fix(config): drop four stale =y lines the build was already discarding #47

Merged

pipeline-bot merged 1 commit from fix/defconfig-drop-stale-symbols into trunk

2026-09-04 08:28:00 +00:00

sean commented

2026-09-04 08:13:54 +00:00

Owner

The x86 defconfig contradicted itself, and the build has been printing "4 advisory symbol(s) dropped" on every run because of it.

Line	Symbol	Why it never took effect
35	`CONFIG_KEXEC_FILE=y`	also unset at line 374, in the same file
343	`CONFIG_IO_STRICT_DEVMEM=y`	depends on `DEVMEM`, disabled at line 382
73	`CONFIG_BRIDGE_NETFILTER=y`	depends on `BRIDGE`, never set anywhere
138	`CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y`	depends on `BRIDGE_NETFILTER`

The built kernel does not change. The explicit is not set lines already won and the unsatisfied symbols were already being dropped by olddefconfig. What changes is that the file stops lying about itself and the drift report goes quiet.

Checked against the running fleet, not assumed

CONFIG_IO_STRICT_DEVMEM was added deliberately as hardening in #41, so I checked whether dropping it weakens anything. It does not:

/dev/mem does not exist on a node. DEVMEM=n means there is nothing to filter, which is strictly stronger than IO_STRICT_DEVMEM=y filtering access to it.
A node carries zero bridges and has no /proc/sys/net/bridge. Cilium runs kube-proxy-replacement=true on a veth datapath with vxlan tunnelling, and there is no kube-proxy DaemonSet, so nothing wants bridge-netfilter.
KEXEC was disabled on purpose, per the comment block this commit extends: no crashkernel= was ever configured and bootc rolls reboot via firmware.

The comment block at the bottom now records all four and why, so the next person does not re-add them.

arm64 is untouched

It is a different, larger config that sets CONFIG_BRIDGE=y and CONFIG_KEXEC=y consistently, so it has none of these contradictions. There are no arm64 nodes.

Why now

This is also the change that lets the fleet pick up hugepages=1024 being removed from the node-bootc kargs (sean/builder-images #198). Nothing in the cluster requests hugepages — zero mentions across every workload spec — yet every node reserves 2 GiB, 12 GiB fleet-wide, including the master which never ran an io-engine. A running node only moves by bootc switch to a node-bootc digest, and that digest is minted only by a linux release, so the kernel needed a real change before the reclaim could ship.

https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

The x86 defconfig contradicted itself, and the build has been printing **"4 advisory symbol(s) dropped"** on every run because of it. | Line | Symbol | Why it never took effect | | --- | --- | --- | | 35 | `CONFIG_KEXEC_FILE=y` | **also unset at line 374, in the same file** | | 343 | `CONFIG_IO_STRICT_DEVMEM=y` | depends on `DEVMEM`, disabled at line 382 | | 73 | `CONFIG_BRIDGE_NETFILTER=y` | depends on `BRIDGE`, never set anywhere | | 138 | `CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y` | depends on `BRIDGE_NETFILTER` | **The built kernel does not change.** The explicit `is not set` lines already won and the unsatisfied symbols were already being dropped by `olddefconfig`. What changes is that the file stops lying about itself and the drift report goes quiet. ## Checked against the running fleet, not assumed `CONFIG_IO_STRICT_DEVMEM` was added deliberately as hardening in #41, so I checked whether dropping it weakens anything. It does not: - **`/dev/mem` does not exist on a node.** `DEVMEM=n` means there is nothing to filter, which is *strictly stronger* than `IO_STRICT_DEVMEM=y` filtering access to it. - **A node carries zero bridges** and has no `/proc/sys/net/bridge`. Cilium runs `kube-proxy-replacement=true` on a veth datapath with vxlan tunnelling, and there is no kube-proxy DaemonSet, so nothing wants bridge-netfilter. - **KEXEC was disabled on purpose**, per the comment block this commit extends: no `crashkernel=` was ever configured and bootc rolls reboot via firmware. The comment block at the bottom now records all four and why, so the next person does not re-add them. ## arm64 is untouched It is a different, larger config that sets `CONFIG_BRIDGE=y` and `CONFIG_KEXEC=y` consistently, so it has none of these contradictions. There are no arm64 nodes. ## Why now This is also the change that lets the fleet pick up `hugepages=1024` being removed from the node-bootc kargs (`sean/builder-images` #198). Nothing in the cluster requests hugepages — **zero mentions across every workload spec** — yet every node reserves 2 GiB, 12 GiB fleet-wide, including the master which never ran an io-engine. A running node only moves by `bootc switch` to a node-bootc digest, and that digest is minted only by a linux release, so the kernel needed a real change before the reclaim could ship. https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

sean added 1 commit

2026-09-04 08:13:54 +00:00

fix(config): drop four stale =y lines the build was already discarding

pipeline/ci CI green @ 71fa3316b3c3

Details

71fa3316b3

The x86 defconfig contradicted itself and the build had been printing
"4 advisory symbol(s) dropped" on every run:

  CONFIG_KEXEC_FILE=y                  set at line 35 AND unset at line 374
  CONFIG_IO_STRICT_DEVMEM=y            depends on DEVMEM, disabled at line 382
  CONFIG_BRIDGE_NETFILTER=y            depends on BRIDGE, never set anywhere
  CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y  depends on BRIDGE_NETFILTER

The built kernel does not change. The explicit `is not set` lines already
won and the unsatisfied symbols were already being dropped by
olddefconfig. What changes is that the file stops lying about itself and
the drift report goes quiet.

Checked against the running fleet before deleting, rather than assumed:

  /dev/mem does not exist on a node, so IO_STRICT_DEVMEM is moot. This is
  not a weakening — DEVMEM=n means there is no /dev/mem to filter, which
  is strictly stronger than filtering access to one.

  A node carries zero bridges and has no /proc/sys/net/bridge. Cilium runs
  kube-proxy-replacement=true on a veth datapath with vxlan tunnelling and
  there is no kube-proxy DaemonSet, so nothing wants bridge-netfilter.

  KEXEC was disabled deliberately, per the comment block this commit
  extends: no crashkernel= was ever configured and bootc rolls reboot via
  firmware.

arm64 is untouched. It is a different, larger config that sets CONFIG_BRIDGE=y
and CONFIG_KEXEC=y consistently, so it has none of these contradictions.

Claude-Session: https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

pipeline-bot merged commit 71fa3316b3 into trunk

2026-09-04 08:28:00 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/linux!47

No description provided.

Rows
Columns