kernel configs: disable unprivileged BPF #9082
Open
+1
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
neheb
requested review from
AGM1968,
ColorfulRhino,
HeyMeco,
JohnTheCoolingFan,
PanderMusubi,
SuperKali,
TheSnowfield,
Tonymac32,
ahoneybun,
amazingfate,
brentr,
catalinii,
chainsx,
chraac,
efectn,
ginkage,
igorpecovnik,
janprunk,
joekhoobyar,
krachlatte,
lanefu,
leggewie,
paolosabatino,
prahal,
pyavitz,
rpardini,
schwar3kat,
sgjava,
teknoid and
vidplace7
as code owners
Member
|
Why should this override? |
Collaborator
|
My original question here was whether the automated machinery would elide the changed line altogether, as, being an overlay, if it would already by =y then it would be evaluated as redundant by savedefconfig.
|
Contributor
Author
|
https://github.com/neheb/build/actions/runs/20403772655 refuses to run |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
config/kernel/linux-mvebu-legacy.config (1)
94-105: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y here is correct and aligned with the PR’s goalPlacing
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yalongsideCONFIG_BPF=y/CONFIG_BPF_SYSCALL=ycleanly enforces “unprivileged eBPF default-off” on this legacy mvebu kernel, which is exactly what the spectre_v2 reporting logic expects. No conflicting BPF options are present in this block, so the change is safe and behaviorally clear.If you later regenerate this autogen
.configviarewrite-kernel-config, just ensure the armbian-kernel.sh hook also sets this symbol so the change persists and you don’t see churn in this file. Based on learnings, these configs are overlays on top of arch defconfig and are periodically rewritten.config/kernel/linux-mvebu-current.config (1)
6-12: Defconfig overlay use of CONFIG_BPF_UNPRIV_DEFAULT_OFF=y looks goodSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yin this Armbian mvebu “current” defconfig cleanly enforces unprivileged-BPF default-off (while keepingCONFIG_BPF_JIT=yand privileged BPF intact), matching the PR’s objective and the legacy config behavior. As an overlay, this is the appropriate place to override the kernel’s default for this family; any future rewrite of defconfigs will either preserve or drop it as redundant without functional risk.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (33)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)lib/functions/compilation/armbian-kernel.sh(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (22)
- config/kernel/linux-rockchip-edge.config
- config/kernel/linux-sunxi64-legacy.config
- config/kernel/linux-rockchip64-edge.config
- config/kernel/linux-mvebu64-edge.config
- config/kernel/linux-sunxi64-edge.config
- config/kernel/linux-rockchip-current.config
- config/kernel/linux-odroidxu4-current.config
- config/kernel/linux-rk322x-edge.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-imx6-legacy.config
- lib/functions/compilation/armbian-kernel.sh
- config/kernel/linux-imx6-current.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-meson64-edge.config
- config/kernel/linux-meson64-current.config
- config/kernel/linux-mvebu64-current.config
- config/kernel/linux-rockchip64-current.config
- config/kernel/linux-sunxi-current.config
- config/kernel/linux-sunxi64-current.config
- config/kernel/linux-sunxi-edge.config
- config/kernel/linux-virtual-current.config
- config/kernel/linux-rockchip-rk3588-edge.config
🧰 Additional context used
🧠 Learnings (20)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:48:09.091Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the user prefers flexible grep patterns over anchored ones for BTRFS configuration checks, but agrees to use quiet grep (-q) to avoid polluting build logs.
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
config/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-10-26T12:56:29.185Z
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Applied to files:
config/kernel/linux-rk322x-current.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
config/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Applied to files:
config/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-08-11T22:00:13.411Z
Learnt from: rafayahmed317
Repo: armbian/build PR: 8484
File: config/kernel/linux-rk35xx-vendor.config:904-906
Timestamp: 2025-08-11T22:00:13.411Z
Learning: In the linux-rk35xx-vendor kernel, the LTE driver options (CONFIG_LTE, CONFIG_LTE_RM310, CONFIG_LTE_EM05) are defined as boolean in drivers/net/lte/Kconfig and cannot be built as modules - they must be either built-in (=y) or disabled.
Applied to files:
config/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-11-08T06:39:24.527Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8886
File: patch/kernel/rk35xx-vendor-6.1/dt/rk3528-nanopi-rev01.dts:9-9
Timestamp: 2025-11-08T06:39:24.527Z
Learning: In Armbian's Rockchip vendor kernel branches (rk35xx-vendor), device tree files may not require the same headers as mainline Linux. For example, input key definitions like KEY_BACK and KEY_VOLUMEUP may be handled differently in BSP kernels and don't necessarily need explicit includes like <dt-bindings/input/input.h> that would be required in mainline kernel device trees.
