From c4623cbce4b12906aad08322a16c89fff49913f6 Mon Sep 17 00:00:00 2001
From: Adam Lesinski <adam@runloop.ai>
Date: Fri, 9 Oct 2026 12:24:17 -0700
Subject: [PATCH] kernel: trim unused storage, passthrough and filesystems

---
 .github/workflows/build-kernel.yaml           | 12 ++++++++-
 .../kernel/configs/fragments/common/9p.conf   | 22 ++++------------
 .../kernel/configs/fragments/common/fs.conf   | 22 ++++++++--------
 .../kernel/configs/fragments/common/tcmu.conf | 13 ++++------
 .../kernel/configs/fragments/common/vfio.conf |  9 +++----
 .../configs/fragments/common/virtio.conf      | 11 ++++----
 .../kernel/configs/fragments/x86_64/vfio.conf |  8 +++---
 packaging/kernel/verify-storage-config.sh     | 25 +++++++++++++++++++
 8 files changed, 70 insertions(+), 52 deletions(-)
 create mode 100644 packaging/kernel/verify-storage-config.sh

diff --git a/.github/workflows/build-kernel.yaml b/.github/workflows/build-kernel.yaml
index eb86bef..9e556ca 100644
--- a/.github/workflows/build-kernel.yaml
+++ b/.github/workflows/build-kernel.yaml
@@ -85,6 +85,12 @@ jobs:
         working-directory: packaging/kernel
         run: ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} ${{ matrix.build_type_arg }} -f -s setup
 
+      - name: Verify storage configuration
+        working-directory: packaging/kernel
+        run: |
+          kernel_dir=$(find . -maxdepth 1 -type d -name 'kata-linux-*' | head -n1)
+          bash verify-storage-config.sh "${kernel_dir}/.config"
+
       - name: Build kernel
         working-directory: packaging/kernel
         run: ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} ${{ matrix.build_type_arg }} build
@@ -131,12 +137,14 @@ jobs:
           ls -lh ${{ github.workspace }}/${TARBALL_NAME}
 
       - name: Configure AWS credentials
+        if: github.ref == 'refs/heads/main'
         uses: runloopai/configure-aws-credentials@main
         with:
           role-to-assume: arn:aws:iam::992382648534:role/Github-OIDC-Deploy-Role
           aws-region: us-east-2
 
       - name: Upload to S3
+        if: github.ref == 'refs/heads/main'
         run: |
           S3_PATH="s3://runloop-apt-prod-us-east-2/microvm-kernel/${{ steps.tarball.outputs.tarball_name }}"
           echo "Uploading to: ${S3_PATH}"
@@ -151,6 +159,7 @@ jobs:
           retention-days: 7
 
       - name: Tag source for this artifact
+        if: github.ref == 'refs/heads/main'
         # Push a git tag named after the tarball (sans extension) so every
         # shipped kernel binary maps to the exact source commit that built it.
         # Idempotent: re-runs of a commit skip the push if the tag exists.
@@ -170,7 +179,7 @@ jobs:
     name: Upload Summary
     runs-on: ubuntu-slim
     needs: build-kernel
-    if: always() && needs.build-kernel.result == 'success'
+    if: always() && needs.build-kernel.result == 'success' && github.ref == 'refs/heads/main'
     steps:
       - name: Checkout
         uses: runloopai/checkout@main
@@ -185,6 +194,7 @@ jobs:
           echo "version_string=${VERSION_STRING}" >> $GITHUB_OUTPUT
 
       - name: Configure AWS credentials
+        if: github.ref == 'refs/heads/main'
         uses: runloopai/configure-aws-credentials@main
         with:
           role-to-assume: arn:aws:iam::992382648534:role/Github-OIDC-Deploy-Role
diff --git a/packaging/kernel/configs/fragments/common/9p.conf b/packaging/kernel/configs/fragments/common/9p.conf
index 6995479..15005d7 100644
--- a/packaging/kernel/configs/fragments/common/9p.conf
+++ b/packaging/kernel/configs/fragments/common/9p.conf
@@ -1,17 +1,5 @@
-# Enable 9p(fs) support - required for Kata to mount filesystems into the workload
-
-CONFIG_NET_9P=y
-CONFIG_NET_9P_VIRTIO=y
-CONFIG_9P_FS=y
-# NOTE - 9p client cacheing turned off?
-# FIXME: check if that is right?
-# https://github.com/kata-containers/packaging/issues/483
-#CONFIG_9P_FSCACHE=y
-CONFIG_NETWORK_FILESYSTEMS=y
-# Q. Do we use the POSIX_ACL over 9p?
-# FIXME: https://github.com/kata-containers/packaging/issues/483
-CONFIG_9P_FS_POSIX_ACL=y
-# NOTE - this adds security labels, such as used by SELinux - we may be able to
-# disable this, for now.
-# FIXME: https://github.com/kata-containers/packaging/issues/483
-CONFIG_9P_FS_SECURITY=y
+# No host filesystem sharing or network filesystem clients.
+CONFIG_NET_9P=n
+CONFIG_NET_9P_VIRTIO=n
+CONFIG_9P_FS=n
+CONFIG_NETWORK_FILESYSTEMS=n
diff --git a/packaging/kernel/configs/fragments/common/fs.conf b/packaging/kernel/configs/fragments/common/fs.conf
index b4bcf27..5ed4554 100644
--- a/packaging/kernel/configs/fragments/common/fs.conf
+++ b/packaging/kernel/configs/fragments/common/fs.conf
@@ -1,14 +1,14 @@
-# Enable a whole bunch of filesystem related items
+# Filesystems for ext4 guest disks and Docker overlay mounts.
 
