linux-postmarketos-qcom-laptop: use devicepkg-dev

This is (hopefully) makes config validation more robust by considering
all fragments together and detecting missing dependencies when an
expected config is not found in the final generated config (which should
hopeqully help reduce time debugging why options are mysteriously not
present)

There are some possible downsides to this change... the logic is more
complex, and probably slower. But in the overall scope of "generating
full kconfig and building a kernel", it's still a tiny drop in the
bucket.

.ci/testcases/test_kernel.py

@@ -40,14 +40,6 @@ def test_aports_kernel():
                                    " pmbootstrap installs cross-compiler"
                                    " automatically.")
 
-        # check some options only for main and community devices
-        _, relpath = pkgrepo_relative_path(path)
-        for part in ["main", "community"]:
-            if part in relpath.parts:
-                if "pmb:kconfigcheck-community" not in apkbuild["options"]:
-                    raise RuntimeError(f"{aport_name}: \"pmb:kconfigcheck-community\" missing in"
-                                       " options= line, required for all community/main devices.")
-
         # check for postmarketos-installkernel in makedepends when installing kernel with make
         if bool(re.search("make z?install", path.read_text(encoding="utf-8"))):
             if "postmarketos-installkernel" not in apkbuild["makedepends"]:

device/community/linux-google-veyron/APKBUILD

@@ -2,17 +2,14 @@
 # Contributor: Jenneron <jenneron@protonmail.com>
 pkgname=linux-google-veyron
 pkgver=6.6.74
-pkgrel=0
+pkgrel=1
 pkgdesc="Mainline kernel for Google Veyron devices"
 arch="armv7"
 _carch="arm"
 _flavor="${pkgname#linux-}"
 url="https://kernel.org"
 license="GPL-2.0-only"
-options="!strip !check !tracedeps
-	pmb:cross-native
-	pmb:kconfigcheck-community
-"
+options="!strip !check !tracedeps pmb:cross-native"
 makedepends="
 	bash
 	bison
@@ -22,6 +19,7 @@ makedepends="
 	installkernel
 	openssl-dev
 	perl
+	postmarketos-installkernel
 	rsync
 	gzip
 	xz
@@ -48,23 +46,15 @@ replaces="linux-postmarketos-rockchip"
 
 prepare() {
 	default_prepare
-	cp "$srcdir/config-$_flavor.$CARCH" .config
+	. kernel_prepare
 }
 
 build() {
-	unset LDFLAGS
-	make ARCH="$_carch" \
-		KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-$_flavor"
+	. kernel_build
 }
 
 package() {
-	downstreamkernel_package "$builddir" "$pkgdir" "$_carch" "$_flavor"
-
-	make -j1 modules_install dtbs_install \
-		ARCH="$_carch" \
-		INSTALL_MOD_STRIP=1 \
-		INSTALL_MOD_PATH="$pkgdir" \
-		INSTALL_DTBS_PATH="$pkgdir/boot/dtbs"
+	. kernel_package
 }
 
 sha512sums="

device/community/linux-postmarketos-grate/APKBUILD

@@ -5,50 +5,38 @@
 
 pkgname=linux-postmarketos-grate
 pkgver=6.12.5
-pkgrel=1
+pkgrel=2
 pkgdesc="Linux kernel with experimental patches for Tegra"
 arch="armv7"
 url="https://gitlab.com/grate-driver/linux"
 license="GPL-2.0-only"
-options="!strip !check !tracedeps pmb:cross-native pmb:kconfigcheck-community pmb:kconfigcheck-uefi"
+options="!strip !check !tracedeps pmb:cross-native"
 makedepends="bash bison findutils flex postmarketos-installkernel openssl-dev
-	     perl gmp-dev mpc1-dev mpfr-dev xz"
+	     perl gmp-dev mpc1-dev mpfr-dev xz devicepkg-dev"
 
 # Source
 _flavor="${pkgname#linux-}"
 _tag="v${pkgver//_/-}-lts"
 _carch="arm"
-_config="config-$_flavor.$arch"
-source="$pkgname-$_tag.tar.bz2::$url/-/archive/$_tag/linux-$_tag.tar.bz2
-	$_config"
+source="$pkgname-$_tag.tar.bz2::$url/-/archive/$_tag/linux-$_tag.tar.bz2"
 builddir="$srcdir/linux-$_tag"
 
+_pmos_defconfig="grate_defconfig"
+_pmos_uefi="true" # for surface rt
+
 prepare() {
 	default_prepare
-	cp "$srcdir/config-$_flavor.$CARCH" .config
+	. kernel_prepare
 }
 
 build() {
-	unset LDFLAGS
-	make ARCH="$_carch" CC="${CC:-gcc}" \
-		KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-postmarketOS"
+	. kernel_build
 }
 
 package() {
-	mkdir -p "$pkgdir"/boot
-	make zinstall modules_install dtbs_install \
-		ARCH="$_carch" \
-		INSTALL_PATH="$pkgdir"/boot \
-		INSTALL_MOD_PATH="$pkgdir" \
-		INSTALL_MOD_STRIP=1 \
-		INSTALL_DTBS_PATH="$pkgdir"/boot/dtbs
-	rm -f "$pkgdir"/lib/modules/*/build "$pkgdir"/lib/modules/*/source
-
-	install -D "$builddir"/include/config/kernel.release \
-		"$pkgdir"/usr/share/kernel/$_flavor/kernel.release
+	. kernel_package
 }
 