Applied to files:
config/kernel/linux-rk35xx-vendor.config
🔇 Additional comments (8)
config/kernel/linux-mvebu64-legacy.config (1)
10-10: Verify implementation approach: config file edits may not persist.Based on the PR discussion and learnings about the Armbian build system, kernel configuration files in
config/kernel/are autogenerated overlays that are periodically rewritten by automated processes. Direct edits to these files may be overwritten during futurerewrite-kernel-configruns.Per the PR discussion (comments from tabrisnet and coderabbitai), the recommended approach is to add
BPF_UNPRIV_DEFAULT_OFFto theopts_yarray in thearmbian_kernel_config__600_enable_ebpf_and_btf_infofunction inlib/functions/compilation/armbian-kernel.sh. This ensures the configuration persists through the automated kernel config generation workflow: previous config → armbian-kernel.sh changes → make oldconfig → Armbian processing.Please confirm:
- Are changes to
lib/functions/compilation/armbian-kernel.shalso included in this PR but not visible in the current review files?- If only config file edits are being made, have you verified these changes will persist through the next automated rewrite?
Based on learnings about the Armbian build system's kernel configuration workflow.
config/kernel/linux-imx6-edge.config (1)
12-12: Config option correctly enabled; see implementation approach concern.The addition of
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yis correct and addresses the vulnerability warning issue described in the PR objectives. The placement is appropriate alongside other BPF-related configuration options.However, the same persistence concern raised for
linux-mvebu64-legacy.configapplies here regarding the automated kernel config generation workflow. Please ensure the implementation approach will maintain these changes across future automated rewrites.config/kernel/linux-thead-legacy.config (1)
182-182: Verification complete: armbian-kernel.sh properly updated.The concern about manual config file edits being overwritten is addressed. The PR correctly adds
BPF_UNPRIV_DEFAULT_OFFto theopts_yarray in thearmbian_kernel_config__600_enable_ebpf_and_btf_info()function (line 123 oflib/functions/compilation/armbian-kernel.sh), which is the proper approach. The config file entry will be auto-generated from this function during automated config regeneration, so the manual edit is consistent with Armbian's build system architecture.config/kernel/linux-rk322x-current.config (1)
95-107: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y here correctly enforces unprivileged BPF off by defaultWith
CONFIG_BPF,CONFIG_BPF_SYSCALL, andCONFIG_BPF_JITalready enabled, settingCONFIG_BPF_UNPRIV_DEFAULT_OFF=yis the right way to make unprivileged eBPF default‑off on this RK322x kernel and aligns with the PR’s spectre_v2 mitigation goal. Note that this file is an autogenerated Armbian overlay; the canonical behavior should come from the updatedarmbian-kernel.sh, and futurerewrite-kernel-configruns may drop this explicit line if it becomes redundant. Based on learnings, Armbian kernel overlays are periodically regenerated.config/kernel/linux-mvebu-edge.config (1)
6-12: mvebu-edge: enabling CONFIG_BPF_UNPRIV_DEFAULT_OFF=y is consistent and desirableAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext toCONFIG_BPF_JIT=ygives mvebu-edge the same “unprivileged BPF default‑off” behavior as other families, matching the PR’s objective. Since this is an autogenerated Armbian defconfig overlay, ensure the correspondingarmbian-kernel.shlogic is treated as the canonical source and check after runningrewrite-kernel-configthat this setting is preserved (or made redundant) as expected. Based on learnings, these overlays are periodically regenerated.config/kernel/linux-bcm2711-legacy.config (1)
10-10: Configuration change is consistent across files.The change matches the pattern applied to other kernel configs in this PR. The placement after
CONFIG_BPF_JIT=yis appropriate and consistent with the BPF configuration grouping.Please see the verification request in the review of
linux-sunxi-legacy.configregarding the persistence of manual config file changes versus implementing this inarmbian-kernel.sh.config/kernel/linux-odroidxu4-edge.config (1)
9-9: Configuration change is consistent across kernel variants.The change is correctly placed in the BPF configuration section and follows the same pattern as other kernel configs in this PR. The syntax is correct and aligns with the security objective to disable unprivileged BPF by default.
Please refer to the verification request and discussion in the review of
linux-sunxi-legacy.configregarding the optimal approach for ensuring this change persists through Armbian's automated kernel configuration regeneration process.config/kernel/linux-sunxi-legacy.config (1)
9-9: Remove manual CONFIG_BPF_UNPRIV_DEFAULT_OFF additions from config files.
