podroid_kernel.config

# ──────────────────────────────────────────────────────────────────────────────
# Podroid kernel config fragment — applied on top of arm64 defconfig.
#
# Goal: eliminate the 19s modprobe loop by building every required driver
# directly into the kernel image.  No loadable modules needed at runtime.
#
# Build flow:
#   make ARCH=arm64 defconfig
#   scripts/kconfig/merge_config.sh -m .config podroid_kernel.config
#   make ARCH=arm64 olddefconfig
#   make ARCH=arm64 -j$(nproc) Image.gz
# ──────────────────────────────────────────────────────────────────────────────

# ── Initramfs support (required for boot) ────────────────────────────────────
CONFIG_BLK_DEV_INITRD=y
CONFIG_RD_GZIP=y

# ── Strip debug info (halves build time and kernel size) ─────────────────────
CONFIG_DEBUG_INFO_NONE=y
# CONFIG_DEBUG_INFO is not set

# ── Timer: 100 Hz instead of default 250 Hz, tickless idle ───────────────────
CONFIG_HZ_100=y
CONFIG_NO_HZ_IDLE=y
CONFIG_NO_HZ=y

# ── Scheduler: throughput/server mode, lower context-switch overhead ─────────
CONFIG_PREEMPT_NONE=y

# ── Transparent huge pages — help memory allocators through TCG ──────────────
CONFIG_TRANSPARENT_HUGEPAGE=y
CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y

# ── Virtio devices (all built-in — no modprobe at boot) ──────────────────────
CONFIG_VIRTIO=y
CONFIG_VIRTIO_PCI=y
CONFIG_VIRTIO_BLK=y
CONFIG_VIRTIO_NET=y
CONFIG_VIRTIO_CONSOLE=y
CONFIG_HW_RANDOM_VIRTIO=y
# CONFIG_VIRTIO_BALLOON is not set
# CONFIG_VIRTIO_INPUT is not set

# ── Block I/O — selected per-device via sysfs in podroid-bootstrap ───────────
CONFIG_MQ_IOSCHED_DEADLINE=y
CONFIG_BLK_CGROUP=y
CONFIG_BLK_CGROUP_IOCOST=y
# CONFIG_MQ_IOSCHED_KYBER is not set

# ── Serial console: PL011 UART = ttyAMA0 ─────────────────────────────────────
CONFIG_SERIAL_AMBA_PL011=y
CONFIG_SERIAL_AMBA_PL011_CONSOLE=y

# ── Filesystems (built-in) ────────────────────────────────────────────────────
CONFIG_EXT4_FS=y
# Unicode/UTF-8 casefold tables: Android formats ext4/f2fs with the casefold
# (case-insensitive) feature, and the kernel refuses to mount such volumes
# without CONFIG_UNICODE. Needed so passed-through Android-formatted storage
# is mountable in the guest.
CONFIG_UNICODE=y
CONFIG_OVERLAY_FS=y
CONFIG_FUSE_FS=y
CONFIG_TMPFS=y
CONFIG_TMPFS_XATTR=y
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
# CONFIG_EXT2_FS is not set
# CONFIG_EXT3_FS is not set
# CONFIG_BTRFS_FS is not set
# CONFIG_XFS_FS is not set

# ── Squashfs + zstd decoder — required to mount /dev/vdb (alpine-rootfs.squashfs)
# build-rootfs.sh uses `mksquashfs -comp zstd -Xcompression-level 19`,
# so the kernel MUST be able to decode zstd at mount time. Modules don't
# load early enough — these must be builtin.
CONFIG_SQUASHFS=y
CONFIG_SQUASHFS_ZSTD=y
CONFIG_DECOMPRESS_ZSTD=y
CONFIG_ZSTD_DECOMPRESS=y

# ── virtio-9p: Downloads folder sharing ──────────────────────────────────────
CONFIG_NET_9P=y
CONFIG_NET_9P_VIRTIO=y
CONFIG_9P_FS=y

# ── ZRAM: built-in compressed swap (replaces modprobe zram in init) ───────────
CONFIG_SWAP=y
CONFIG_ZSMALLOC=y
CONFIG_ZRAM=y
CONFIG_ZRAM_DEF_COMP_LZ4=y
CONFIG_CRYPTO_LZ4=y
CONFIG_CRYPTO_LZ4HC=y

# ── Networking: TUN/VETH/bridge (built-in for Podman container networking) ───
CONFIG_TUN=y
CONFIG_VETH=y
CONFIG_BRIDGE=y
CONFIG_BRIDGE_NETFILTER=y
CONFIG_BRIDGE_VLAN_FILTERING=y
CONFIG_VLAN_8021Q=y
CONFIG_NET_SCHED=y
CONFIG_NET_SCH_FQ_CODEL=y
CONFIG_DUMMY=y

