pmaports/kconfigcheck.toml

# pmaports CI and "pmbootstrap kconfig check" use this file to ensure our
# kernels have certain kernel config options set. Which categories are checked
# depends on options="pmb:kconfigcheck-…" in the linux APKBUILD. If no such
# option is set, see the default in ["category:default".">=0.0.0"."all"] below.

[aliases]
# Devices with options="pmb:kconfigcheck-community" in the device APKBUILD will
# check for the following categories. A CI check ensures that all devices in
# device/main and device/community dirs have this option. Devices in testing
# may also have "pmb:kconfigcheck-community", but it may be removed when
# modifying the required options and adjusting the devices in testing is too
# much effort. Device maintainers may fix it up afterwards and add it back.
community = [
	"category:default",
	"category:community_various",
	"category:containers",
	"category:debug",
	"category:filesystems",
	"category:input",
	"category:iwd",
	"category:libcamera",
	"category:netboot",
	"category:nftables",
	"category:usb_gadgets",
	"category:waydroid",
	"category:wireguard",
	"category:zram",
]

# Format for rule sections:
#   ["category:<NAME>"."<KERNEL_VERSION>"."<ARCHITECTURES>"]
# Implemented value types:
# - boolean (e.g. 'ANDROID_PARANOID_NETWORK = false'):
#   - false: disabled
#   - true: enabled, either as module or built-in
# - list (e.g. 'ANDROID_BINDER_DEVICES = ["binder", "hwbinder"]'):
#   - each element of the array must be contained in the kernel config string,
#     in any order. The example above would accept the following in the config:
#       CONFIG_ANDROID_BINDER_DEVICES="hwbinder,vndbinder,binder"
# - string (e.g. 'LSM = "lockdown,yama,loadpin,safesetid,integrity"'):
#   - the value in the kernel config must be the same as the given string. Use
#     this e.g. if the order of the elements is important.

# default: all devices must satisfy these
["category:default".">=0.0.0"."all"]
ANDROID_PARANOID_NETWORK = false
BLK_DEV_INITRD = true
CGROUPS = true
CRYPTO_AES = true
CRYPTO_XTS = true
DEVTMPFS = true
DM_CRYPT = true
INPUT_EVDEV = true
EXT4_FS = true
KINETO_GAN = false
PFT = false
SEC_RESTRICT_ROOTING = false
SYSVIPC = true
TMPFS_POSIX_ACL = true
USE_VFB = false
VT = true
["category:default".">=2.6.0"."all"]
BINFMT_ELF = true
["category:default".">=3.10.0"."all"]
BINFMT_SCRIPT = true
["category:default".">=4.0.0"."all"]
UEVENT_HELPER = true
USER_NS = true
["category:default"."<4.7.0"."all"]
DEVPTS_MULTIPLE_INSTANCES = true
["category:default"."<4.14.0"."all"]
SAMSUNG_TUI = false
TZDEV = false
["category:default"."<5.2.0"."armhf armv7 x86"]
LBDAF = true
["category:default".">=5.2.0"."all"]
# Provide a proper dummy null console to improve compatibility
# on devices that like to coerce console=null
NULL_TTY = true
["category:default".">=5.19.0"."all"]
FW_LOADER_COMPRESS_ZSTD = true

# waydroid: android compatibility layer
["category:waydroid".">=0.0.0"."all"]
ANDROID_BINDERFS = false
ANDROID_BINDER_DEVICES = ["binder", "hwbinder", "vndbinder"]
ANDROID_BINDER_IPC = true
ANDROID_BINDER_IPC_SELFTEST = false
BLK_DEV_LOOP = true
BPF_SYSCALL = true
BRIDGE = true
BRIDGE_VLAN_FILTERING = true
CGROUP_BPF = true
FUSE_FS = true
IP_NF_MANGLE = true
NETFILTER_XTABLES = true
NETFILTER_XT_MATCH_COMMENT = true
PSI = true
PSI_DEFAULT_DISABLED = false
SQUASHFS = true
SQUASHFS_XATTR = true
SQUASHFS_XZ = true
TMPFS_XATTR = true
TUN = true
VETH = true
VLAN_8021Q = true  # prerequisite for bridge
["category:waydroid".">=3.5"."all"]
CROSS_MEMORY_ATTACH = true
["category:waydroid".">=4.20.0"."all"]
PSI = true  # required by userspace OOM killer
PSI_DEFAULT_DISABLED = false
["category:waydroid"."<5.18"."all"]
ASHMEM = true

