1
0
Fork 0
mirror of https://gitlab.postmarketos.org/postmarketOS/pmaports.git synced 2025-07-12 16:19:48 +03:00
pmaports/kconfigcheck.toml
Willow Barraco 6f65c4ba66
kconfigcheck: add netmount category to support NFS better
NFS allow the user to mount distant resources locally, and this is
specially great for mobiles devices, with limited disk space. The user
can couple this with FS-Cache, to limit the network impact. Kerberos
bring security to the NFS mounting.

This new category "netmout" make sure the kernels are built to support
this.
2025-07-06 15:05:36 +02:00

547 lines
15 KiB
TOML

# pmaports CI and "pmbootstrap kconfig check" use this file to ensure our
# kernels have certain kernel config options set. Which categories are checked
# depends on options="pmb:kconfigcheck-…" in the linux APKBUILD. If no such
# option is set, see the default in ["category:default".">=0.0.0"."all"] below.
[aliases]
# Devices with options="pmb:kconfigcheck-community" in the device APKBUILD will
# check for the following categories. A CI check ensures that all devices in
# device/main and device/community dirs have this option. Devices in testing
# may also have "pmb:kconfigcheck-community", but it may be removed when
# modifying the required options and adjusting the devices in testing is too
# much effort. Device maintainers may fix it up afterwards and add it back.
community = [
"category:default",
"category:community_various",
"category:containers",
"category:debug",
"category:filesystems",
"category:input",
"category:iwd",
"category:netboot",
"category:nftables",
"category:usb_gadgets",
"category:waydroid",
"category:wireguard",
"category:zram",
]
# Format for rule sections:
# ["category:<NAME>"."<KERNEL_VERSION>"."<ARCHITECTURES>"]
# Implemented value types:
# - boolean (e.g. 'ANDROID_PARANOID_NETWORK = false'):
# - false: disabled
# - true: enabled, either as module or built-in
# - list (e.g. 'ANDROID_BINDER_DEVICES = ["binder", "hwbinder"]'):
# - each element of the array must be contained in the kernel config string,
# in any order. The example above would accept the following in the config:
# CONFIG_ANDROID_BINDER_DEVICES="hwbinder,vndbinder,binder"
# - string (e.g. 'LSM = "lockdown,yama,loadpin,safesetid,integrity"'):
# - the value in the kernel config must be the same as the given string. Use
# this e.g. if the order of the elements is important.
# default: all devices must satisfy these
["category:default".">=0.0.0"."all"]
ANDROID_PARANOID_NETWORK = false
BLK_DEV_INITRD = true
CGROUPS = true
CRYPTO_AES = true
CRYPTO_XTS = true
DEVTMPFS = true
DM_CRYPT = true
INPUT_EVDEV = true
EXT4_FS = true
KINETO_GAN = false
PFT = false
SEC_RESTRICT_ROOTING = false
SYSVIPC = true
TMPFS_POSIX_ACL = true
USE_VFB = false
VT = true
["category:default".">=2.6.0"."all"]
BINFMT_ELF = true
["category:default".">=3.10.0"."all"]
BINFMT_SCRIPT = true
["category:default".">=4.0.0"."all"]
UEVENT_HELPER = true
USER_NS = true
["category:default"."<4.7.0"."all"]
DEVPTS_MULTIPLE_INSTANCES = true
["category:default"."<4.14.0"."all"]
SAMSUNG_TUI = false
TZDEV = false