 sha512sums="
 21a1ccd77d3745c70361ed15828616308f43b2f4630b9e17c8191de78fef979e866e8cb12e9f5eaf3c91ad034b89a1796e850c69a56a2d6a967ae5df43a34255  linux-postmarketos-grate-v6.12.5-lts.tar.bz2
-6545b7c9fde2050e6437adad3f80f3ec920903a7cda904f15629562611d2202d2ed2152685828331f34282c898d31ca2818fd6427e5ccca1bf9431c033ac6ec2  config-postmarketos-grate.armv7
 "

device/community/linux-postmarketos-qcom-laptop/APKBUILD

@@ -2,22 +2,19 @@
 # Co-Maintainer: Casey Connolly <kcxt@postmarketos.org>
 pkgname=linux-postmarketos-qcom-laptop
 pkgver=6.15
-pkgrel=0
+pkgrel=1
 # Commit from branch @ https://github.com/jhovold/linux/tree/wip/x1e80100-$pkgver
 _commit="64941e2988752ce492e2dac6249535423189ee46"
 pkgdesc="Generic kernel for Qualcomm laptops"
 arch="aarch64"
 _carch="arm64"
-_flavor="postmarketos-qcom-laptop"
+_flavor="${pkgname#linux-}"
 url="https://kernel.org"
 license="GPL-2.0-only"
 options="!strip
 	!check
 	!tracedeps
 	pmb:cross-native
-	pmb:kconfigcheck-community
-	pmb:kconfigcheck-uefi
-	pmb:kconfigcheck-virt
 "
 makedepends="
 	bash
@@ -38,50 +35,29 @@ replaces="linux-lenovo-21bx"
 _repository="linux"
 source="
 	$pkgname-$_commit.tar.gz::https://github.com/jhovold/$_repository/archive/$_commit.tar.gz
-	misc.config
-	pmos.config
+	qcom-laptop.config
 "
 builddir="$srcdir/linux-$_commit"
 _outdir="out"
 _defconfig="johan_defconfig"
 
+_pmos_defconfig="johan_defconfig"
+_pmos_uefi="true"
+
 prepare() {
 	default_prepare
-	cp "$srcdir/pmos.config" "$builddir"/arch/"$_carch"/configs/
-	cp "$srcdir/misc.config" "$builddir"/arch/"$_carch"/configs/
-
-	# Generate .config
-	unset LDFLAGS
-	make ARCH="$_carch" CC="${CC:-gcc}" \
-		KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-$_flavor" \
-		"$_defconfig" pmos.config misc.config
+	. kernel_prepare
 }
 
 build() {
-	unset LDFLAGS
-	make ARCH="$_carch" CC="${CC:-gcc}" \
-		KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-$_flavor"
+	. kernel_build
 }
 
 package() {
-	install -Dm644 "$builddir/arch/$_carch/boot/vmlinuz.efi" \
-			"$pkgdir/boot/linux.efi"
-
-	make modules_install dtbs_install \
-		ARCH="$_carch" \
-		INSTALL_PATH="$pkgdir"/boot/ \
-		INSTALL_MOD_PATH="$pkgdir" \
-		INSTALL_MOD_STRIP=1 \
-		INSTALL_DTBS_PATH="$pkgdir"/boot/dtbs
-
-	rm -f "$pkgdir"/lib/modules/*/build "$pkgdir"/lib/modules/*/source
-
-	install -D "$builddir"/include/config/kernel.release \
-		"$pkgdir"/usr/share/kernel/$_flavor/kernel.release
+	. kernel_package
 }
 
 sha512sums="
 5eea324d83f243a50712f5317b2db55cd3e380eaa2e76d689dd5125bcbbd78601fbd1bf8622c95fa3e0ee43580bdbafce15c507aee65cb4ffac994f7c0b98948  linux-postmarketos-qcom-laptop-64941e2988752ce492e2dac6249535423189ee46.tar.gz
-bea4d6dcf60e90b8ce111c3b510e8f57db2d556b4b18aa257b267ea15ea4c90e4f81be656e59da0a525819d34354afdab3501234783c1542bbde9ee6670e17b8  misc.config
-89244418a7331fd89109591f2748bebdcc7c9a4a34980a551d0a42abf063cb47188758d5e22001caf10f8db893532544a3dbd1111764ddea9db6048bbde005f4  pmos.config
+bea4d6dcf60e90b8ce111c3b510e8f57db2d556b4b18aa257b267ea15ea4c90e4f81be656e59da0a525819d34354afdab3501234783c1542bbde9ee6670e17b8  qcom-laptop.config
 "

main/devicepkg-dev/APKBUILD

@@ -1,21 +1,32 @@
 pkgname=devicepkg-dev
-pkgver=0.18.1
-pkgrel=1
+pkgver=0.19.8
+pkgrel=0
 pkgdesc="Provides default device package functions"
 url="https://postmarketos.org"
 arch="noarch"
 license="MIT"
+makedepends="jinja2-cli"
+subpackages="$pkgname-jinja2:_jinja2"
 source="
 	compiler-gcc.h
+	config-fragments/mainline.config.j2
+	config-fragments/uefi.config.j2
 	devicepkg_build.sh
 	devicepkg_package.sh
 	devicepkg_pmtest_post_install.sh
 	downstreamkernel_prepare.sh
 	downstreamkernel_package.sh
 	devicepkg_subpackage_kernel.sh
+	kernel_build.sh
+	kernel_package.sh
+	kernel_prepare.sh
 	testdata/deviceinfo
 	testdata/expected-deviceinfo-downstream
 	testdata/expected-deviceinfo-mainline
+	testdata/expected-uefi-config-arm
+	testdata/expected-uefi-config-arm64
+	testdata/expected-uefi-config-arm64-pre-6.1.0
+	testdata/expected-uefi-config-x86_64
 "
 
 check() {
@@ -54,6 +65,68 @@ check() {
 		echo "ERROR: mainline deviceinfo contains incorrect data"
 	fi
 