CONFIG_BPF_UNPRIV_DEFAULT_OFFis already being set vialib/functions/compilation/armbian-kernel.shin thearmbian_kernel_config__600_enable_ebpf_and_btf_info()function (line 123, within theopts_yarray). Manual additions of this option to kernel config files are redundant and will be overwritten during Armbian's automated config regeneration process.Remove
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yfrom all config files affected by this PR. The setting is already properly enforced through the automated tooling.⛔ Skipped due to learnings
Learnt from: tabrisnet Repo: armbian/build PR: 8661 File: lib/functions/compilation/armbian-kernel.sh:194-199 Timestamp: 2025-09-25T18:37:00.330Z Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.Learnt from: tabrisnet Repo: armbian/build PR: 8661 File: lib/functions/compilation/armbian-kernel.sh:194-199 Timestamp: 2025-09-25T18:37:00.330Z Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.Learnt from: EvilOlaf Repo: armbian/build PR: 8428 File: config/boards/lckfb-taishanpi.csc:5-9 Timestamp: 2025-07-25T03:51:50.830Z Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.Learnt from: libiunc Repo: armbian/build PR: 8033 File: config/kernel/linux-starfive2-vendor.config:43-43 Timestamp: 2025-03-31T12:57:13.880Z Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.Learnt from: EvilOlaf Repo: armbian/build PR: 8428 File: config/boards/lckfb-taishanpi.csc:5-9 Timestamp: 2025-07-25T03:51:50.830Z Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.Learnt from: igorpecovnik Repo: armbian/build PR: 8849 File: config/boards/radxa-e54c.csc:14-28 Timestamp: 2025-11-02T20:49:56.719Z Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.Learnt from: tabrisnet Repo: armbian/build PR: 8678 File: config/kernel/linux-sunxi64-current.config:94-94 Timestamp: 2025-09-27T21:50:15.915Z Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.Learnt from: EvilOlaf Repo: armbian/build PR: 0 File: :0-0 Timestamp: 2025-12-19T13:56:45.124Z Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.Learnt from: tabrisnet Repo: armbian/build PR: 8661 File: lib/functions/compilation/armbian-kernel.sh:194-201 Timestamp: 2025-09-22T21:52:01.225Z Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.Learnt from: tabrisnet Repo: armbian/build PR: 8661 File: lib/functions/compilation/armbian-kernel.sh:194-201 Timestamp: 2025-09-22T21:52:01.225Z Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.Learnt from: lanefu Repo: armbian/build PR: 8377 File: config/kernel/linux-uefi-arm64-cloud.config:165-170 Timestamp: 2025-07-19T00:03:42.995Z Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.Learnt from: pyavitz Repo: armbian/build PR: 8421 File: config/kernel/linux-sunxi64-edge.config:438-439 Timestamp: 2025-07-27T15:56:34.414Z Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.Learnt from: tabrisnet Repo: armbian/build PR: 0 File: :0-0 Timestamp: 2025-08-30T06:56:33.372Z Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
config/kernel/linux-mvebu64-current.config (1)
11-11: Consider centralizing this change in armbian-kernel.sh instead of editing config files directly.The change itself is correct and addresses the security posture issue. However, based on the PR discussion and Armbian's kernel config generation workflow, modifying
lib/functions/compilation/armbian-kernel.sh(functionarmbian_kernel_config__600_enable_ebpf_and_btf_info) would be the preferred approach:
- Config files in
config/kernel/are autogenerated overlays that can be overwritten by periodicrewrite-kernel-configjobs- Adding
BPF_UNPRIV_DEFAULT_OFFto theopts_yarray in the script ensures the change propagates to all generated configs- This reduces file churn and avoids potential conflicts during config regeneration
Based on learnings, Armbian kernel configuration files are overlays maintained through generation scripts, and manual edits may not persist.
Example implementation in armbian-kernel.sh
In
lib/functions/compilation/armbian-kernel.sh, within thearmbian_kernel_config__600_enable_ebpf_and_btf_infofunction, add:opts_y+=( "BPF_SYSCALL" # eBPF "BPF_JIT" + "BPF_UNPRIV_DEFAULT_OFF" # Disable unprivileged eBPF by default # ... other options )Then run
rewrite-kernel-configto regenerate all config files with this change applied consistently.lib/functions/compilation/armbian-kernel.sh (1)
119-125: Good: centralizingBPF_UNPRIV_DEFAULT_OFFin the eBPF/BTF helper.Adding
"BPF_UNPRIV_DEFAULT_OFF"toopts_yhere makes the unprivileged‑BPF default‑off behavior part of the scripted kernel config pipeline, so rewrite‑kernel‑config will preserve it. If you ever want this enforced even whenKERNEL_BTF="no", you could set it outside the BTF RAM check, but that’s an optional follow‑up rather than a blocker.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (33)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)lib/functions/compilation/armbian-kernel.sh(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (20)
- config/kernel/linux-rockchip64-edge.config
- config/kernel/linux-sunxi64-legacy.config
- config/kernel/linux-odroidxu4-current.config
- config/kernel/linux-sunxi-edge.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-virtual-current.config
- config/kernel/linux-odroidxu4-edge.config
- config/kernel/linux-imx6-current.config
- config/kernel/linux-rk35xx-vendor.config
- config/kernel/linux-rockchip-current.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-meson64-current.config
- config/kernel/linux-mvebu-current.config
- config/kernel/linux-sunxi-legacy.config
- config/kernel/linux-mvebu64-edge.config
- config/kernel/linux-thead-legacy.config
- config/kernel/linux-imx6-legacy.config
- config/kernel/linux-rockchip-rk3588-edge.config
- config/kernel/linux-rk322x-edge.config
- config/kernel/linux-mvebu-legacy.config
🧰 Additional context used
🧠 Learnings (33)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-17T05:09:02.306Z
Learning: In the Armbian build system, kernel patches (e.g., in patch/kernel/archive/sunxi-6.18/patches.armbian/) contain device tree overlays and other code that have existed for years and are maintained/ported across kernel versions. When reviewing PRs that modify these patch files, focus on the actual changes being made (e.g., Makefile fixes, new additions) rather than reviewing the entire existing content within the patch as if it were new code. The patch file contents are existing, stable code unless explicitly modified in the PR diff.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:48:09.091Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the user prefers flexible grep patterns over anchored ones for BTRFS configuration checks, but agrees to use quiet grep (-q) to avoid polluting build logs.
