Kernel Configuration Addendum

Relevant source files

The following files were used as context for generating this wiki page:

• build-buggy-linux-7_0.bash
• config.addendum.txt
• README.md
• empty.go
• cmdline.txt

The Kernel Configuration Addendum provides a specific set of Linux kernel parameters and build instructions to create a specialized amd64 kernel for the gokrazy ecosystem. This kernel package targets Tailscale natlab/vmtest environments. It intentionally preserves a UDP GSO (Generic Segmentation Offload) regression to allow testing of mitigation behaviors in network software.

Sources: README.md:1-6, empty.go:7-9

Build Pipeline and Integration

The project uses a bash script to automate the retrieval and compilation of the Linux 7.0 kernel. The process merges standard default configurations with the custom addendum to produce a bootable vmlinuz image.

Build Process Flow

The build script follows a linear progression from source acquisition to binary output.

The diagram shows the sequence of operations performed by the build script to generate the final kernel image.
Sources: build-buggy-linux-7_0.bash:4-21

Build Commands

Step	Action	Description
1	curl	Downloads the Linux 7.0 kernel source from kernel.org.
2	tar	Extracts the source into a local directory.
3	make defconfig	Generates a base x86_64 configuration.
4	cat	Appends the config.addendum.txt content to the base .config.
5	make olddefconfig	Resolves dependencies and sets default values for new symbols.
6	make bzImage	Compiles the kernel using all available CPU cores.

Sources: build-buggy-linux-7_0.bash:10-21

Kernel Configuration Modules

The config.addendum.txt file defines specific features required for networking, virtualization, and debugging.

Networking and Firewall

The configuration enables comprehensive networking support, specifically for IPv6, WireGuard, and nftables. It intentionally disables certain Netfilter connection tracking helpers to prevent NAT slipstreaming attacks.

• IPv6 Support: Enables multiple tables and socket support.
• nftables: Provides a full suite of modules including NAT, masquerading, and packet rejection.
• Security: Disables NF_CONNTRACK_FTP, NF_CONNTRACK_SIP, and other helpers.
• Advanced Networking: Includes BPF syscalls, CGROUP BPF, and OverlayFS for container-style networking.

Sources: config.addendum.txt:1-3, config.addendum.txt:26-58, config.addendum.txt:90-105

Hardware and Virtualization Drivers

The kernel supports QEMU q35 environments and specialized network hardware for regression testing.

The diagram illustrates the primary driver categories enabled via the addendum.
Sources: config.addendum.txt:72-87, config.addendum.txt:9-12

Boot Configuration

The kernel uses a specific command line defined in cmdline.txt to manage initialization and error handling.

Parameter	Value	Purpose
root	/dev/sda2	Specifies the second partition of the first disk as the root filesystem.
ro	N/A	Mounts the root filesystem as read-only.
init	/gokrazy/init	Sets the gokrazy-specific init process as the first userspace task.
panic	10	Reboots the system 10 seconds after a kernel panic.
oops	panic	Forces a full kernel panic if an "oops" (recoverable error) occurs.

Sources: cmdline.txt:1

Diagnostic and Testing Features

The kernel is configured to facilitate deep inspection of network behavior and system state.

• UDP GSO Diagnostic: Enables the Intel igb driver to exercise tx-udp-segmentation and tx-gso-partial features.
• Debug Visibility: Enables CONFIG_DYNAMIC_DEBUG and CONFIG_IKCONFIG_PROC to allow viewing the kernel configuration at /proc/config.gz.
• Congestion Control: Sets TCP BBR as the default congestion control algorithm.
• Traffic Shaping: Includes CONFIG_NET_SCH_TBF for use with tc and CONFIG_INET_DIAG for ss utility support.

Sources: config.addendum.txt:5-7, config.addendum.txt:60-61, config.addendum.txt:69-70, config.addendum.txt:111-113, README.md:12-16

Summary

The Kernel Configuration Addendum transforms a standard Linux 7.0 source tree into a specialized testing tool for gokrazy and Tailscale. By layering specific network drivers, container primitives, and intentional regressions onto the base configuration, it creates a deterministic environment for validating network stack mitigations. This package integrates directly into the gokrazy build system as a KernelPackage via the empty.go marker file.

Sources: README.md:18-21, empty.go:5-9