+	_template="$srcdir/uefi.config.j2"
+
+	# Generate uefi config on 6.6.0 arm
+	# (no CONFIG_EFI_ZBOOT, no CONFIG_EFI_MIXED)
+	jinja2 --strict \
+		-D kernel_version="6" \
+		-D kernel_patchlevel="6" \
+		-D arch="arm" \
+		"$_template" > "$testdir/uefi-config-arm"
+
+	# Generate uefi config on 6.6.0 arm64
+	# (CONFIG_EFI_ZBOOT, no CONFIG_EFI_MIXED)
+	jinja2 --strict \
+		-D kernel_version="6" \
+		-D kernel_patchlevel="6" \
+		-D arch="arm64" \
+		"$_template" > "$testdir/uefi-config-arm64"
+
+	# Generate uefi config on 5.15.0 arm64
+	# (no CONFIG_EFI_ZBOOT, no CONFIG_EFI_MIXED)
+	jinja2 --strict \
+		-D kernel_version="5" \
+		-D kernel_patchlevel="15" \
+		-D arch="$_carch" \
+		"$_template" > "$testdir/uefi-config-arm64-pre-6.1.0"
+
+	# Generate uefi config on 6.6.0 x86_64
+	# (no CONFIG_EFI_ZBOOT, CONFIG_EFI_MIXED)
+	jinja2 --strict \
+		-D kernel_version="6" \
+		-D kernel_patchlevel="6" \
+		-D arch="x86_64" \
+		"$_template" > "$testdir/uefi-config-x86_64"
+
+	if ! cmp -s "$srcdir/expected-uefi-config-arm" \
+		"$testdir/uefi-config-arm"
+	then
+		echo "ERROR: unexpected result with uefi config on arm using 6.6.0 version"
+		exit 1
+	fi
+
+	if ! cmp -s "$srcdir/expected-uefi-config-arm64" \
+		"$testdir/uefi-config-arm64"
+	then
+		echo "ERROR: unexpected result with uefi config on arm64 using 6.6.0 version"
+		exit 1
+	fi
+
+	if ! cmp -s "$srcdir/expected-uefi-config-arm64-pre-6.1.0" \
+		"$testdir/uefi-config-arm64-pre-6.1.0"
+	then
+		echo "ERROR: unexpected result with uefi config on arm64 using 5.15.0 version"
+		exit 1
+	fi
+
+	if ! cmp -s "$srcdir/expected-uefi-config-x86_64" \
+		"$testdir/uefi-config-x86_64"
+	then
+		echo "ERROR: unexpected result with uefi config on x86_64 using 6.6.0 version"
+		exit 1
+	fi
+
 	# Cleanup
 	rm -r "$testdir"
 }
@@ -71,18 +144,46 @@ package() {
 		"$pkgdir/usr/bin/downstreamkernel_package"
 	install -Dm755 "$srcdir/devicepkg_subpackage_kernel.sh" \
 		"$pkgdir/usr/bin/devicepkg_subpackage_kernel"
+	install -Dm755 "$srcdir/kernel_build.sh" \
+		"$pkgdir/usr/bin/kernel_build"
+	install -Dm755 "$srcdir/kernel_package.sh" \
+		"$pkgdir/usr/bin/kernel_package"
+	install -Dm755 "$srcdir/kernel_prepare.sh" \
+		"$pkgdir/usr/bin/kernel_prepare"
 	install -Dm644 "$srcdir/compiler-gcc.h" \
 		"$pkgdir/usr/share/devicepkg-dev/compiler-gcc.h"
+	install -Dm644 "$srcdir/mainline.config.j2" \
+		"$pkgdir/usr/share/devicepkg-dev/config-fragments/mainline.config.j2"
+	install -Dm644 "$srcdir/uefi.config.j2" \
+		"$pkgdir/usr/share/devicepkg-dev/config-fragments/uefi.config.j2"
 }
+
+# Install jinja2-cli when building kernel for kconfig fragments,
+# rely on postmarketos-installkernel for it
+_jinja2() {
+	install_if="$pkgname=$pkgver-r$pkgrel postmarketos-installkernel"
+	depends="jinja2-cli"
+	mkdir "$subpkgdir"
+}
+
 sha512sums="
 d69930dd790b00fb39760a37d95a10899f0d167e10e2804feb05d9ce04f94185dc32d36edc90214aba2ea2aa09bf18f7dab93f1d2eff23f67beb2cc83be30e7c  compiler-gcc.h
+04373cc6776871e999b98636aa8147179f5eebe56c501dc7e482d53ddbabd8c92fef437a3826bd33d1bb286e0325ef4affeb6e9d06c1548d86b0eeea3d0752a9  mainline.config.j2
+04cdc0b2f88782497c709a3ad314aa7fb3c47097837a44d360af71785cef9774d4d7b075afba492a35a4557d9d7674c964f78aec90c7d01873074b95c541b6f6  uefi.config.j2
 a483a970f6cf3e1f2724d8ec1039c2a935cc3e75efd016b3f134cef8a6e53820428bff0f1cb2bcfbd8ccda33c69fdb250be1cf061b2dc53c6063d2ab49023f97  devicepkg_build.sh
 5b83255dabd2019ea07a589d185bee5dad6760e28ab02de3480a0adfd1cf20d0c2e0b4a978e56757899ef683819091cee99d168a48e24a3f604b725e1ba26849  devicepkg_package.sh
 93432976bb785c3ad23ba40ac80c11cb2fb0d83d73642ed39fa3f637a471d5d08641ccc42912d63139af49c521bb86bd02a613482bf8f5e95437aa000a125969  devicepkg_pmtest_post_install.sh
 f81e74e45ae8e55686ae459f550e229e7398daeafa72bd023c2d8c3a0d50e60bf53d5bbdfec931e9fbabe1cd71de57b2192805aaef091ab90bc7203cbaf66ba6  downstreamkernel_prepare.sh
 107242a3da38a574c46cb779e0c75afbeef4cfe659e1b85971973ac55843df06f70f53a5985ca623d4123f05f2984f5dace4a53a3509ecefd7dfdc3c8b705cfe  downstreamkernel_package.sh
 b9e64582d8c4ed35116002388b58ee62531b8db5de3f4629980ca5dcc9f39ba2c1c7c7a9caa03438e183afa42c8cc6680fe217304ef667b8bf213d93789226e9  devicepkg_subpackage_kernel.sh
+9fb15d78e11ff19dbb85f283ccc8bd59f4ecdbf0382053b5f251e7e4e573b7b329cd73c119008cd3f95f2b537a2b45d0753abe669c56f4378d847373f11a569b  kernel_build.sh
+6a0ade8f5b2f48271a2330aecf2ec55cdcb68531999970be65cb0d9637665bd46748115d634de7eaa73489d96db4ff78dabe93b3038879578a143bbed5d3e548  kernel_package.sh
+6afa87c03ccab6d167a2aa5f3e0ec0618bc0f5a9110c514c69635d3267f764f05dd28da2aae0b1bf56cc5c71fd027f0b652e3625dc41a3e26560f7429d7f9b42  kernel_prepare.sh
 f09cb34626f2aedf9ffa69a8050500d54291c416f5e8c8d67ce72244e1d906b190d84a3fadccd7d82824b6a68d981ca8a197a053804df1103457ddb7892b2cc9  deviceinfo
 136247a16ec91dc0c7241eeddb28c2196ae3b29946a9bc7e9566f848491ef1c53b12d05bf2dbc1cc352986712fd76f25c1510bcc8f301af540a2f01c33b299e1  expected-deviceinfo-downstream
 b2e87ab10c116adc18e89ebf478b08904b9a73b17176c03068f8711dac6353e6ab4b3fdaf4051eda05660cac31514520756973ec43d052ba9f42cb1ec9375c5d  expected-deviceinfo-mainline
+c75c157bd7fe05662be7fe24d00f8603ddc4a760f5589463ae4ea2a594430e700835ba2b6edd6b540be5c131fcfc8717556c17a1fdbc41583926787bb09709bd  expected-uefi-config-arm
+22406d611d716d32482ee3b46080d7b945ac3e0e4083bdddfa7a1eca4e9733332118a90739f4ded6e2eee01abe213c95408d9e10fbf087e19d46907bbc21bc7e  expected-uefi-config-arm64
+c75c157bd7fe05662be7fe24d00f8603ddc4a760f5589463ae4ea2a594430e700835ba2b6edd6b540be5c131fcfc8717556c17a1fdbc41583926787bb09709bd  expected-uefi-config-arm64-pre-6.1.0
+3d3ca6a614e7114a9e45c307be42245550030cc8d5d8c7a7e9130cb5da8c5a6b6a641fa9f33c41a4a9ec3dd9158b4a03b00ef2bbae233b255200d91400498e06  expected-uefi-config-x86_64
 "