# iwd: modern inet wireless daemon
# Obtained from 'grep ADD_MISSING src/main.c' in iwd.git
["category:iwd".">=0.0.0"."all"]
ASYMMETRIC_KEY_TYPE = true
ASYMMETRIC_PUBLIC_KEY_SUBTYPE = true
CRYPTO_AES = true
CRYPTO_CBC = true
CRYPTO_CMAC = true
CRYPTO_DES = true
CRYPTO_ECB = true
CRYPTO_HMAC = true
CRYPTO_MD4 = true  # Needed for EAP MSCHAPV2 authentication
CRYPTO_MD5 = true
CRYPTO_SHA1 = true
CRYPTO_SHA256 = true
CRYPTO_SHA512 = true
CRYPTO_USER_API_HASH = true
CRYPTO_USER_API_SKCIPHER = true
KEYS = true
KEY_DH_OPERATIONS = true
PKCS7_MESSAGE_PARSER = true
PKCS8_PRIVATE_KEY_PARSER = true
X509_CERTIFICATE_PARSER = true
RFKILL = true

# nftables: firewall, not related to nft scams
["category:nftables".">=3.13.0"."all"]
NETFILTER = true
NF_CONNTRACK = true
NF_TABLES = true
NF_TABLES_INET = true
NFT_CT = true
NFT_LOG = true
NFT_LIMIT = true
NFT_MASQ = true
NFT_NAT = true
NFT_REJECT = true
NF_TABLES_IPV4 = true
NF_REJECT_IPV4 = true
IP_NF_IPTABLES = true
IP_NF_FILTER = true
IP_NF_TARGET_REJECT = true
IP_NF_NAT = true
NF_TABLES_IPV6 = true
NF_REJECT_IPV6 = true
IP6_NF_IPTABLES = true
IP6_NF_FILTER = true
IP6_NF_TARGET_REJECT = true
IP6_NF_NAT = true
["category:nftables".">=3.13.0 <0.17"."all"]
NFT_COUNTER = true