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu-edge.configlib/functions/compilation/armbian-kernel.sh
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-12-19T13:56:45.124Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Applied to files:
config/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Applied to files:
config/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-sunxi64-current.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-sunxi64-current.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
config/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Applied to files:
config/kernel/linux-sunxi64-current.config
📚 Learning: 2025-11-20T18:20:11.985Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-03T11:42:46.660Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:96-169
Timestamp: 2025-10-03T11:42:46.660Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), deletion of kernel config files does not need to be handled. The workflow intentionally only captures ACMR (added/copied/modified/renamed) changes and does not need to propagate deletions to the aggregator.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-04T17:59:19.369Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:217-220
Timestamp: 2025-10-04T17:59:19.369Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), the workflow is designed to rewrite existing kernel configs only. New/untracked files can be safely ignored, so using `git diff --quiet` (which ignores untracked files) is the correct approach for detecting changes rather than `git status --porcelain`.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-01T02:34:37.451Z
Learnt from: tabrisnet
Repo: armbian/build PR: 9000
File: config/desktop/questing/environments/xfce/debian/postinst:17-18
Timestamp: 2025-12-01T02:34:37.451Z
Learning: In the Armbian build system shell scripts, the sed pattern with -i flag placed after the script argument (e.g., `sed "s/.../.../" -i file`) is intentional and correct. While non-POSIX, this GNU sed extension is used throughout the codebase and works correctly in the Armbian build environment. This pattern should not be flagged as incorrect.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-06-24T10:08:40.313Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-17T05:09:02.306Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-17T05:09:02.306Z
Learning: In the Armbian build system, kernel patches (e.g., in patch/kernel/archive/sunxi-6.18/patches.armbian/) contain device tree overlays and other code that have existed for years and are maintained/ported across kernel versions. When reviewing PRs that modify these patch files, focus on the actual changes being made (e.g., Makefile fixes, new additions) rather than reviewing the entire existing content within the patch as if it were new code. The patch file contents are existing, stable code unless explicitly modified in the PR diff.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-16T13:40:07.649Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-17T15:46:22.709Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 9096
File: patch/kernel/archive/sunxi-6.18/patches.armbian/arm64-dts-sun50i-h616-add-overlays.patch:4-5
Timestamp: 2025-12-17T15:46:22.709Z
Learning: In Armbian kernel patches, when patches are renamed or reorganized, the old Subject line may be intentionally preserved in the patch header (as a second Subject line) for archival/historical purposes to document the previous patch name. This is an Armbian-specific practice for tracking patch evolution and should not be flagged as an error when the maintainer has intentionally included it for documentation.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-03-31T22:20:48.475Z
Learnt from: rpardini
Repo: armbian/build PR: 8044
File: patch/u-boot/v2025.04/cmd-fileenv-read-string-from-file-into-env.patch:76-86
Timestamp: 2025-03-31T22:20:48.475Z
Learning: For the Armbian build project, maintaining consistency with existing patches across U-Boot versions (such as between 2025.01 and 2025.04) is prioritized over refactoring individual patches for code improvements.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-11-11T20:56:20.303Z
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-current.config
📚 Learning: 2025-10-26T10:41:35.118Z
Learnt from: HackingGate
Repo: armbian/build PR: 8665
File: config/boards/photonicat2.csc:4-4
Timestamp: 2025-10-26T10:41:35.118Z
Learning: In the Armbian build system, rk3576 boards consistently use BOARDFAMILY="rk35xx" for both vendor and edge kernel targets. The rk35xx family configuration sources rockchip64_common.inc, which provides edge and current kernel branch definitions, making these branches available even though they're not defined directly in rk35xx.conf.
Applied to files:
config/kernel/linux-rockchip-edge.config
📚 Learning: 2025-10-26T12:56:29.185Z
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rk322x-current.config
📚 Learning: 2025-12-18T23:40:41.627Z
Learnt from: rpardini
Repo: armbian/build PR: 9101
File: lib/functions/image/compress-checksum.sh:44-48
Timestamp: 2025-12-18T23:40:41.627Z
Learning: In the Armbian build framework, scripts run with set -e, so a non-zero exit status will abort the script. During reviews, assume failures will stop execution unless explicitly handled. Verify that commands that must fail are checked, errors are propagated, and any critical steps have proper error handling (e.g., using pipefail where appropriate, checking exit codes, and not masking failures).