["category:default"."<5.2.0"."armhf armv7 x86"]
LBDAF = true
["category:default".">=5.2.0"."all"]
# Provide a proper dummy null console to improve compatibility
# on devices that like to coerce console=null
NULL_TTY = true
["category:default".">=5.19.0"."all"]
FW_LOADER_COMPRESS_ZSTD = true
["category:default".">=4.20.0"."all"]
# required for systemd-oomd
PSI = true
PSI_DEFAULT_DISABLED = false
UDMABUF = true
["category:netmount".">=2.6.0"."all"]
CACHEFILES = true
CRYPTO_AES = true
CRYPTO_CAMELLIA = true
CRYPTO_CBC = true
CRYPTO_CTS = true
CRYPTO_HMAC = true
CRYPTO_SHA256 = true
CRYPTO_SHA512 = true
FSCACHE = true
NFS_FS = true
NFS_FSCACHE = true
NFS_V3 = true
NFS_V4 = true
RPCSEC_GSS_KRB5 = true
["category:netmount".">=3.1.0"."all"]
CRYPTO_CMAC = true
["category:netmount".">=3.10.0"."all"]
CRYPTO_AES_TI = true
["category:netmount".">=3.10.0"."aarch64"]
CRYPTO_AES_ARM64_CE_BLK = true
["category:netmount".">=4.14.0"."all"]
RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1 = true
RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2 = true
RPCSEC_GSS_KRB5_ENCTYPES_CAMELLIA = true
# waydroid: android compatibility layer
["category:waydroid".">=0.0.0"."all"]
ANDROID_BINDERFS = false
ANDROID_BINDER_DEVICES = ["binder", "hwbinder", "vndbinder"]
ANDROID_BINDER_IPC = true
ANDROID_BINDER_IPC_SELFTEST = false
BLK_DEV_LOOP = true
BPF_SYSCALL = true
BRIDGE = true
BRIDGE_VLAN_FILTERING = true
CGROUP_BPF = true
FUSE_FS = true
IP_NF_MANGLE = true
NETFILTER_XTABLES = true
NETFILTER_XT_MATCH_COMMENT = true
SQUASHFS = true
SQUASHFS_XATTR = true
SQUASHFS_XZ = true
TMPFS_XATTR = true
TUN = true
VETH = true
VLAN_8021Q = true # prerequisite for bridge
["category:waydroid".">=3.5"."all"]
CROSS_MEMORY_ATTACH = true
["category:waydroid".">=4.20.0"."all"]
PSI = true # required by userspace OOM killer
PSI_DEFAULT_DISABLED = false
["category:waydroid"."<5.18"."all"]
ASHMEM = true
# iwd: modern inet wireless daemon
# Obtained from 'grep ADD_MISSING src/main.c' in iwd.git
["category:iwd".">=0.0.0"."all"]
ASYMMETRIC_KEY_TYPE = true
ASYMMETRIC_PUBLIC_KEY_SUBTYPE = true
CRYPTO_AES = true
CRYPTO_CBC = true
CRYPTO_CMAC = true
CRYPTO_DES = true
CRYPTO_ECB = true
CRYPTO_HMAC = true
CRYPTO_MD4 = true # Needed for EAP MSCHAPV2 authentication
CRYPTO_MD5 = true
CRYPTO_SHA1 = true
CRYPTO_SHA256 = true
CRYPTO_SHA512 = true
CRYPTO_USER_API_HASH = true
CRYPTO_USER_API_SKCIPHER = true
KEYS = true
KEY_DH_OPERATIONS = true
PKCS7_MESSAGE_PARSER = true
PKCS8_PRIVATE_KEY_PARSER = true
X509_CERTIFICATE_PARSER = true
RFKILL = true
# nftables: firewall, not related to nft scams
["category:nftables".">=3.13.0"."all"]
NETFILTER = true
NF_CONNTRACK = true
NF_TABLES = true
NF_TABLES_INET = true
NFT_CT = true
NFT_LOG = true
NFT_LIMIT = true
NFT_MASQ = true
NFT_NAT = true
NFT_REJECT = true
NF_TABLES_IPV4 = true
NF_REJECT_IPV4 = true
IP_NF_IPTABLES = true
IP_NF_FILTER = true
IP_NF_TARGET_REJECT = true
IP_NF_NAT = true
NF_TABLES_IPV6 = true
NF_REJECT_IPV6 = true
IP6_NF_IPTABLES = true
IP6_NF_FILTER = true
IP6_NF_TARGET_REJECT = true
IP6_NF_NAT = true
["category:nftables".">=3.13.0 <0.17"."all"]