# containers: lxc, docker, etc.
["category:containers".">=0.0.0"."all"]
NAMESPACES = true
NET_NS = true
PID_NS = true
IPC_NS = true
UTS_NS = true
CGROUPS = true
CGROUP_CPUACCT = true
CGROUP_DEVICE = true
CGROUP_FREEZER = true
CGROUP_SCHED = true
CPUSETS = true
KEYS = true
VETH = true
BRIDGE = true  # (also needed for waydroid)
BRIDGE_NETFILTER = true
IP_NF_FILTER = true
IP_NF_TARGET_MASQUERADE = true
NETFILTER_XT_MATCH_ADDRTYPE = true
NETFILTER_XT_MATCH_CONNTRACK = true
NETFILTER_XT_MATCH_IPVS = true
NETFILTER_XT_MARK = true
NETFILTER_XT_TARGET_CHECKSUM = true  # Needed for lxc
IP_NF_NAT = true
NF_NAT = true
POSIX_MQUEUE = true
BLK_DEV_DM = true  # Storage Drivers
DUMMY = true  # Network Drivers
# USER_NS = true  # This is already in pmOS kconfig check
BLK_CGROUP = true  # Optional section
BLK_DEV_THROTTLING = true  # Optional section
CGROUP_PERF = true  # Optional section
NET_CLS_CGROUP = true  # Optional section
FAIR_GROUP_SCHED = true  # Optional section
IP_NF_TARGET_REDIRECT = true  # Optional section
IP_VS = true  # Optional section
IP_VS_NFCT = true  # Optional section
IP_VS_PROTO_TCP = true  # Optional section
IP_VS_PROTO_UDP = true  # Optional section
IP_VS_RR = true  # Optional section
# EXT4_FS = true  # This is already in pmOS kconfig check
EXT4_FS_POSIX_ACL = true  # Optional section
EXT4_FS_SECURITY = true  # Optional section
["category:containers".">=3.2"."all"]
CFS_BANDWIDTH = true  # Optional section
["category:containers".">=3.3"."all"]
CHECKPOINT_RESTORE = true  # Needed for lxc
["category:containers".">=3.6"."all"]
MEMCG = true
DM_THIN_PROVISIONING = true  # Storage Drivers
SWAP = true
["category:containers".">=3.6"."x86 x64_64"]
HUGETLB_PAGE = true
CGROUP_HUGETLB = true  # Optional section
["category:containers".">=3.6 <6.1_rc1"."all"]
MEMCG_SWAP = true
["category:containers".">=3.7 <5.0"."all"]
NF_NAT_IPV4 = true  # Needed for lxc
NF_NAT_IPV6 = true  # Needed for lxc
["category:containers".">=3.7"."all"]
VXLAN = true  # Network Drivers
IP6_NF_TARGET_MASQUERADE = true  # Needed for lxc
["category:containers".">=3.9"."all"]
BRIDGE_VLAN_FILTERING = true  # Network Drivers (also for waydroid)
MACVLAN = true  # Network Drivers
["category:containers".">=3.13"."all"]
NFT_COMPAT = true
["category:containers".">=3.14"."all"]
CGROUP_NET_PRIO = true  # Optional section
["category:containers".">=3.18"."all"]
OVERLAY_FS = true  # Storage Drivers
["category:containers".">=3.19"."all"]
IPVLAN = true  # Network Drivers
SECCOMP = true  # Optional section
["category:containers".">=4.4"."all"]
CGROUP_PIDS = true  # Optional section

# zram: RAM disk with on-the-fly compression
["category:zram".">=0.0.0"."all"]
ZRAM = true
ZSMALLOC = true
SWAP = true

["category:zram"."<6.12"."all"]
CRYPTO_ZSTD = true

["category:zram".">=6.12"."all"]
ZRAM_BACKEND_ZSTD = true

# netboot: https://postmarketos.org/netboot
["category:netboot".">=0.0.0"."all"]
BLK_DEV_NBD = true

# wireguard: VPN software, also includes options for wg-quick
["category:wireguard".">=5.6_rc1"."all"]
WIREGUARD = true
IP_ADVANCED_ROUTER = true
IP_MULTIPLE_TABLES = true
IPV6_MULTIPLE_TABLES = true
NF_TABLES = true
NF_TABLES_IPV4 = true
NF_TABLES_IPV6 = true
NFT_CT = true
NFT_FIB = true
NFT_FIB_IPV4 = true
NFT_FIB_IPV6 = true
NF_CONNTRACK_MARK = true

# filesystems
["category:filesystems".">=0.0.0"."all"]
BTRFS_FS = true
EXFAT_FS = true
EXT4_FS = true
F2FS_FS = true
UDF_FS = true
XFS_FS = true

# usb_gadgets
["category:usb_gadgets".">=0.0.0"."all"]
# disable legacy gadgets
USB_ETH = false
USB_FUNCTIONFS = false
USB_MASS_STORAGE = false
USB_G_SERIAL = false
# enable configfs gadgets
USB_CONFIGFS_ACM = true  # Serial gadget for debug-shell
USB_CONFIGFS_MASS_STORAGE = true  # Mass storage gadget for debug-shell
USB_CONFIGFS_NCM = true  # USB networking via NCM
USB_CONFIGFS_RNDIS = true  # USB networking via RNDIS (legacy)