Applied to files:
lib/functions/compilation/armbian-kernel.sh
🔇 Additional comments (8)
config/kernel/linux-sunxi-current.config (1)
9-9: Remove manual config edit; BPF_UNPRIV_DEFAULT_OFF is already handled centrally.The security improvement is correct, but the manual config file edit is redundant. The
armbian_kernel_config__600_enable_ebpf_and_btf_infofunction already setsBPF_UNPRIV_DEFAULT_OFFin itsopts_yarray (line 123 of lib/functions/compilation/armbian-kernel.sh). This setting is applied automatically during kernel compilation, making the manual edit to the config file unnecessary.Remove this change from the config file and rely on the existing central function to apply the setting consistently across all configurations.
Likely an incorrect or invalid review comment.
config/kernel/linux-mvebu-edge.config (1)
9-12: Unprivileged BPF default-off correctly enabled for mvebuSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent with the existing BPF enablement and matches the PR goal of disabling unprivileged eBPF by default while preserving privileged BPF use. No conflicts apparent in this defconfig overlay.config/kernel/linux-rockchip64-current.config (1)
9-13: Rockchip64: BPF_UNPRIV_DEFAULT_OFF aligns with existing BPF stackWith
CONFIG_BPF_SYSCALL=y,CONFIG_BPF_JIT=yandCONFIG_BPF_LSM=yalready enabled, addingCONFIG_BPF_UNPRIV_DEFAULT_OFF=ygives the intended “BPF available but unprivileged disabled by default” behavior and should clean up the Spectre v2 vulnerability reporting. Looks coherent for this family.config/kernel/linux-imx6-edge.config (1)
10-14: i.MX6 edge: consistent unprivileged BPF default-offAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext to the existing BPF JIT options consistently applies the “unprivileged BPF disabled by default” policy here as well, matching the other families and the PR’s security objective.config/kernel/linux-rk322x-current.config (1)
95-106: EnableCONFIG_BPF_UNPRIV_DEFAULT_OFFfor correct unprivileged eBPF stateSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent with the existing BPF settings and with the PR goal of having unprivileged eBPF disabled by default and properly reflected in the Spectre v2 vulnerability output. No issues spotted.config/kernel/linux-rockchip-edge.config (1)
8-12: Rockchip edge: unprivileged eBPF default‑off is correctly enabled
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ycomplementsCONFIG_BPF_SYSCALL/CONFIG_BPF_JITand aligns this defconfig with the intended “unprivileged eBPF disabled by default” behavior and reporting. Looks good.config/kernel/linux-meson64-edge.config (1)
7-11: EnablingCONFIG_BPF_UNPRIV_DEFAULT_OFFhere is correct and consistent.Placed alongside the other BPF options, this ensures unprivileged BPF is default‑off for meson64 edge and matches the central armbian‑kernel.sh logic.
config/kernel/linux-sunxi64-edge.config (1)
7-9: Sunxi64 edge config correctly enablesCONFIG_BPF_UNPRIV_DEFAULT_OFF.The new line sits with the other BPF knobs and matches the intended “unprivileged BPF default‑off” behavior across ARM64 kernels.
Collaborator
|
Have you looked into running [a few sample jobs] manually on your machine?Each individual run shouldn't take more than a few minutes.
basically ./compile.sh rewrite-kernel-config BOARD=foo BRANCH=current
That's what the workflow does, but once for every board family.
The goal would, roughly, be to run for a sunxi64 board, a meson64 board & a rockchip64 board. See the results.
Did it elide the line?
Sent from myPhone.
|
Collaborator
|
I fetched/cherry-picked your commit de1f9ee, then did a rewrite for As I expected [ignore |
Contributor
|
Tip For best results, initiate chat on the files or code changes. @tabrisnet: Thank you for testing this! Your results confirm the overlay config behavior and reveal an important insight. What the test results mean: The fact that The original problem: The configs had explicit What this means for the PR: The current PR has two types of changes:
Recommended next steps: Since the
This approach:
@neheb: Would you like to run the full rewrite-kernel-config workflow, or should the maintainers handle that separately? The key fix (armbian-kernel.sh change) is already in place. 🧠 Learnings used |
Collaborator
|
Unlike the 🐰 suggestion, I'd say either revert the |
Contributor
Author
|
Deleted the line. |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
config/kernel/linux-sunxi64-current.config (1)
7-9: Align with generator workflow: remove explicitCONFIG_BPF_UNPRIV_DEFAULT_OFFfrom this overlayThis line achieves the desired mitigation, but
config/kernel/linux-sunxi64-current.configis a generated overlay. The agreed approach in this PR is to setCONFIG_BPF_UNPRIV_DEFAULT_OFFinarmbian-kernel.shand letrewrite-kernel-configregenerate overlays; leaving the explicit=yhere is redundant and will be dropped or rewritten later. Please rely on the central generator and keep this overlay minimal. Based on learnings, manual edits in these files tend not to persist.Proposed cleanup
-CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
🧹 Nitpick comments (5)
config/kernel/linux-imx6-legacy.config (1)
98-111: Avoid persisting manual edits in autogenerated kernel configs
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yis a valid choice here (it makes unprivileged eBPF disabled by default and matches the PR’s security goal), but this file is tagged “Automatically generated; DO NOT EDIT” and Armbian’s workflow rewrites these overlays from defconfig +armbian-kernel.sh. That rewrite will likely drop this line again if it matches the kernel default, causing pointless churn across many.configfiles.Prefer enforcing
BPF_UNPRIV_DEFAULT_OFFin the central kernel-config machinery (e.g.armbian_kernel_config__600_enable_ebpf_and_btf_infoinlib/functions/compilation/armbian-kernel.sh) and letrewrite-kernel-configregenerate overlays, rather than carrying this explicit=yin each overlay file. Once the central change is in place, this line can be safely removed and left to the rewrite job.