main/devicepkg-dev/config-fragments/mainline.config.j2

@@ -0,0 +1,284 @@
+# Create a list of integers for kernel version, so we can compare it properly. 
+{% set kver = [kernel_version | int, kernel_patchlevel | int] %}
+
+# general
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_CGROUPS=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_DEVTMPFS=y
+CONFIG_DM_CRYPT=m
+CONFIG_INPUT_EVDEV=y
+CONFIG_SYSVIPC=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_VT=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_CGROUP_BPF=y
+CONFIG_USB_CONFIGFS_NCM=y
+
+{% if kver >= [2, 6] %}
+CONFIG_BINFMT_ELF=y
+{% endif %}
+
+{% if kver >= [3, 10] %}
+CONFIG_BINFMT_SCRIPT=y
+{% endif %}
+
+{% if kver >= [4, 0] %}
+CONFIG_UEVENT_HELPER=y
+CONFIG_USER_NS=y
+{% endif %}
+
+{% if kver < [4, 7] %}
+CONFIG_DEVPTS_MULTIPLE_INSTANCES=y
+{% endif %}
+
+{% if kver < [4, 14] %}
+CONFIG_SAMSUNG_TUI=n
+CONFIG_TZDEV=n
+{% endif %}
+
+{% if kver < [5, 2] and arch in ["arm", "i386"] %}
+CONFIG_LBDAF=n
+{% endif %}
+
+# filesystems
+CONFIG_BTRFS_FS=m
+CONFIG_EXFAT_FS=m
+CONFIG_EXT4_FS=m
+CONFIG_F2FS_FS=m
+
+# FDE
+CONFIG_MD=y
+CONFIG_CRYPTO_SHA256=y # TODO: make this module
+CONFIG_CRYPTO_AES=y # TODO: make this module
+
+# nftables
+{% if kver >= [3, 13] %}
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_INET=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_REJECT=m
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NF_REJECT_IPV4=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NF_REJECT_IPV6=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_NAT=m
+{% endif %}
+
+{% if kver >= [3, 13] and kver < [5, 17] %}
+CONFIG_NFT_COUNTER=m
+{% endif %}
+
+# wireguard
+{% if kver >= [5, 6] %}
+CONFIG_WIREGUARD=m
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_FIB_IPV4=m
+CONFIG_NFT_FIB_IPV6=m
+CONFIG_NF_CONNTRACK_MARK=y
+{% endif %}
+
+# waydroid
+CONFIG_ANDROID_BINDERFS=n
+CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
+CONFIG_ANDROID_BINDER_IPC=y
+CONFIG_ANDROID_BINDER_IPC_SELFTEST=n
+CONFIG_BLK_DEV_LOOP=m
+CONFIG_BPF_SYSCALL=y
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_CGROUP_BPF=y
+CONFIG_FUSE_FS=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_TMPFS_XATTR=y
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_VLAN_8021Q=m # prerequisite for bridge
+
+{% if kver >= [3, 5] %}
+CONFIG_CROSS_MEMORY_ATTACH=y
+{% endif %}
+
+{% if kver >= [4, 20] %}
+CONFIG_PSI=y
+CONFIG_PSI_DEFAULT_DISABLED=n
+{% endif %}
+
+{% if kver < [5, 18] %}
+CONFIG_ASHMEM=y
+{% endif %}
+
+# iwd
+CONFIG_ASYMMETRIC_KEY_TYPE=y
+CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
+CONFIG_CRYPTO_AES=y # TODO: make this module
+CONFIG_CRYPTO_CBC=y # TODO: make this module
+CONFIG_CRYPTO_CMAC=y # TODO: make this module
+CONFIG_CRYPTO_DES=y # TODO: make this module
+CONFIG_CRYPTO_ECB=y # TODO: make this module
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_MD5=y # TODO: make this module
+CONFIG_CRYPTO_SHA1=y # TODO: make this module
+CONFIG_CRYPTO_SHA256=y # TODO: make this module
+CONFIG_CRYPTO_SHA512=y # TODO: make this module
+CONFIG_CRYPTO_USER_API_HASH=m
+CONFIG_CRYPTO_USER_API_SKCIPHER=m
+CONFIG_KEYS=y
+CONFIG_KEY_DH_OPERATIONS=y
+CONFIG_PKCS7_MESSAGE_PARSER=y
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