# community_various: Various options that were not categorized properly due to
# inflexibility of previous kconfigcheck related code. We should move these to
# proper categories above and/or invent new categories with meaningful names.
# >> Do not add more here!! <<
["category:community_various".">=0.0.0"."all"]
BINFMT_MISC = true  # register binary formats
CIFS = true  # mount SMB shares
LEDS_TRIGGER_PATTERN = true  # feedbackd
LEDS_TRIGGER_TIMER = true  # hfd-service
NETFILTER_XT_MATCH_MARK = true  # e.g. HashiCorp Nomad
NETFILTER_XT_MATCH_MULTIPORT = true  # e.g. HashiCorp Nomad
NETFILTER_XT_MATCH_STATISTIC = true  # kube-proxy
NETFILTER_XT_MATCH_TCPMSS = true  # change MTU e.g. for Wireguard
NETFILTER_XT_TARGET_TCPMSS = true  # change MTU e.g. for Wireguard
# TODO = Depends on SUSPEND which is not enabled for some devices
# PM_WAKELOCKS = true  # Sxmo
UCLAMP_TASK = true  # Scheduler hints
UCLAMP_TASK_GROUP = true  # Scheduler hints
RT_GROUP_SCHED = false  # https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/2652
DM_INTEGRITY = true  # Device-mapper integrity target

# uefi: proper modern booting
["category:uefi".">=0.0.0"."all"]
EFI_STUB = true
EFI = true
DMI = true
EFI_ESRT = true
EFI_VARS_PSTORE = true
EFI_RUNTIME_WRAPPERS = true
VFAT_FS = true
NLS_ASCII = true
["category:uefi".">=0.0.0"."x86_64"]
EFI_MIXED = true
["category:uefi".">=0.0.0"."aarch64 armv7"]
EFI_GENERIC_STUB = true
EFI_PARAMS_FROM_FDT = true
["category:uefi".">=6.1.0"."aarch64"]
# Required EFI booting compressed kernels on this arch
EFI_ZBOOT = true
# Devices that used to run windows may still want to access
# the windows partition (e.g. to retrieve firmware on WoA)
["category:uefi".">=5.15"."aarch64 x86_64"]
NTFS3_FS = true