# ── Netfilter: full stack needed by netavark + iptables compat ───────────────
CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
CONFIG_NETFILTER_NETLINK=y
CONFIG_NETFILTER_NETLINK_LOG=y
CONFIG_NF_CONNTRACK=y
CONFIG_NF_CONNTRACK_NETLINK=y
CONFIG_NF_NAT=y

# nftables (netavark primary backend)
CONFIG_NF_TABLES=y
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_IPV4=y
CONFIG_NF_TABLES_IPV6=y
CONFIG_NF_TABLES_BRIDGE=y
CONFIG_NF_TABLES_NETDEV=y
# NFT_COUNTER / NFT_SET_RBTREE / NFT_SET_HASH were merged into nf_tables core
# in Linux ~6.2 — they are now built unconditionally when CONFIG_NF_TABLES=y
# and the standalone Kconfig symbols no longer exist (verified absent in v7.0).
CONFIG_NFT_CONNLIMIT=y
CONFIG_NFT_LOG=y
CONFIG_NFT_LIMIT=y
CONFIG_NFT_MASQ=y
CONFIG_NFT_REDIR=y
CONFIG_NFT_NAT=y
CONFIG_NFT_CT=y

# iptables (legacy compat layer used by some container tools)
CONFIG_NETFILTER_XTABLES=y
CONFIG_IP_NF_IPTABLES=y
CONFIG_IP_NF_FILTER=y
CONFIG_IP_NF_NAT=y
CONFIG_IP_NF_MANGLE=y
CONFIG_IP6_NF_IPTABLES=y
CONFIG_IP6_NF_FILTER=y
CONFIG_IP6_NF_NAT=y
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
CONFIG_NETFILTER_XT_MATCH_MARK=y
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
CONFIG_NETFILTER_XT_TARGET_MARK=y

# ── Cgroups v2 — full set required by Podman ─────────────────────────────────
CONFIG_CGROUPS=y
CONFIG_CGROUP_SCHED=y
CONFIG_CGROUP_PIDS=y
CONFIG_CGROUP_RDMA=y
CONFIG_CGROUP_FREEZER=y
CONFIG_CGROUP_HUGETLB=y
CONFIG_CPUSETS=y
# CONFIG_MEMCG_SWAP was removed in Linux 6.1 — swap accounting is now
# unconditional and folded into MEMCG itself (verified absent in v7.0).
CONFIG_MEMCG=y
CONFIG_BLK_CGROUP=y
CONFIG_CGROUP_PERF=y
CONFIG_CGROUP_BPF=y
CONFIG_CGROUP_NET_PRIO=y
CONFIG_CGROUP_NET_CLASSID=y

# ── Namespaces — rootless Podman requires all of these ───────────────────────
CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_TIME_NS=y
CONFIG_IPC_NS=y
CONFIG_USER_NS=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y

# ── Security ──────────────────────────────────────────────────────────────────
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y

# ── ARM64 hardware crypto (AES/SHA via CPU instructions) ─────────────────────
# CRYPTO_SHA2_ARM64_CE and CRYPTO_AES_ARM64_CE were removed in Linux ~6.10–6.13.
# Their accelerated routines moved to lib/crypto and are auto-selected by
# CRYPTO_SHA256 / CRYPTO_AES on capable CPUs (verified absent in v7.0).
CONFIG_CRYPTO_SHA256=y
CONFIG_CRYPTO_AES=y
CONFIG_CRYPTO_GHASH_ARM64_CE=y

# ── Disable: display (headless — QEMU runs with -display none) ───────────────
# CONFIG_DRM is not set
# CONFIG_FB is not set
# CONFIG_FRAMEBUFFER_CONSOLE is not set

# ──────────────────────────────────────────────────────────────────────────────
# USB host stack + passthrough device drivers
#
# When USB passthrough is enabled, QEMU attaches a qemu-xhci (PCIe XHCI)
# controller and UsbPassthroughManager hot-plugs real Android USB devices into
# the guest at runtime (QMP add-fd + device_add usb-host). The guest kernel
# binds a class driver to whatever is passed through, so every USB device
# class is built in here — storage, input/HID, serial adapters, network
# dongles, audio, webcams, printers, Bluetooth and Wi-Fi. All =y so a device
# can appear before the modprobe-free init has any chance to load a module.
# ──────────────────────────────────────────────────────────────────────────────

