kernel(config): seanfarm33 — forensics/recovery adds, verified trims #19

Merged

pipeline-bot merged 1 commit from config/seanfarm33-audit into trunk 2026-08-15 11:35:47 +00:00

Conversation 0 Commits 1 Files changed 1 +54 -12

sean commented 2026-08-15 07:30:04 +00:00

Owner

Copy link

The approved config audit (plan: purrfect-doodling-garden). One file: arch/x86/configs/seanfarm_defconfig.

ADD — forensics/self-recovery (panic+auto-reboot posture): pstore+ramoops, softlockup/hardlockup(buddy)/hung-task detectors with panic flags, panic_on_oops, softdog. The 069094 wedge class becomes self-healing with evidence.
ADD — observability/memory: PSI, delayacct, MGLRU, THP default madvise.
FIX — security: lockdown LSM actually compiled (the LSM string already named it), dmesg_restrict, random_kmalloc_caches, bug_on_data_corruption.
DROP — verified dead against live /proc/config.gz + QEMU Q35 hardware + deployed stack: KVM host support, kexec/kdump, IKHEADERS, Intel MEI, cpufreq, ipip/sit, LDT/16-bit/vsyscall, /dev/mem, /dev/port, BSD ptys, AppArmor, geneve/macvlan/macvtap/vlan/bridge. KEPT deliberately: WIREGUARD (cilium encrypt-node LIVE), DUMMY (nodelocal-dns), VXLAN/VETH/netfilter (iptables masquerade path is load-bearing).

Companions ride separate trains: builder-images (bake hard-gate +5 symbols; kargs reserve_mem/ramoops, delayacct, lockdown=integrity; systemd RuntimeWatchdogSec), seanfarm (sysctl kernel.io_uring_disabled=1). Release after those merge; versionPolicy mints 6.18.44-seanfarm33; post-roll sysrq-c drill on one worker proves pstore + auto-reboot.

The approved config audit (plan: purrfect-doodling-garden). One file: arch/x86/configs/seanfarm_defconfig. ADD — forensics/self-recovery (panic+auto-reboot posture): pstore+ramoops, softlockup/hardlockup(buddy)/hung-task detectors with panic flags, panic_on_oops, softdog. The 069094 wedge class becomes self-healing with evidence. ADD — observability/memory: PSI, delayacct, MGLRU, THP default madvise. FIX — security: lockdown LSM actually compiled (the LSM string already named it), dmesg_restrict, random_kmalloc_caches, bug_on_data_corruption. DROP — verified dead against live /proc/config.gz + QEMU Q35 hardware + deployed stack: KVM host support, kexec/kdump, IKHEADERS, Intel MEI, cpufreq, ipip/sit, LDT/16-bit/vsyscall, /dev/mem, /dev/port, BSD ptys, AppArmor, geneve/macvlan/macvtap/vlan/bridge. KEPT deliberately: WIREGUARD (cilium encrypt-node LIVE), DUMMY (nodelocal-dns), VXLAN/VETH/netfilter (iptables masquerade path is load-bearing). Companions ride separate trains: builder-images (bake hard-gate +5 symbols; kargs reserve_mem/ramoops, delayacct, lockdown=integrity; systemd RuntimeWatchdogSec), seanfarm (sysctl kernel.io_uring_disabled=1). Release after those merge; versionPolicy mints 6.18.44-seanfarm33; post-roll sysrq-c drill on one worker proves pstore + auto-reboot.

sean added 1 commit 2026-08-15 07:30:05 +00:00

kernel(config): seanfarm33 — forensics/recovery adds, verified trims ... 02d0f2c85e

Adds (wedge posture = panic + auto-reboot, decided 2026-08-15): pstore
with ramoops, softlockup/hardlockup (buddy) and hung-task detectors that
panic, panic_on_oops, softdog. A wedged node now reboots itself in
minutes and leaves a trace; node 069094 sat Ready-but-dead with zero
evidence for want of these.

Adds (observability + memory): PSI, task delay accounting, MGLRU,
THP default madvise (Postgres/etcd latency; Mayastor hugetlbfs is
explicit and untouched).

Security: compile the lockdown LSM the LSM list already named (it was
inert), dmesg_restrict, random_kmalloc_caches, bug_on_data_corruption.

Drops, each verified against the live config, the QEMU Q35 hardware,
and the deployed stack: KVM host support, kexec/kdump (never had
crashkernel=; bootc reboots via firmware), IKHEADERS, Intel MEI,
cpufreq, ipip/sit tunnels (cilium is vxlan), LDT/16-bit/vsyscall,
/dev/mem, /dev/port, BSD ptys, AppArmor (no userspace on Alma), and
geneve/macvlan/macvtap/vlan/bridge. WireGuard STAYS: cilium node
encryption is live. DUMMY stays: nodelocal-dns uses it.

pipeline-bot merged commit 02d0f2c85e into trunk 2026-08-15 11:35:47 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/linux!19

No description provided.