+CONFIG_X509_CERTIFICATE_PARSER=y
+CONFIG_RFKILL=m
+
+# containers (lxc, Docker)
+CONFIG_NAMESPACES=y
+CONFIG_NET_NS=y
+CONFIG_PID_NS=y
+CONFIG_IPC_NS=y
+CONFIG_UTS_NS=y
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CPUSETS=y
+CONFIG_KEYS=y
+CONFIG_VETH=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_NETFILTER=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MARK=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m # needed for lxc
+CONFIG_IP_NF_NAT=m
+CONFIG_NF_NAT=m
+CONFIG_POSIX_MQUEUE=y
+CONFIG_BLK_DEV_DM=m # Storage Drivers
+CONFIG_DUMMY=m # Network Drivers
+CONFIG_USER_NS=y
+CONFIG_BLK_CGROUP=y # Optional section
+CONFIG_BLK_DEV_THROTTLING=y # Optional section
+CONFIG_CGROUP_PERF=y # Optional section
+CONFIG_NET_CLS_CGROUP=m # Optional section
+CONFIG_NET_SCHED=y # Optional section
+CONFIG_FAIR_GROUP_SCHED=y # Optional section
+CONFIG_RT_GROUP_SCHED=y # Optional section
+CONFIG_IP_NF_TARGET_REDIRECT=m # Optional section
+CONFIG_IP_VS=m # Optional section
+CONFIG_IP_VS_NFCT=y # Optional section
+CONFIG_IP_VS_PROTO_TCP=y # Optional section
+CONFIG_IP_VS_PROTO_UDP=y # Optional section
+CONFIG_IP_VS_RR=m # Optional section
+CONFIG_EXT4_FS=m
+CONFIG_EXT4_FS_POSIX_ACL=y # Optional section
+CONFIG_EXT4_FS_SECURITY=y # Optional section
+
+{% if kver >= [3, 2] %}
+CONFIG_CFS_BANDWIDTH=y # Optional section
+{% endif %}
+
+{% if kver >= [3, 3] %}
+CONFIG_CHECKPOINT_RESTORE=y # Needed for lxc
+{% endif %}
+
+{% if kver >= [3, 6] %}
+CONFIG_MEMCG=y
+CONFIG_DM_THIN_PROVISIONING=m # Storage Drivers
+CONFIG_SWAP=y
+{% endif %}
+
+{% if kver >= [3, 6] and arch in ["i386", "x86_64", "sparc64", "ia64"] %}
+CONFIG_HUGETLB_PAGE=y
+CONFIG_CGROUP_HUGETLB=y
+{% endif %}
+
+{% if kver >= [3, 6] and kver < [6, 1] %}
+CONFIG_MEMCG_SWAP=y
+{% endif %}
+
+{% if kver >= [3, 7] and kver < [5, 0] %}
+CONFIG_NF_NAT_IPV4=m # Needed for lxc
+CONFIG_NF_NAT_IPV6=m # Needed for lxc
+{% endif %}
+
+{% if kver >= [3, 7] %}
+CONFIG_VXLAN=m # Network Drivers
+CONFIG_IP6_NF_TARGET_MASQUERADE=m # Needed for lxc
+{% endif %}
+
+{% if kver >= [3, 9] %}
+CONFIG_BRIDGE_VLAN_FILTERING=y # This is already enabled
+CONFIG_MACVLAN=m # Network Drivers
+{% endif %}
+
+{% if kver >= [3, 14] %}
+CONFIG_CGROUP_NET_PRIO=y # Optional section
+{% endif %}
+
+{% if kver >= [3, 18] %}
+CONFIG_OVERLAY_FS=m # Storage Drivers
+{% endif %}
+
+{% if kver >= [3, 19] %}
+CONFIG_IPVLAN=m # Network Drivers
+CONFIG_SECCOMP=y # Optional section
+{% endif %}
+
+{% if kver >= [3, 14] %}
+CONFIG_CGROUP_PIDS=y # Optional section
+{% endif %}
+
+# zram
+{% if kver >= [3, 14] %}
+CONFIG_ZRAM=m
+CONFIG_ZSMALLOC=m
+CONFIG_ZSMALLOC_STAT=y
+CONFIG_ZRAM_MEMORY_TRACKING=y
+CONFIG_CRYPTO_LZ4=m
+CONFIG_LZ4_COMPRESS=m
+CONFIG_SWAP=y
+{% endif %}
+
+# usb gadgets
+# disable legacy gadgets
+CONFIG_USB_ETH=n
+CONFIG_USB_FUNCTIONFS=n
+CONFIG_USB_MASS_STORAGE=n
+CONFIG_USB_G_SERIAL=n
+# enable configfs gadgets
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+
+# other
+CONFIG_BLK_DEV_NBD=y # netboot
+CONFIG_INPUT_UINPUT=m # fbkeyboard, buffyboard
+CONFIG_LEDS_TRIGGER_TIMER=m # hfd-service
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m # change MTU, e.g. for Wireguard
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m # change MTU, e.g. for Wireguard