 CONFIG_BLK_DEV_INITRD=y
 
 # Recommended for Docker
 CONFIG_BLK_DEV_THROTTLING=y
 
-# Required for hotplug block devices into Kata, using SCSI
+# Keep loop mounts for guest applications; SCSI disks are not used.
 CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_BSG=y
-CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_BSG=n
+CONFIG_BLK_DEV_SD=n
 # Required in v6.8+ to use mounted loop devices
 CONFIG_BLK_DEV_WRITE_MOUNTED=y
 
@@ -23,7 +23,7 @@ CONFIG_EXT4_FS_SECURITY=y
 # https://github.com/kata-containers/packaging/issues/483
 CONFIG_JBD2=y
 CONFIG_FS_MBCACHE=y
-CONFIG_XFS_FS=y
+CONFIG_XFS_FS=n
 CONFIG_FS_POSIX_ACL=y
 CONFIG_EXPORTFS=y
 CONFIG_EXPORTFS_BLOCK_OPS=y
@@ -39,10 +39,10 @@ CONFIG_TMPFS_XATTR=y
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_MISC_FILESYSTEMS=y
-CONFIG_EROFS_FS=y
-CONFIG_EROFS_FS_XATTR=y
-CONFIG_EROFS_FS_ZIP=y
-CONFIG_EROFS_FS_SECURITY=y
+CONFIG_EROFS_FS=n
+CONFIG_EROFS_FS_XATTR=n
+CONFIG_EROFS_FS_ZIP=n
+CONFIG_EROFS_FS_SECURITY=n
 CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EPOLL=y
@@ -58,6 +58,6 @@ CONFIG_OVERLAY_FS_REDIRECT_DIR=y
 CONFIG_OVERLAY_FS_METACOPY=y
 CONFIG_OVERLAY_FS_XINO_AUTO=y
 
-# virtio-fs driver support:
-CONFIG_VIRTIO_FS=y
+# Keep FUSE for guest applications, without virtio-fs host sharing.
+CONFIG_VIRTIO_FS=n
 CONFIG_FUSE_FS=y
diff --git a/packaging/kernel/configs/fragments/common/tcmu.conf b/packaging/kernel/configs/fragments/common/tcmu.conf
index 4103cee..1e72d1c 100644
--- a/packaging/kernel/configs/fragments/common/tcmu.conf
+++ b/packaging/kernel/configs/fragments/common/tcmu.conf
@@ -1,8 +1,5 @@
-# LIO SCSI target subsystem and TCMU userspace backstore.
-# Required for overlaybd-tcmu to run inside the cloud-hypervisor guest VM.
-CONFIG_TARGET_CORE=y
-# UIO (Userspace I/O) is a dependency of TCM_USER2; without it, make olddefconfig
-# silently downgrades TCM_USER2 from =y to =n.
-CONFIG_UIO=y
-CONFIG_TCM_USER2=y
-CONFIG_LOOPBACK_TARGET=y
+# No SCSI target backends (including overlaybd-tcmu) in the guest.
+CONFIG_TARGET_CORE=n
+CONFIG_UIO=n
+CONFIG_TCM_USER2=n
+CONFIG_LOOPBACK_TARGET=n
diff --git a/packaging/kernel/configs/fragments/common/vfio.conf b/packaging/kernel/configs/fragments/common/vfio.conf
index 32da819..cc20abc 100644
--- a/packaging/kernel/configs/fragments/common/vfio.conf
+++ b/packaging/kernel/configs/fragments/common/vfio.conf
@@ -1,5 +1,4 @@
-# Options we need in order to handle vfio_mode=vfio devices
-
-CONFIG_IOMMU_SUPPORT=y
-CONFIG_VFIO=y
-CONFIG_VFIO_PCI=y
+# No device passthrough or guest IOMMU. Keep PCI for virtio devices.
+CONFIG_IOMMU_SUPPORT=n
+CONFIG_VFIO=n
+CONFIG_VFIO_PCI=n
diff --git a/packaging/kernel/configs/fragments/common/virtio.conf b/packaging/kernel/configs/fragments/common/virtio.conf
index 8211b62..7c8a6a5 100644
--- a/packaging/kernel/configs/fragments/common/virtio.conf
+++ b/packaging/kernel/configs/fragments/common/virtio.conf
@@ -1,4 +1,4 @@
-# We need virtio for 9p and serial and vsock at least
+# Virtio devices provide disks, networking, consoles and vsock.
 
