Export generated kernel configs

2026-06-12 11:29:02 +08:00
parent e5e8876546
commit 72b7dc3210
2 changed files with 135 additions and 182 deletions
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+arch="${1:?usage: prepare-kernel-config.sh <x86_64|arm64>}"
+
+run_olddefconfig() {
+  if [ "$arch" = "arm64" ]; then
+    timeout 300 make ARCH=arm64 olddefconfig < /dev/null
+  else
+    timeout 300 make olddefconfig < /dev/null
+  fi
+}
+
+apply_policy_config() {
+  scripts/config --disable SYSTEM_TRUSTED_KEYS
+  scripts/config --disable SYSTEM_REVOCATION_KEYS
+
+  scripts/config --enable TCP_CONG_BBR
+  scripts/config --disable DEFAULT_CUBIC
+  scripts/config --enable DEFAULT_BBR
+  scripts/config --set-str DEFAULT_TCP_CONG bbr
+
+  scripts/config --enable NET_SCH_DEFAULT
+  scripts/config --enable NET_SCH_FQ
+  scripts/config --disable DEFAULT_FQ_CODEL
+  scripts/config --disable DEFAULT_PFIFO_FAST
+  scripts/config --enable DEFAULT_FQ
+  scripts/config --set-str DEFAULT_NET_SCH fq
+
+  scripts/config --module NETFILTER_XTABLES
+  scripts/config --enable NETFILTER_XTABLES_LEGACY
+  scripts/config --module IP_NF_IPTABLES_LEGACY
+  scripts/config --module IP_NF_FILTER
+  scripts/config --module IP_NF_NAT
+  scripts/config --module IP_NF_TARGET_MASQUERADE
+  scripts/config --module IP_NF_MANGLE
+  scripts/config --module IP_NF_RAW
+  scripts/config --module IP6_NF_IPTABLES_LEGACY
+  scripts/config --module IP6_NF_FILTER
+  scripts/config --module IP6_NF_NAT
+  scripts/config --module IP6_NF_MANGLE
+  scripts/config --module IP6_NF_RAW
+
+  scripts/config --disable DEBUG_INFO
+  scripts/config --enable DEBUG_INFO_NONE
+  scripts/config --disable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
+  scripts/config --disable DEBUG_INFO_DWARF4
+  scripts/config --disable DEBUG_INFO_DWARF5
+  scripts/config --disable DEBUG_INFO_REDUCED
+  scripts/config --disable DEBUG_INFO_COMPRESSED
+  scripts/config --disable DEBUG_INFO_SPLIT
+  scripts/config --disable DEBUG_INFO_BTF
+  scripts/config --disable DEBUG_INFO_BTF_MODULES
+  scripts/config --disable MODULE_ALLOW_BTF_MISMATCH
+
+  scripts/config --disable AFS_FS
+  scripts/config --disable XFRM_ESP
+  scripts/config --disable INET_ESP
+  scripts/config --disable INET6_ESP
+  scripts/config --disable AF_RXRPC
+  scripts/config --disable RXKAD
+}
+
+require_config_line() {
+  local line="$1"
+  local message="$2"
+  if ! grep -q "^${line}$" .config; then
+    echo "ERROR: $message"
+    exit 1
+  fi
+}
+
+reject_enabled_config() {
+  local symbol="$1"
+  if grep -q "^${symbol}=" .config; then
+    echo "ERROR: ${symbol} is enabled; refusing to continue."
+    exit 1
+  fi
+}
+
+validate_config() {
+  reject_enabled_config CONFIG_XFRM_ESP
+  reject_enabled_config CONFIG_INET_ESP
+  reject_enabled_config CONFIG_INET6_ESP
+  reject_enabled_config CONFIG_AF_RXRPC
+  reject_enabled_config CONFIG_DEBUG_INFO
+
+  require_config_line 'CONFIG_TCP_CONG_BBR=y' 'CONFIG_TCP_CONG_BBR is not built in.'
+  require_config_line 'CONFIG_DEFAULT_BBR=y' 'CONFIG_DEFAULT_BBR is not enabled.'
+  require_config_line 'CONFIG_DEFAULT_TCP_CONG="bbr"' 'CONFIG_DEFAULT_TCP_CONG is not bbr.'
+  require_config_line 'CONFIG_NET_SCH_FQ=y' 'CONFIG_NET_SCH_FQ is not built in.'
+  require_config_line 'CONFIG_NET_SCH_DEFAULT=y' 'CONFIG_NET_SCH_DEFAULT is not enabled.'
+  require_config_line 'CONFIG_DEFAULT_FQ=y' 'CONFIG_DEFAULT_FQ is not enabled.'
+  require_config_line 'CONFIG_DEFAULT_NET_SCH="fq"' 'CONFIG_DEFAULT_NET_SCH is not fq.'
+  require_config_line 'CONFIG_NETFILTER_XTABLES_LEGACY=y' 'CONFIG_NETFILTER_XTABLES_LEGACY is not enabled.'
+  require_config_line 'CONFIG_IP_NF_IPTABLES_LEGACY=m' 'CONFIG_IP_NF_IPTABLES_LEGACY is not module-enabled.'
+  require_config_line 'CONFIG_IP_NF_NAT=m' 'CONFIG_IP_NF_NAT is not module-enabled.'
+  require_config_line 'CONFIG_IP_NF_FILTER=m' 'CONFIG_IP_NF_FILTER is not module-enabled.'
+  require_config_line 'CONFIG_IP_NF_TARGET_MASQUERADE=m' 'CONFIG_IP_NF_TARGET_MASQUERADE is not module-enabled.'
+
+  grep -E 'CONFIG_(DEBUG_INFO_NONE|TCP_CONG_BBR|DEFAULT_BBR|DEFAULT_TCP_CONG|NET_SCH_DEFAULT|NET_SCH_FQ|DEFAULT_FQ|DEFAULT_NET_SCH|NETFILTER_XTABLES_LEGACY|IP_NF_IPTABLES_LEGACY|IP_NF_NAT|IP_NF_FILTER|IP_NF_TARGET_MASQUERADE|IP6_NF_IPTABLES_LEGACY|IP6_NF_NAT|IP6_NF_FILTER)=' .config
+}
+
+case "$arch" in
+  arm64)
+    cp "$GITHUB_WORKSPACE/arm64.config" .config
+    ;;
+  x86_64)
+    cp "$GITHUB_WORKSPACE/x86-64.config" .config
+    ;;
+  *)
+    echo "ERROR: unsupported arch: $arch"
+    exit 1
+    ;;
+esac
+
+apply_policy_config
+run_olddefconfig
+apply_policy_config
+run_olddefconfig
+validate_config
+
+mkdir -p "$GITHUB_WORKSPACE/build-configs"
+cp .config "$GITHUB_WORKSPACE/build-configs/${arch}.config"
+cp .config "$GITHUB_WORKSPACE/build-configs/${arch}-${KERNEL_VERSION}.config"