Based on learnings, manual edits to autogenerated overlays are discouraged and non-persistent.config/kernel/linux-sunxi64-legacy.config (1)
7-9: Avoid hard‑codingCONFIG_BPF_UNPRIV_DEFAULT_OFFin this autogenerated overlayThese
config/kernel/*.configfiles are generated overlays; explicit defaults likeCONFIG_BPF_UNPRIV_DEFAULT_OFF=ywill be elided byrewrite-kernel-configand cause churn. With the option handled centrally inlib/functions/compilation/armbian-kernel.sh, this line is redundant here and can be dropped so the overlay only captures deviations from the base defconfig. Based on learnings, Armbian prefers generator‑driven changes over manual edits in these files.Proposed cleanup
-CONFIG_BPF_UNPRIV_DEFAULT_OFF=yconfig/kernel/linux-mvebu-current.config (1)
9-10: Keep unprivileged BPF default‑off, but drive it fromarmbian-kernel.sh, not this overlayThe value
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yis correct for security, but this file is an autogenerated overlay. Per the Armbian workflow and previous discussion on this PR, the persistent source of truth should belib/functions/compilation/armbian-kernel.shplusrewrite-kernel-config; keeping the explicit line here is redundant and will be stripped or rewritten later. Consider dropping it and relying on the generator’s BPF section instead. Based on learnings, autogenerated overlays should stay minimal.Proposed cleanup
-CONFIG_BPF_UNPRIV_DEFAULT_OFF=yconfig/kernel/linux-mvebu-legacy.config (1)
94-105: Correct option, but prefer setting it viaarmbian-kernel.shinstead of this generated configEnabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere does achieve the desired security behavior (disabling unprivileged eBPF by default), but this file is an auto‑generated kernel config overlay and is subject torewrite-kernel-config. As discussed in the PR and past learnings, the preferred pattern is:
- Add
BPF_UNPRIV_DEFAULT_OFFto the appropriateopts_y+=()inlib/functions/compilation/armbian-kernel.sh(e.g. inarmbian_kernel_config__600_enable_ebpf_and_btf_info), and- Let the rewrite workflow regenerate overlays, omitting redundant lines if the option matches the kernel default.
Once the central script change is in place, this explicit line in the overlay can be dropped to avoid churn when rewrite-kernel-config runs. Based on learnings, Armbian kernel overlays should not be manually maintained where the generator can express the intent.
config/kernel/linux-sunxi-legacy.config (1)
8-12: Functionally good, but should rely on the central kernel-config generator rather than this overlay
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is the correct knob to turn off unprivileged eBPF by default and addresses the reported vuln output. However, thislinux-sunxi-legacy.configfile is an autogenerated Armbian overlay; per the agreed PR direction and existing workflow, this option should be set vialib/functions/compilation/armbian-kernel.shand then propagated byrewrite-kernel-config, not by hand in the overlay.Once the generator is updated, consider removing this explicit line from the overlay so that future rewrite runs don’t drop it as redundant or reformat it, avoiding unnecessary config churn. Based on learnings, overlay configs should remain as thin deltas over the base defconfig.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (32)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (22)
- config/kernel/linux-rockchip-current.config
- config/kernel/linux-sunxi-edge.config
- config/kernel/linux-sunxi-current.config
- config/kernel/linux-rockchip64-edge.config
- config/kernel/linux-imx6-current.config
- config/kernel/linux-sunxi64-edge.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-rockchip64-current.config
- config/kernel/linux-rockchip-rk3588-edge.config
- config/kernel/linux-odroidxu4-edge.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-mvebu64-legacy.config
- config/kernel/linux-rk322x-current.config
- config/kernel/linux-meson64-current.config
- config/kernel/linux-rk322x-edge.config
- config/kernel/linux-bcm2711-legacy.config
- config/kernel/linux-rockchip-edge.config
- config/kernel/linux-rk35xx-vendor.config
- config/kernel/linux-odroidxu4-current.config
- config/kernel/linux-virtual-current.config
- config/kernel/linux-mvebu-edge.config
- config/kernel/linux-mvebu64-edge.config
🧰 Additional context used
🧠 Learnings (32)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:96-169
Timestamp: 2025-10-03T11:42:46.660Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), deletion of kernel config files does not need to be handled. The workflow intentionally only captures ACMR (added/copied/modified/renamed) changes and does not need to propagate deletions to the aggregator.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-17T05:09:02.306Z
Learning: In the Armbian build system, kernel patches (e.g., in patch/kernel/archive/sunxi-6.18/patches.armbian/) contain device tree overlays and other code that have existed for years and are maintained/ported across kernel versions. When reviewing PRs that modify these patch files, focus on the actual changes being made (e.g., Makefile fixes, new additions) rather than reviewing the entire existing content within the patch as if it were new code. The patch file contents are existing, stable code unless explicitly modified in the PR diff.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi64-legacy.config