# ── Compressed firmware ──────────────────────────────────────────────────────
# Alpine ships /lib/firmware zstd-compressed (e.g. rtw8821a_fw.bin.zst). The
# firmware loader only tries a compressed file as a fallback, and only when
# this is enabled — without it USB Wi-Fi/Bluetooth drivers fail probe with
# -ENOENT even though the firmware package is installed.
CONFIG_FW_LOADER_COMPRESS=y
CONFIG_FW_LOADER_COMPRESS_ZSTD=y

# ── USB core + host controllers ──────────────────────────────────────────────
CONFIG_USB_SUPPORT=y
CONFIG_USB=y
CONFIG_USB_PCI=y
CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
CONFIG_USB_DEFAULT_PERSIST=y
CONFIG_USB_MON=y
CONFIG_USB_XHCI_HCD=y
CONFIG_USB_XHCI_PCI=y
CONFIG_USB_EHCI_HCD=y
CONFIG_USB_EHCI_PCI=y
CONFIG_USB_OHCI_HCD=y
CONFIG_USB_OHCI_HCD_PCI=y
CONFIG_USB_UHCI_HCD=y

# ── Input + HID (keyboards, mice, touchpads, gamepads, tablets) ──────────────
CONFIG_INPUT=y
CONFIG_INPUT_EVDEV=y
CONFIG_INPUT_KEYBOARD=y
CONFIG_INPUT_MOUSE=y
CONFIG_INPUT_JOYDEV=y
CONFIG_INPUT_JOYSTICK=y
CONFIG_INPUT_TABLET=y
CONFIG_INPUT_TOUCHSCREEN=y
CONFIG_INPUT_MISC=y
CONFIG_HID=y
CONFIG_HID_GENERIC=y
CONFIG_HID_MULTITOUCH=y
CONFIG_HIDRAW=y
CONFIG_USB_HID=y
CONFIG_USB_HIDDEV=y

# ── USB mass storage (sits on SCSI) + removable-media filesystems ────────────
CONFIG_SCSI=y
CONFIG_BLK_DEV_SD=y
CONFIG_BLK_DEV_SR=y
CONFIG_CHR_DEV_SG=y
CONFIG_USB_STORAGE=y
CONFIG_USB_UAS=y
CONFIG_FAT_FS=y
CONFIG_VFAT_FS=y
CONFIG_EXFAT_FS=y
CONFIG_NTFS3_FS=y
CONFIG_ISO9660_FS=y
CONFIG_UDF_FS=y
CONFIG_NLS_CODEPAGE_437=y
CONFIG_NLS_ISO8859_1=y
CONFIG_NLS_UTF8=y

# ── USB serial converters (FTDI / Prolific / Silabs / WCH …) + CDC-ACM ───────
CONFIG_USB_ACM=y
CONFIG_USB_SERIAL=y
CONFIG_USB_SERIAL_GENERIC=y
CONFIG_USB_SERIAL_FTDI_SIO=y
CONFIG_USB_SERIAL_PL2303=y
CONFIG_USB_SERIAL_CP210X=y
CONFIG_USB_SERIAL_CH341=y
CONFIG_USB_SERIAL_OPTION=y
CONFIG_USB_SERIAL_QUALCOMM=y
CONFIG_USB_SERIAL_SIERRAWIRELESS=y

# ── Wired USB network adapters ───────────────────────────────────────────────
CONFIG_USB_NET_DRIVERS=y
CONFIG_USB_USBNET=y
CONFIG_USB_NET_AX8817X=y
CONFIG_USB_NET_AX88179_178A=y
CONFIG_USB_NET_CDCETHER=y
CONFIG_USB_NET_CDC_EEM=y
CONFIG_USB_NET_CDC_NCM=y
CONFIG_USB_NET_CDC_MBIM=y
CONFIG_USB_NET_RNDIS_HOST=y
CONFIG_USB_RTL8150=y
CONFIG_USB_RTL8152=y
CONFIG_USB_LAN78XX=y
CONFIG_USB_NET_SMSC75XX=y
CONFIG_USB_NET_SMSC95XX=y
CONFIG_USB_NET_DM9601=y
CONFIG_USB_NET_MCS7830=y
CONFIG_USB_CATC=y
CONFIG_USB_KAWETH=y
CONFIG_USB_PEGASUS=y
CONFIG_USB_IPHETH=y

# ── USB audio / MIDI ─────────────────────────────────────────────────────────
CONFIG_SOUND=y
CONFIG_SND=y
CONFIG_SND_USB=y
CONFIG_SND_USB_AUDIO=y

# ── USB video — UVC webcams ──────────────────────────────────────────────────
CONFIG_MEDIA_SUPPORT=y
CONFIG_MEDIA_USB_SUPPORT=y
CONFIG_MEDIA_CAMERA_SUPPORT=y
CONFIG_VIDEO_DEV=y
CONFIG_USB_VIDEO_CLASS=y