main/devicepkg-dev/config-fragments/uefi.config.j2

@@ -0,0 +1,22 @@
+# Create a list of integers for kernel version, so we can compare it properly. 
+{% set kver = [kernel_version | int, kernel_patchlevel | int] %}
+
+CONFIG_EFI_STUB=y
+CONFIG_EFI=y
+CONFIG_DMI=y
+CONFIG_EFI_ESRT=y
+CONFIG_PSTORE=y # dependency of CONFIG_EFI_VARS_PSTORE
+CONFIG_EFI_VARS_PSTORE=y
+CONFIG_EFI_PARAMS_FROM_FDT=y
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+CONFIG_EFI_GENERIC_STUB=y
+
+{% if kver >= [6, 1] and arch == "arm64" %}
+# For systemd-boot
+CONFIG_EFI_ZBOOT=y
+{% endif %}
+
+{% if arch == "x86_64" %}
+# For booting on x86_64 with 32-bit EFI
+CONFIG_EFI_MIXED=y
+{% endif %}

main/devicepkg-dev/kernel_build.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+unset LDFLAGS
+# shellcheck disable=SC2154
+# _carch and pkgrel are defined in APKBUILD
+make ARCH="$_carch" CC="${CC:-gcc}" \
+	KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-postmarketOS"

main/devicepkg-dev/kernel_package.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+# shellcheck disable=SC2154
+# pkgdir is defined in APKBUILD
+mkdir -p "$pkgdir"/boot
+
+case "$_carch" in
+	arm|arm64) _make_install="zinstall modules_install dtbs_install";;
+	riscv64) _make_install="install modules_install dtbs_install";;
+	*) _make_install="install";;
+esac
+
+# shellcheck disable=SC2086,SC2154
+# pkgdir is defined in APKBUILD
+make $_make_install \
+	ARCH="$_carch" \
+	INSTALL_PATH="$pkgdir"/boot \
+	INSTALL_MOD_PATH="$pkgdir" \
+	INSTALL_MOD_STRIP=1 \
+	INSTALL_DTBS_PATH="$pkgdir"/boot/dtbs
+rm -f "$pkgdir"/lib/modules/*/build "$pkgdir"/lib/modules/*/source
+
+# shellcheck disable=SC2154
+# builddir, pkgdir, _flavor are defined in APKBUILD
+install -D "$builddir"/include/config/kernel.release \
+	"$pkgdir"/usr/share/kernel/"$_flavor"/kernel.release