NFT_COUNTER = true
# containers: lxc, docker, etc.
["category:containers".">=0.0.0"."all"]
NAMESPACES = true
NET_NS = true
PID_NS = true
IPC_NS = true
UTS_NS = true
CGROUPS = true
CGROUP_CPUACCT = true
CGROUP_DEVICE = true
CGROUP_FREEZER = true
CGROUP_SCHED = true
CPUSETS = true
KEYS = true
VETH = true
BRIDGE = true # (also needed for waydroid)
BRIDGE_NETFILTER = true
IP_NF_FILTER = true
IP_NF_TARGET_MASQUERADE = true
NETFILTER_XT_MATCH_ADDRTYPE = true
NETFILTER_XT_MATCH_CONNTRACK = true
NETFILTER_XT_MATCH_IPVS = true
NETFILTER_XT_MARK = true
NETFILTER_XT_TARGET_CHECKSUM = true # Needed for lxc
IP_NF_NAT = true
NF_NAT = true
POSIX_MQUEUE = true
BLK_DEV_DM = true # Storage Drivers
DUMMY = true # Network Drivers
# USER_NS = true # This is already in pmOS kconfig check
BLK_CGROUP = true # Optional section
BLK_DEV_THROTTLING = true # Optional section
CGROUP_PERF = true # Optional section
NET_SCHED = true # Required by NET_CLS_CGROUP
NET_CLS_CGROUP = true # Optional section
FAIR_GROUP_SCHED = true # Optional section
IP_NF_TARGET_REDIRECT = true # Optional section
IP_VS = true # Optional section
IP_VS_NFCT = true # Optional section
IP_VS_PROTO_TCP = true # Optional section
IP_VS_PROTO_UDP = true # Optional section
IP_VS_RR = true # Optional section
# EXT4_FS = true # This is already in pmOS kconfig check
EXT4_FS_POSIX_ACL = true # Optional section
EXT4_FS_SECURITY = true # Optional section
["category:containers".">=3.2"."all"]
CFS_BANDWIDTH = true # Optional section
["category:containers".">=3.3"."all"]
CHECKPOINT_RESTORE = true # Needed for lxc
["category:containers".">=3.6"."all"]
MEMCG = true
DM_THIN_PROVISIONING = true # Storage Drivers
SWAP = true
["category:containers".">=3.6"."x86 x64_64"]
HUGETLB_PAGE = true
CGROUP_HUGETLB = true # Optional section
["category:containers".">=3.6 <6.1_rc1"."all"]
MEMCG_SWAP = true
["category:containers".">=3.7 <5.0"."all"]
NF_NAT_IPV4 = true # Needed for lxc
NF_NAT_IPV6 = true # Needed for lxc
["category:containers".">=3.7"."all"]
VXLAN = true # Network Drivers
IP6_NF_TARGET_MASQUERADE = true # Needed for lxc
["category:containers".">=3.9"."all"]
BRIDGE_VLAN_FILTERING = true # Network Drivers (also for waydroid)
MACVLAN = true # Network Drivers
["category:containers".">=3.13"."all"]
NFT_COMPAT = true
["category:containers".">=3.14"."all"]
CGROUP_NET_PRIO = true # Optional section
["category:containers".">=3.18"."all"]
OVERLAY_FS = true # Storage Drivers
["category:containers".">=3.19"."all"]
IPVLAN = true # Network Drivers
SECCOMP = true # Optional section
["category:containers".">=4.4"."all"]
CGROUP_PIDS = true # Optional section
# zram: RAM disk with on-the-fly compression
["category:zram".">=0.0.0"."all"]
ZRAM = true
ZSMALLOC = true
SWAP = true
["category:zram"."<6.12"."all"]
CRYPTO_ZSTD = true
["category:zram".">=6.12"."all"]
ZRAM_BACKEND_ZSTD = true
# netboot: https://postmarketos.org/netboot
["category:netboot".">=0.0.0"."all"]
BLK_DEV_NBD = true
# wireguard: VPN software, also includes options for wg-quick
["category:wireguard".">=5.6_rc1"."all"]
WIREGUARD = true
IP_ADVANCED_ROUTER = true
IP_MULTIPLE_TABLES = true
IPV6_MULTIPLE_TABLES = true
NF_TABLES = true
NF_TABLES_IPV4 = true
NF_TABLES_IPV6 = true
NFT_CT = true
NFT_FIB = true
NFT_FIB_IPV4 = true
NFT_FIB_IPV6 = true
NF_CONNTRACK_MARK = true
# filesystems
["category:filesystems".">=0.0.0"."all"]
BTRFS_FS = true
EXFAT_FS = true
EXT4_FS = true
F2FS_FS = true
UDF_FS = true
XFS_FS = true
# usb_gadgets
["category:usb_gadgets".">=0.0.0"."all"]
# disable legacy gadgets
USB_ETH = false
USB_FUNCTIONFS = false
USB_MASS_STORAGE = false
USB_G_SERIAL = false
# enable configfs gadgets
USB_CONFIGFS_ACM = true # Serial gadget for debug-shell
USB_CONFIGFS_MASS_STORAGE = true # Mass storage gadget for debug-shell
USB_CONFIGFS_NCM = true # USB networking via NCM
USB_CONFIGFS_RNDIS = true # USB networking via RNDIS (legacy)