 # To get VIRTIO, we need a bus - ours of choice is PCI. We need to enable
 # PCI support to get VIRTIO_PCI support
@@ -10,11 +10,10 @@ CONFIG_VIRTIO_PCI=y
 # Without this nested-VM Kata does not work (we have not worked out exactly why)
 CONFIG_VIRTIO_PCI_LEGACY=y
 
-# FIXME - are we moving away from/choosing between SCSI and BLK support?
-# https://github.com/kata-containers/packaging/issues/483
-CONFIG_SCSI=y
-CONFIG_SCSI_LOWLEVEL=y
-CONFIG_SCSI_VIRTIO=y
+# Disks are exposed as virtio-blk over PCI, without a SCSI layer.
+CONFIG_SCSI=n
+CONFIG_SCSI_LOWLEVEL=n
+CONFIG_SCSI_VIRTIO=n
 CONFIG_VIRTIO_BLK=y
 CONFIG_TTY=y
 CONFIG_VIRTIO_CONSOLE=y
diff --git a/packaging/kernel/configs/fragments/x86_64/vfio.conf b/packaging/kernel/configs/fragments/x86_64/vfio.conf
index e052e10..714deb8 100644
--- a/packaging/kernel/configs/fragments/x86_64/vfio.conf
+++ b/packaging/kernel/configs/fragments/x86_64/vfio.conf
@@ -1,4 +1,4 @@
-# x86 specific items we need in order to handle vfio_mode=vfio devices
-CONFIG_INTEL_IOMMU=y
-CONFIG_IRQ_REMAP=y
-CONFIG_VIRTIO_IOMMU=y
+# No guest IOMMU or device passthrough.
+CONFIG_INTEL_IOMMU=n
+CONFIG_IRQ_REMAP=n
+CONFIG_VIRTIO_IOMMU=n
diff --git a/packaging/kernel/verify-storage-config.sh b/packaging/kernel/verify-storage-config.sh
new file mode 100644
index 0000000..ff91d11
--- /dev/null
+++ b/packaging/kernel/verify-storage-config.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Validate the resolved config, including symbols selected by other options.
+set -euo pipefail
+config=${1:?Usage: verify-storage-config.sh path/to/.config}
+[[ -f "$config" ]] || { echo "Missing kernel config: $config" >&2; exit 1; }
+
+for symbol in PCI PCI_MSI VIRTIO_PCI VIRTIO_BLK EXT4_FS OVERLAY_FS FUSE_FS TMPFS DEVTMPFS \
+    LIBNVDIMM BLK_DEV_PMEM VIRTIO_PMEM DAX FS_DAX; do
+    if ! grep -qx "CONFIG_${symbol}=y" "$config"; then
+        echo "Required built-in option missing: CONFIG_${symbol}=y" >&2
+        exit 1
+    fi
+done
+
+for symbol in SCSI SCSI_VIRTIO BLK_DEV_SD BLK_DEV_BSG TARGET_CORE TCM_USER2 \
+    LOOPBACK_TARGET UIO VFIO VFIO_PCI IOMMU_SUPPORT INTEL_IOMMU VIRTIO_IOMMU \
+    XFS_FS EROFS_FS VIRTIO_FS NET_9P 9P_FS \
+    NETWORK_FILESYSTEMS; do
+    if grep -Eq "^CONFIG_${symbol}=[ym]$" "$config"; then
+        echo "Unexpected storage/passthrough option: CONFIG_${symbol}" >&2
+        exit 1
+    fi
+done
+
+echo "Storage configuration verified: virtio-blk/PCI, PMEM/DAX, ext4, overlayfs and FUSE"