main/devicepkg-dev/kernel_prepare.sh

@@ -0,0 +1,206 @@
+#!/bin/bash
+
+kernel_configs=""
+
+# $1: file path
+apply_jinja_template() {
+	filepath="$1"
+	filename="$(basename "$filepath")"
+	# builddir is defined in APKBUILD
+	# shellcheck disable=SC2154
+	makefile="$builddir"/Makefile
+	kernel_version="$(grep "^VERSION" "$makefile" | sed -e "s/VERSION = //")"
+	kernel_patchlevel="$(grep "^PATCHLEVEL" "$makefile" | sed -e "s/PATCHLEVEL = //")"
+	# shellcheck disable=SC2154
+	jinja2 --strict \
+		-D kernel_version="$kernel_version" \
+		-D kernel_patchlevel="$kernel_patchlevel" \
+		-D arch="$_carch" \
+		"$filepath" > "$builddir"/kernel/configs/"${filename%.j2}"
+}
+
+validate_all_configs() {
+    local _config_file="$builddir"/.config
+
+    set -x
+    # Collect all requirements from all fragments
+    local all_requirements=""
+    for fragment in ${kernel_configs//.j2/}; do
+        fragment_file="$builddir/kernel/configs/$fragment"
+        if [ -f "$fragment_file" ]; then
+            all_requirements="$all_requirements $(cat "$fragment_file")"
+        fi
+    done
+
+    # Process =y and =m requirements with dependency analysis
+    while IFS= read -r line; do
+        option="${line%=*}"
+        value="${line#*=}"
+
+        if ! grep -q "^$line$" "$_config_file"; then
+            echo "ERROR: $line not set in final config!"
+            EXIT_CODE=1
+
+            # Do dependency analysis for missing options
+            if [ "$value" = "y" ] || [ "$value" = "m" ]; then
+                # Check if this option exists but with different value
+                actual_value=$(grep "^${option}=" "$_config_file" | cut -d= -f2)
+                if [ -n "$actual_value" ]; then
+                    echo "  Note: $option is =$actual_value instead of =$value"
+
+                    # Check for =y depending on =m issue
+                    if [ "$value" = "y" ] && [ "$actual_value" = "m" ]; then
+                        echo "  Hint: Built-in options can't depend on modules"
+                    fi
+                else
+                    # Option is completely missing - check dependencies
+                    analyze_missing_option "$option" "$value" "$all_requirements"
+                fi
+            fi
+        fi
+    done < <(echo "$all_requirements" | grep -E "^CONFIG_[A-Z0-9_]+=[ym]" | cut -d'#' -f1 | tr -d ' ' | sort -u)
+
+    # Process =n requirements
+    while IFS= read -r line; do
+        option="${line%=n}"
+        if ! grep -q "# $option is not set" "$_config_file"; then
+            echo "ERROR: $option must NOT be set!"
+            EXIT_CODE=1
+        fi
+    done < <(echo "$all_requirements" | grep -E "^CONFIG_[A-Z0-9_]+=n" | cut -d'#' -f1 | tr -d ' ')
+
+    # Process string requirements
+    while IFS= read -r line; do
+        if ! grep -q "^$line$" "$_config_file"; then
+            echo "ERROR: $line not found in final config!"
+            EXIT_CODE=1
+        fi
+    done < <(echo "$all_requirements" | grep -E "^CONFIG_[A-Z0-9_]+=\".*\"" | cut -d'#' -f1 | tr -d ' ')
+
+    return $EXIT_CODE
+}
+
+# Helper function to analyze why an option is missing
+analyze_missing_option() {
+    local option="$1"
+    local wanted_value="$2"
+    local all_requirements="$3"
+    local config_name="${option#CONFIG_}"
+
+    # Find Kconfig file for this option
+    local kconfig
+    kconfig=$(find . -name 'Kconfig*' -type f -exec grep -l "^config $config_name$" {} \; 2>/dev/null | head -n1)
+
+    if [ -z "$kconfig" ]; then
+        echo "  WARNING: Could not find Kconfig definition for $option"
+        return
+    fi
+
+    # Extract dependencies from Kconfig
+    local deps
+    deps=$(awk -v opt="$config_name" '
+    /^config / { 
+        if (in_block) exit
+        in_block = ($2 == opt)
+    }
+    in_block && /depends on/ {
+        sub(/.*depends on[[:space:]]+/, "")
+        print
+    }
+    ' "$kconfig" | grep -oE '[A-Z][A-Z0-9_]+' | sed 's/^/CONFIG_/' | sort -u)
+
+    if [ -n "$deps" ]; then
+        echo "  Missing dependencies:"
+        for dep in $deps; do
+            if ! echo "$all_requirements" | grep -q "^$dep="; then
+                echo "    - $dep (not in any fragment)"
+            elif [ "$wanted_value" = "y" ]; then
+                dep_value=$(echo "$all_requirements" | grep "^$dep=" | cut -d= -f2 | head -n1)
+                if [ "$dep_value" = "m" ]; then
+                    echo "    - $dep is =m but needs to be =y (for built-in $option)"
+                fi
+            fi
+        done
+    fi
+}
+
+# if full config is supplied instead of defconfig, copy it.
+copy_full_config() {
+	# shellcheck disable=SC2154
+	# _config and srcdir are defined in APKBUILD
+	if [ -n "$_config" ]; then
+		cp "$srcdir/$_config" .config
+	fi
+}
+
+# if we need only to copy a full config (.e.g. if we want to edit
+# it), then we can pass ONLY_COPY=1 to env and the code will end up
+# here. This is needed for "pmbootstrap kconfig edit" command when
+# using full configs
+if [ "$ONLY_COPY" = "1" ]; then
+	copy_full_config
+	return
+fi
+
+# srcdir is defined in APKBUILD
+# shellcheck disable=SC2154
+fragments_from_package="$(find "$srcdir" -maxdepth 1 -name "*.config" -o -name "*.config.j2")"
+
+if [ -n "$fragments_from_package" ]; then
+	for config in $fragments_from_package;
+	do
+		kernel_configs="$kernel_configs $(basename "$config")"
+	done
+fi
+
+# mainline is default config fragment
+kernel_configs="$kernel_configs mainline.config.j2"
+
+# shellcheck disable=SC2154
+# _pmos_uefi is defined in APKBUILD
+if [ "$_pmos_uefi" = "true" ]; then
+	kernel_configs="$kernel_configs uefi.config.j2"
+fi
+
+# copy fragments
+# shellcheck disable=SC2154
+# builddir is defined in APKBUILD
+for config in $kernel_configs; do
+	_paths="/usr/share/devicepkg-dev/config-fragments/$config $srcdir/$config"
+	for file in $_paths; do
+		if [ -f "$file" ]; then
+			if [[ "$file" == *.config ]]; then
+				cp "$file" "$builddir"/kernel/configs
+			elif [[ "$file" == *.config.j2 ]]; then
+				apply_jinja_template "$file"
+			fi
+		fi
+	done
+done
+
+# copy full config when using it instead of defconfig
+# empty _pmos_defconfig won't be a problem
+copy_full_config
+
+# apply all the configs, _pmos_defconfig is defined in device package
+# shellcheck disable=SC2086,SC2154
+# _carch and _pmos_defconfig are defined in APKBUILD
+make ARCH="$_carch" $_pmos_defconfig ${kernel_configs//.j2/}
+
+# validate all configs. this will go through all of them, and will
+# print all errors. However, it will end the script only after going
+# through all configs, because we want to see all problems that
+# happen during applying the configs
+#
+# EXIT_CODE will be set to 1 in validate_config function if there is
+# at least one misconfiguration, so we will be able to end up with an
+# error on condition of this variable.
+EXIT_CODE=0
+for config in ${kernel_configs//.j2/};
+do
+	validate_all_configs
+done
+
+if [ "$EXIT_CODE" -ne 0 ]; then
+	exit "$EXIT_CODE"
+fi

