0bf63

feat: build kernel from debian source

5c81568

feat: use debian kernel for buildernet VM and improvements to build s…

99bcf98

…cript

chore: add indentation in GitHub path of kernel build script

8c77b93

chore: cleanup

c30007a

fkondej requested a review from alexhulbert February 17, 2026 16:48

fkondej self-assigned this Feb 17, 2026

alexhulbert reviewed Feb 17, 2026

View reviewed changes

alexhulbert added the general improvements label Feb 17, 2026

fkondej requested a review from bakhtin February 18, 2026 09:17

bakhtin reviewed Feb 18, 2026

View reviewed changes

fkondej added 6 commits February 19, 2026 01:21

feat: use Debian kernel source only

2128786

feat: remove inlined CONFIG_MODULES from build script

fc089ae

feat: add FLAVOR to kernel version and include LOCALVERSION in cache …

9fc7ce3

…hash

feat: build and install kernel as .deb package

92aaae9

feat: kernel: auto-discover config fragments and patches from directo…

b7fc636

…ries

chore: remove unused ubuntu.config kernel config snippet

54d7719

fkondej changed the title ~~Add support to Debian kernel source builds and kernel patches~~ feat: add support to Debian kernel source builds and kernel patches Feb 20, 2026

fkondej requested review from alexhulbert and bakhtin February 20, 2026 11:25

alexhulbert requested changes Feb 20, 2026

View reviewed changes

		# KERNEL_VERSION must match a linux-source package available in this snapshot
		Mirror=https://snapshot.debian.org/archive/debian/20251113T083151Z/

		@@ -0,0 +1 @@
		# CONFIG_MODULES is not set No newline at end of file

Conversation

fkondej commented Feb 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fkondej Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bakhtin left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fkondej Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

fkondej Feb 20, 2026 •

edited

Loading

fkondej Feb 20, 2026 •

edited

Loading