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-thead-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
config/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi64-legacy.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Applied to files:
config/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-11-20T18:20:11.985Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-03T11:42:46.660Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:96-169
Timestamp: 2025-10-03T11:42:46.660Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), deletion of kernel config files does not need to be handled. The workflow intentionally only captures ACMR (added/copied/modified/renamed) changes and does not need to propagate deletions to the aggregator.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-04T17:59:19.369Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:217-220
Timestamp: 2025-10-04T17:59:19.369Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), the workflow is designed to rewrite existing kernel configs only. New/untracked files can be safely ignored, so using `git diff --quiet` (which ignores untracked files) is the correct approach for detecting changes rather than `git status --porcelain`.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-01T02:34:37.451Z
Learnt from: tabrisnet
Repo: armbian/build PR: 9000
File: config/desktop/questing/environments/xfce/debian/postinst:17-18
Timestamp: 2025-12-01T02:34:37.451Z
Learning: In the Armbian build system shell scripts, the sed pattern with -i flag placed after the script argument (e.g., `sed "s/.../.../" -i file`) is intentional and correct. While non-POSIX, this GNU sed extension is used throughout the codebase and works correctly in the Armbian build environment. This pattern should not be flagged as incorrect.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-06-24T10:08:40.313Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-19T13:56:45.124Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Applied to files:
config/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-12-17T05:09:02.306Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-17T05:09:02.306Z
Learning: In the Armbian build system, kernel patches (e.g., in patch/kernel/archive/sunxi-6.18/patches.armbian/) contain device tree overlays and other code that have existed for years and are maintained/ported across kernel versions. When reviewing PRs that modify these patch files, focus on the actual changes being made (e.g., Makefile fixes, new additions) rather than reviewing the entire existing content within the patch as if it were new code. The patch file contents are existing, stable code unless explicitly modified in the PR diff.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-16T13:40:07.649Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-17T15:46:22.709Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 9096
File: patch/kernel/archive/sunxi-6.18/patches.armbian/arm64-dts-sun50i-h616-add-overlays.patch:4-5
Timestamp: 2025-12-17T15:46:22.709Z
Learning: In Armbian kernel patches, when patches are renamed or reorganized, the old Subject line may be intentionally preserved in the patch header (as a second Subject line) for archival/historical purposes to document the previous patch name. This is an Armbian-specific practice for tracking patch evolution and should not be flagged as an error when the maintainer has intentionally included it for documentation.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-03-31T22:20:48.475Z
Learnt from: rpardini
Repo: armbian/build PR: 8044
File: patch/u-boot/v2025.04/cmd-fileenv-read-string-from-file-into-env.patch:76-86
Timestamp: 2025-03-31T22:20:48.475Z
Learning: For the Armbian build project, maintaining consistency with existing patches across U-Boot versions (such as between 2025.01 and 2025.04) is prioritized over refactoring individual patches for code improvements.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-11-11T20:56:20.303Z
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the modern recommended approach for kernel configuration is to use the kernel-config command via "./compile.sh BOARD=boardname BRANCH=branchname kernel-config" instead of the deprecated KERNEL_CONFIGURE=yes flag. This provides a two-step workflow: configure using menuconfig, then build, with better transparency and control over configuration changes.
Applied to files:
config/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-22T22:08:54.273Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-09-22T22:08:54.273Z
Learning: When extracting comments from Linux Kconfig files, def_bool and def_tristate entries use their parameter as a dependency/default condition, not as a feature description. Comments should be generated differently for these entry types to avoid misleading inline documentation.
Applied to files:
config/kernel/linux-sunxi64-legacy.config
🔇 Additional comments (1)
config/kernel/linux-meson64-edge.config (1)
10-10: Technical change is correct.The addition of
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yproperly addresses the PR objective to disable unprivileged BPF and fix the CPU vulnerability warning. The setting is placed logically within the BPF configuration group.As discussed in previous review comments, the workflow approach (manual config edits + armbian-kernel.sh change) has been accepted by the maintainer for immediate availability, despite being non-standard.