# ── USB printers ─────────────────────────────────────────────────────────────
CONFIG_USB_PRINTER=y

# ── Bluetooth over USB ───────────────────────────────────────────────────────
CONFIG_BT=y
CONFIG_BT_RFCOMM=y
CONFIG_BT_BNEP=y
CONFIG_BT_HIDP=y
CONFIG_BT_HCIBTUSB=y
CONFIG_BT_HCIBTUSB_BCM=y
CONFIG_BT_HCIBTUSB_RTL=y
CONFIG_BT_HCIBTUSB_MTK=y

# ── Wi-Fi over USB — wireless core + common USB dongle families ──────────────
# RFKILL must be =y: cfg80211/mac80211/BT carry `depends on RFKILL || !RFKILL`,
# which evaluates to `m` when RFKILL=m and silently caps the whole wireless +
# Bluetooth stack (and every driver above it) down to a module. Podroid has no
# module-loading path for these, so a demoted driver is a dead driver.
CONFIG_RFKILL=y
CONFIG_WIRELESS=y
CONFIG_CFG80211=y
CONFIG_MAC80211=y
CONFIG_WLAN=y
CONFIG_WLAN_VENDOR_ATH=y
CONFIG_ATH9K_HTC=y
CONFIG_CARL9170=y
CONFIG_AR5523=y
CONFIG_WLAN_VENDOR_BROADCOM=y
CONFIG_BRCMFMAC=y
CONFIG_BRCMFMAC_USB=y
CONFIG_WLAN_VENDOR_INTERSIL=y
CONFIG_P54_COMMON=y
CONFIG_P54_USB=y
CONFIG_WLAN_VENDOR_MARVELL=y
CONFIG_MWIFIEX=y
CONFIG_MWIFIEX_USB=y
CONFIG_LIBERTAS=y
CONFIG_LIBERTAS_USB=y
CONFIG_WLAN_VENDOR_MEDIATEK=y
CONFIG_MT7601U=y
CONFIG_MT76x0U=y
CONFIG_MT76x2U=y
CONFIG_MT7921U=y
CONFIG_WLAN_VENDOR_RALINK=y
CONFIG_RT2X00=y
CONFIG_RT2500USB=y
CONFIG_RT73USB=y
CONFIG_RT2800USB=y
CONFIG_RT2800USB_RT33XX=y
CONFIG_RT2800USB_RT35XX=y
CONFIG_RT2800USB_RT3573=y
CONFIG_RT2800USB_RT53XX=y
CONFIG_RT2800USB_RT55XX=y
CONFIG_RT2800USB_UNKNOWN=y
CONFIG_WLAN_VENDOR_REALTEK=y
CONFIG_RTL8187=y
CONFIG_RTL8XXXU=y
CONFIG_RTL_CARDS=y
CONFIG_RTL8192CU=y
CONFIG_RTW88=y
CONFIG_RTW88_8822BU=y
CONFIG_RTW88_8822CU=y
CONFIG_RTW88_8723DU=y
CONFIG_RTW88_8821CU=y
# AU-series USB adapters (RTL8821AU / RTL8812AU / RTL8814AU) — e.g. the many
# TP-Link Archer T2U/T4U dongles. Separate drivers from the *CU/*BU ones.
CONFIG_RTW88_8821AU=y
CONFIG_RTW88_8812AU=y
CONFIG_RTW88_8814AU=y
CONFIG_WLAN_VENDOR_ZYDAS=y
CONFIG_ZD1211RW=y
CONFIG_WLAN_VENDOR_ATMEL=y
CONFIG_AT76C50X_USB=y
CONFIG_USB_NET_RNDIS_WLAN=y

# ── Disable: storage buses not used (virtio-blk + USB only) ──────────────────
# CONFIG_ATA is not set
# CONFIG_MMC is not set
# CONFIG_MEMSTICK is not set

# ── Disable: other unused subsystems ─────────────────────────────────────────
# CONFIG_WATCHDOG is not set
# CONFIG_IOMMU_SUPPORT is not set
# CONFIG_CAN is not set
# CONFIG_NFC is not set
# CONFIG_INFINIBAND is not set
# LED class is built in (=y, not =m): rtl8xxxu carries `depends on LEDS_CLASS`
# and mac80211/rtw88 select it, so a module-level LEDS_CLASS caps those USB
# Wi-Fi drivers down to =m — same dead-driver trap as RFKILL above.
CONFIG_NEW_LEDS=y
CONFIG_LEDS_CLASS=y
# CONFIG_EDAC is not set
# CONFIG_W1 is not set
# CONFIG_PCCARD is not set
# CONFIG_MTD is not set