main/devicepkg-dev/testdata/expected-uefi-config-arm

@@ -0,0 +1,16 @@
+# Create a list of integers for kernel version, so we can compare it properly. 
+
+
+CONFIG_EFI_STUB=y
+CONFIG_EFI=y
+CONFIG_DMI=y
+CONFIG_EFI_ESRT=y
+CONFIG_PSTORE=y # dependency of CONFIG_EFI_VARS_PSTORE
+CONFIG_EFI_VARS_PSTORE=y
+CONFIG_EFI_PARAMS_FROM_FDT=y
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+CONFIG_EFI_GENERIC_STUB=y
+
+
+
+

main/devicepkg-dev/testdata/expected-uefi-config-arm64

@@ -0,0 +1,19 @@
+# Create a list of integers for kernel version, so we can compare it properly. 
+
+
+CONFIG_EFI_STUB=y
+CONFIG_EFI=y
+CONFIG_DMI=y
+CONFIG_EFI_ESRT=y
+CONFIG_PSTORE=y # dependency of CONFIG_EFI_VARS_PSTORE
+CONFIG_EFI_VARS_PSTORE=y
+CONFIG_EFI_PARAMS_FROM_FDT=y
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+CONFIG_EFI_GENERIC_STUB=y
+
+
+# For systemd-boot
+CONFIG_EFI_ZBOOT=y
+
+
+

main/devicepkg-dev/testdata/expected-uefi-config-arm64-pre-6.1.0

@@ -0,0 +1,16 @@
+# Create a list of integers for kernel version, so we can compare it properly. 
+
+
+CONFIG_EFI_STUB=y
+CONFIG_EFI=y
+CONFIG_DMI=y
+CONFIG_EFI_ESRT=y
+CONFIG_PSTORE=y # dependency of CONFIG_EFI_VARS_PSTORE
+CONFIG_EFI_VARS_PSTORE=y
+CONFIG_EFI_PARAMS_FROM_FDT=y
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+CONFIG_EFI_GENERIC_STUB=y
+
+
+
+

main/devicepkg-dev/testdata/expected-uefi-config-x86_64

@@ -0,0 +1,19 @@
+# Create a list of integers for kernel version, so we can compare it properly. 
+
+
+CONFIG_EFI_STUB=y
+CONFIG_EFI=y
+CONFIG_DMI=y
+CONFIG_EFI_ESRT=y
+CONFIG_PSTORE=y # dependency of CONFIG_EFI_VARS_PSTORE
+CONFIG_EFI_VARS_PSTORE=y
+CONFIG_EFI_PARAMS_FROM_FDT=y
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+CONFIG_EFI_GENERIC_STUB=y
+
+
+
+
+# For booting on x86_64 with 32-bit EFI
+CONFIG_EFI_MIXED=y
+