["category:libcamera".">=0.0.0"."aarch64"]
UDMABUF = true

["category:input".">=0.0.0"."all"]
BT_HIDP = true  # Bluetooth HID
HIDRAW = true  # /dev/hidraw* support
INPUT_UINPUT = true  # buffyboard
JOYSTICK_XPAD = true  # Xbox controller
JOYSTICK_XPAD_FF = true  # Xbox controller force-feedback
JOYSTICK_XPAD_LEDS = true  # Xbox controller LEDs
UHID = true  # User-space HID, e.g. Bluetooth
USB_ANNOUNCE_NEW_DEVICES = true  # dmesg messages when connecting device
USB_HIDDEV = true  # /dev/usb/hiddevX support
USB_PRINTER = true  # printers
# All the special HID drivers that Fedora kernel enables
HID_A4TECH = true
HID_ACCUTOUCH = true
HID_ACRUX_FF = true
HID_ACRUX = true
HID_ALPS = true
HID_APPLEIR = true
HID_APPLE = true
HID_AUREAL = true
HID_BATTERY_STRENGTH = true
HID_BELKIN = true
HID_BETOP_FF = true
HID_BIGBEN_FF = true
HID_CHERRY = true
HID_CHICONY = true
HID_CMEDIA = true
HID_CORSAIR = true
HID_COUGAR = true
HID_CP2112 = true
HID_CREATIVE_SB0540 = true
HID_CYPRESS = true
HID_DRAGONRISE = true
HID_ELAN = true
HID_ELECOM = true
HID_ELO = true
HID_EMS_FF = true
HID_EZKEY = true
HID_FT260 = true
HID_GEMBIRD = true
HID_GENERIC = true
HID_GFRM = true
HID_GLORIOUS = true
HID_GREENASIA = true
HID_GT683R = true
HID_GYRATION = true
HID_HOLTEK = true
HID_ICADE = true
HID_ITE = true
HID_JABRA = true
HID_KENSINGTON = true
HID_KEYTOUCH = true
HID_KYE = true
HID_LCPOWER = true
HID_LED = true
HID_LENOVO = true
HID_LETSKETCH = true
HID_LOGITECH_DJ = true
HID_LOGITECH_HIDPP = true
HID_LOGITECH = true
HID_MACALLY = true
HID_MAGICMOUSE = true
HID_MALTRON = true
HID_MAYFLASH = true
HID_MCP2221 = true
HID_MEGAWORLD_FF = true
HID_MICROSOFT = true
HID_MONTEREY = true
HID_MULTITOUCH = true
HID_NINTENDO = true
HID_NTI = true
HID_NTRIG = true
HID_ORTEK = true
HID_PANTHERLORD = true
HID_PENMOUNT = true
HID_PETALYNX = true
HID_PICOLCD_BACKLIGHT = true
HID_PICOLCD_FB = true
HID_PICOLCD_LCD = true
HID_PICOLCD_LEDS = true
HID_PICOLCD = true
HID_PID = true
HID_PLANTRONICS = true
HID_PLAYSTATION = true
HID_PRIMAX = true
HID_PRODIKEYS = true
HID_PXRC = true
HID_RAZER = true
HID_RETRODE = true
HID_RMI = true
HID_ROCCAT = true
HID_SAITEK = true
HID_SAMSUNG = true
HID_SEMITEK = true
HID_SENSOR_ACCEL_3D = true
HID_SENSOR_ALS = true
HID_SENSOR_CUSTOM_INTEL_HINGE = true
HID_SENSOR_DEVICE_ROTATION = true
HID_SENSOR_GYRO_3D = true
HID_SENSOR_HUB = true
HID_SENSOR_HUMIDITY = true
HID_SENSOR_IIO_COMMON = true
HID_SENSOR_IIO_TRIGGER = true
HID_SENSOR_INCLINOMETER_3D = true
HID_SENSOR_MAGNETOMETER_3D = true
HID_SENSOR_TEMP = true
HID_SIGMAMICRO = true
HID_SMARTJOYPLUS = true
HID_SONY = true
HID_SPEEDLINK = true
HID_STEAM = true
HID_STEELSERIES = true
HID_SUNPLUS = true
HID_THINGM = true
HID_THRUSTMASTER = true
HID_TIVO = true
HID_TOPRE = true
HID_TOPSEED = true
HID_TWINHAN = true
HID_U2FZERO = true
HID_UCLOGIC = true
HID_UDRAW_PS3 = true
HID_VIEWSONIC = true
HID_VIVALDI = true
HID_WACOM = true
HID_WALTOP = true
HID_WIIMOTE = true
HID_XIAOMI = true
HID_XINMO = true
HID_ZEROPLUS = true
HID_ZYDACRON = true
["category:input".">=6.3"."all"]
HID_EVISION = true
HID_SUPPORT = true
["category:input".">=6.5"."all"]
HID_NVIDIA_SHIELD = true
["category:input".">=6.6"."all"]
HID_GOOGLE_STADIA_FF = true
["category:input".">=6.10"."all"]
HID_WINWING = true
["category:input".">=6.12"."all"]
HID_GOODIX_SPI = true
["category:input".">=0.0.0"."riscv64 x86 x86_64"]
HID_BPF = true
["category:input".">=6.4.0"."aarch64"]
HID_BPF = true

["category:usb".">=0.0.0"."all"]
DRM_UDL = true  # DisplayLink - connecting displays via USB
SND_USB_AUDIO = true  # USB audio devices
USB_SERIAL_CP210X = true  # USB serial console
USB_STORAGE = true  # USB mass storage devices
USB_RTL8152 = true  # USB Ethernet

["category:virt".">=0.0.0"."all"]
HW_RANDOM_VIRTIO = true
KVM = true
VIRTUALIZATION = true

["category:debug".">=0.0.0"."all"]
DYNAMIC_DEBUG = true  # Enable debug dynamically
DYNAMIC_FTRACE = true  # Enable function tracing dynamically

# Device specific settings to prevent regressions
["category:librem5".">=0.0.0"."aarch64"]
RS9116_FLASH_MODE = false  # pma!2059
["category:pinephonepro".">=0.0.0"."aarch64"]
LEDS_GROUP_MULTICOLOR = true  # pma!5991