# community_various: Various options that were not categorized properly due to
# inflexibility of previous kconfigcheck related code. We should move these to
# proper categories above and/or invent new categories with meaningful names.
# >> Do not add more here!! <<
["category:community_various".">=0.0.0"."all"]
BINFMT_MISC = true # register binary formats
NETWORK_FILESYSTEMS = true # Required by CIFS
CIFS = true # mount SMB shares
LEDS_TRIGGER_PATTERN = true # feedbackd
LEDS_TRIGGER_TIMER = true # hfd-service
NETFILTER_XT_MATCH_MARK = true # e.g. HashiCorp Nomad
NETFILTER_XT_MATCH_MULTIPORT = true # e.g. HashiCorp Nomad
NETFILTER_XT_MATCH_STATISTIC = true # kube-proxy
NETFILTER_XT_MATCH_TCPMSS = true # change MTU e.g. for Wireguard
NETFILTER_XT_TARGET_TCPMSS = true # change MTU e.g. for Wireguard
# TODO = Depends on SUSPEND which is not enabled for some devices
# PM_WAKELOCKS = true # Sxmo
UCLAMP_TASK = true # Scheduler hints
UCLAMP_TASK_GROUP = true # Scheduler hints
RT_GROUP_SCHED = false # https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/2652
DM_INTEGRITY = true # Device-mapper integrity target
# uefi: proper modern booting
["category:uefi".">=0.0.0"."all"]
EFI_STUB = true
EFI = true
DMI = true
PSTORE = true
EFI_ESRT = true
EFI_VARS_PSTORE = true
EFI_RUNTIME_WRAPPERS = true
VFAT_FS = true
NLS_ASCII = true
["category:uefi".">=0.0.0"."x86_64"]
EFI_MIXED = true
["category:uefi".">=0.0.0"."aarch64 armv7"]
EFI_GENERIC_STUB = true
EFI_PARAMS_FROM_FDT = true
["category:uefi".">=6.1.0"."aarch64"]
# Required EFI booting compressed kernels on this arch
EFI_ZBOOT = true
# Devices that used to run windows may still want to access
# the windows partition (e.g. to retrieve firmware on WoA)
["category:uefi".">=5.15"."aarch64 x86_64"]
NTFS3_FS = true
["category:input".">=0.0.0"."all"]
BT_HIDP = true # Bluetooth HID
HIDRAW = true # /dev/hidraw* support
INPUT_UINPUT = true # buffyboard
INPUT_JOYSTICK = true # Required by CONFIG_JOYSTICK_XPAD_FF
JOYSTICK_XPAD = true # Xbox controller
JOYSTICK_XPAD_FF = true # Xbox controller force-feedback
JOYSTICK_XPAD_LEDS = true # Xbox controller LEDs
UHID = true # User-space HID, e.g. Bluetooth
USB_ANNOUNCE_NEW_DEVICES = true # dmesg messages when connecting device
USB_HIDDEV = true # /dev/usb/hiddevX support
USB_PRINTER = true # printers
# All the special HID drivers that Fedora kernel enables
HID_A4TECH = true
HID_ACCUTOUCH = true
HID_ACRUX_FF = true
HID_ACRUX = true
HID_ALPS = true
HID_APPLEIR = true
HID_APPLE = true
HID_AUREAL = true
HID_BATTERY_STRENGTH = true
HID_BELKIN = true
HID_BETOP_FF = true
HID_BIGBEN_FF = true
HID_CHERRY = true
HID_CHICONY = true
HID_CMEDIA = true
HID_CORSAIR = true
HID_COUGAR = true
HID_CP2112 = true
HID_CREATIVE_SB0540 = true
HID_CYPRESS = true
HID_DRAGONRISE = true
HID_ELAN = true
HID_ELECOM = true
HID_ELO = true
HID_EMS_FF = true
HID_EZKEY = true
HID_FT260 = true
HID_GEMBIRD = true
HID_GENERIC = true
HID_GFRM = true
HID_GLORIOUS = true
HID_GREENASIA = true
HID_GT683R = true
HID_GYRATION = true
HID_HOLTEK = true
HID_ICADE = true
HID_ITE = true
HID_JABRA = true