Collaborator
I didn't mean to remove it from |
github-actions
bot
added
size/small
Collaborator
|
ok, and bring back the |
rpardini
requested changes
Jan 7, 2026
Member
rpardini
left a comment
rpardini
left a comment
There was a problem hiding this comment.
Please drop the changes to .config files and keep only the hook. It will take effect immediately and rewrite job will do, well, it's job, eventually.
I cannot say the actual change is good or bad, though.
Collaborator
|
I'm not gonna say whether this is good/bad, but I did some digging into this option. https://lwn.net/Articles/660331/ |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🌐 Web query: 💡 Result:
Why it matters (security implications)
Operational behavior you should know
Practical impact
Sources: 🌐 Web query: 💡 Result: Reality check (kernel eBPF)
Practical “unprivileged eBPF” patterns (2024–2025)1) Privileged loader + unprivileged app (maps/FD sharing)Use case: ship an eBPF program with a privileged component (daemon/daemonset/operator) that loads & attaches it, then let an unprivileged workload read stats / configure behavior via shared maps (FD passing, pinning, CSI mounts, etc.).
2) “Unprivileged clients” by delegating CAP_BPF to a managerUse case: keep CAP_BPF in a single audited service, while normal users/services stay unprivileged and call it over an API.
3) Run eBPF in user space (no kernel privileges)Use case: tracing/profiling/extensions in environments where you can’t get root/CAP_BPF (dev boxes, shared hosts, locked-down containers).
Representative tools/projects to look at (actively discussed/used in 2024–2025)
Sources: Citations:
Security Implications (TL;DR: This is a good hardening measure)What CONFIG_BPF_UNPRIV_DEFAULT_OFF actually does:
Why it matters for security:
What Use-Cases Might Break?Short answer: Very few legitimate ones, especially on embedded ARM devices. Modern eBPF tooling (2024-2025) has moved away from requiring unprivileged kernel BPF loading:
Reality check for Armbian:
Recommendation✅ This change aligns with security best practices and is appropriate for Armbian. The security benefit (reducing LPE attack surface) significantly outweighs the minimal functionality loss. The fact that it uses The original bug report about the CPU vulnerability warning is a valid concern—having unprivileged eBPF enabled by default is increasingly seen as a security misconfiguration in modern systems. 🧠 Learnings used |
Collaborator
|
What documentation should be prepared for this change? Do we typically document these types of changes that may adversely affect userspace? |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 1460 🏁 Script executed: Length of output: 3477 🏁 Script executed: Length of output: 2476
Current Documentation PracticesArmbian does not have a formal CHANGELOG or release notes process for individual kernel configuration changes. The Recommended Documentation for This ChangeFor this specific change, minimal additional documentation is needed because:
Optional: Forum AnnouncementIf maintainers want to proactively communicate this change, consider a brief note in the forum announcements section for the next release:
Commit Message SuggestionEnsure the commit message is descriptive: Bottom line: The PR description and commit message provide sufficient documentation for this type of security-aligned kernel configuration change. No additional formal documentation is required based on Armbian's current practices. 🧠 Learnings used |
tabrisnet
changed the title
Fixes wrong CPU vulnerability output:
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation:Vulnerable:
Unprivileged eBPF enabled
It's enabled but CONFIG_BPF_UNPRIV_DEFAULT_OFF being unset causes the
warning.
This warning happens on ARM32 and ARM64 devices.
Edited with:
find -name "*.config" -exec sed -i 's/# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set/CONFIG_BPF_UNPRIV_DEFAULT_OFF=y/g' '{}' \;
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes wrong CPU vulnerability output:
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation:Vulnerable: Unprivileged eBPF enabled
It's enabled but CONFIG_BPF_UNPRIV_DEFAULT_OFF being unset causes the warning.
This warning happens on ARM32 and ARM64 devices.
Edited with:
find -name "*.config" -exec sed -i 's/# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set/CONFIG_BPF_UNPRIV_DEFAULT_OFF=y/g' '{}' ;
CONFIG_BPF_UNPRIV_DEFAULT_OFFis a Linux kernel build-time hardening option that disables unprivileged use of thebpf()syscall (and thus unprivileged eBPF loading) by default by settingkernel.unprivileged_bpf_disabled=2at boot. With this default, only privileged processes (e.g., withCAP_SYS_ADMIN/CAP_BPF, depending on kernel) can load eBPF unless an administrator explicitly relaxes it. [1], [2]Operational behavior you should know
kernel.unprivileged_bpf_disabledsemantics (as documented in the kernel sysctl docs/patch):0: unprivilegedbpf()allowed1: unprivilegedbpf()blocked and cannot be re-enabled until reboot (no transition back to0while running)2: unprivilegedbpf()blocked but admin can later switch to0or1if neededIf
CONFIG_BPF_UNPRIV_DEFAULT_OFF=y, the default becomes2instead of0. [2]Summary by CodeRabbit
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.
✏️ Tip: You can customize this high-level summary in your review settings.