HID_KENSINGTON = true
HID_KEYTOUCH = true
HID_KYE = true
HID_LCPOWER = true
HID_LED = true
HID_LETSKETCH = true
HID_LOGITECH_DJ = true
HID_LOGITECH_HIDPP = true
HID_LOGITECH = true
HID_MACALLY = true
HID_MAGICMOUSE = true
HID_MALTRON = true
HID_MAYFLASH = true
HID_MCP2221 = true
HID_MEGAWORLD_FF = true
HID_MICROSOFT = true
HID_MONTEREY = true
HID_MULTITOUCH = true
HID_NINTENDO = true
HID_NTI = true
HID_NTRIG = true
HID_ORTEK = true
HID_PANTHERLORD = true
HID_PENMOUNT = true
HID_PETALYNX = true
HID_PICOLCD_BACKLIGHT = true
HID_PICOLCD_FB = true
LCD_CLASS_DEVICE = true # Required by HID_PICOLCD_LCD
HID_PICOLCD_LCD = true
HID_PICOLCD_LEDS = true
HID_PICOLCD = true
HID_PID = true
HID_PLANTRONICS = true
HID_PLAYSTATION = true
HID_PRIMAX = true
HID_PRODIKEYS = true
HID_PXRC = true
HID_RAZER = true
HID_RETRODE = true
HID_RMI = true
HID_ROCCAT = true
HID_SAITEK = true
HID_SAMSUNG = true
HID_SEMITEK = true
HID_SENSOR_ACCEL_3D = true
HID_SENSOR_ALS = true
HID_SENSOR_CUSTOM_INTEL_HINGE = true
HID_SENSOR_DEVICE_ROTATION = true
HID_SENSOR_GYRO_3D = true
HID_SENSOR_HUB = true
HID_SENSOR_HUMIDITY = true
HID_SENSOR_IIO_COMMON = true
HID_SENSOR_IIO_TRIGGER = true
HID_SENSOR_INCLINOMETER_3D = true
HID_SENSOR_MAGNETOMETER_3D = true
HID_SENSOR_TEMP = true
HID_SIGMAMICRO = true
HID_SMARTJOYPLUS = true
HID_SONY = true
HID_SPEEDLINK = true
HID_STEAM = true
HID_STEELSERIES = true
HID_SUNPLUS = true
HID_THINGM = true
HID_THRUSTMASTER = true
HID_TIVO = true
HID_TOPRE = true
HID_TOPSEED = true
HID_TWINHAN = true
HID_U2FZERO = true
HID_UCLOGIC = true
HID_UDRAW_PS3 = true
HID_VIEWSONIC = true
HID_VIVALDI = true
HID_WACOM = true
HID_WALTOP = true
HID_WIIMOTE = true
HID_XIAOMI = true
HID_XINMO = true
HID_ZEROPLUS = true
HID_ZYDACRON = true
["category:input".">=0.0.0"."x86 x86_64"]
HID_LENOVO = true
["category:input".">=6.3"."all"]
HID_EVISION = true
HID_SUPPORT = true
["category:input".">=6.5"."all"]
HID_NVIDIA_SHIELD = true
["category:input".">=6.6"."all"]
HID_GOOGLE_STADIA_FF = true
["category:input".">=6.10"."all"]
HID_WINWING = true
["category:input".">=6.12"."all"]
HID_GOODIX_SPI = true
["category:input".">=0.0.0"."riscv64 x86 x86_64"]
HID_BPF = true
["category:input".">=6.4.0"."aarch64"]
HID_BPF = true
["category:input".">=4.15.0"."all"]
BPF_JIT = true # Required by HID_BPF
["category:usb".">=0.0.0"."all"]
DRM_UDL = true # DisplayLink - connecting displays via USB
SND_USB_AUDIO = true # USB audio devices
USB_SERIAL_CP210X = true # USB serial console
USB_STORAGE = true # USB mass storage devices
USB_RTL8152 = true # USB Ethernet
["category:virt".">=0.0.0"."all"]
HW_RANDOM_VIRTIO = true
KVM = true
VIRTUALIZATION = true
["category:debug".">=0.0.0"."all"]
FTRACE = true # Required by DEBUG_FTRACE
FUNCTION_TRACER = true # Required by DEBUG_FTRACE
DYNAMIC_DEBUG = true # Enable debug dynamically
DYNAMIC_FTRACE = true # Enable function tracing dynamically
# Device specific settings to prevent regressions
["category:librem5".">=0.0.0"."aarch64"]
RS9116_FLASH_MODE = false # pma!2059
["category:pinephonepro".">=0.0.0"."aarch64"]
LEDS_GROUP_MULTICOLOR = true # pma!5991