feat(kernel): refresh the config seed, build with thin-LTO

The seed was a release behind, so it now matches the tree it is migrated onto. The scheduler, block-layer and TCP additions the tree ships are pinned in the fragment, where the build checks them, rather than left to the seed's defaults. Transparent huge pages move to always, since games map big heaps without asking for them. Clang builds the kernel now: whether thin-LTO is offered at all is decided when Kconfig runs, so LLVM=1 applies to the config steps as well as the compile, and missing tools fail before anything starts. Allocation and call path hardening (init-on-alloc, freelist hardening, stack protector) and debug info are pinned off alongside the speculation mitigations, and the slab pin the minimal seed needs is restored. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-03 14:12:39 +02:00 · 2026-10-01 17:30:32 +03:00
parent a493157d41
commit ca7115dba8
4 changed files with 131 additions and 46 deletions
@@ -114,6 +114,11 @@ and this guest has `CONFIG_MODULES` off and no `/lib/modules` at all.
 - **`vmlinux`, not `bzImage`.** The guest is loaded as a raw ELF with no
  bootloader in the path. It is ~16 MB unstripped, which costs nothing at run
  time: only the loadable segments are mapped.
+- **Built with clang, thin-LTO.** `kernel-build.sh` passes `LLVM=1` to every
+  step, config included, because `HAS_LTO_CLANG` is decided when Kconfig runs
+  and gcc would make `olddefconfig` drop `LTO_CLANG_THIN` silently. `clang`,
+  `ld.lld` and the `llvm-*` binutils must be on `PATH`; the build says which is
+  missing before it starts.
 - **`-march=x86-64-v3`** goes in through `KCFLAGS`. It is safe in a kernel:
  the kernel's own `-mno-sse -mno-avx …` masks every vector extension off
  whatever the flag order, leaving v3's integer ISA.
@@ -1,20 +1,21 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 7.1.5 Kernel Configuration
+# Linux/x86 7.2.6 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.2.1 20260810"
-CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=160201
-CONFIG_CLANG_VERSION=0
-CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=24700
-CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=24700
-CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=109701
+CONFIG_CC_VERSION_TEXT="clang version 22.1.8"
+CONFIG_GCC_VERSION=0
+CONFIG_CC_IS_CLANG=y
+CONFIG_CLANG_VERSION=220108
+CONFIG_AS_IS_LLVM=y
+CONFIG_AS_VERSION=220108
+CONFIG_LD_VERSION=0
+CONFIG_LD_IS_LLD=y
+CONFIG_LLD_VERSION=220108
+CONFIG_RUSTC_VERSION=109801
 CONFIG_RUST_IS_AVAILABLE=y
-CONFIG_RUSTC_LLVM_VERSION=220106
+CONFIG_RUSTC_LLVM_VERSION=220108
 CONFIG_RUSTC_LLVM_MAJOR_VERSION=22
+CONFIG_RUSTC_CLANG_LLVM_COMPATIBLE=y
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
 CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
@@ -24,13 +25,15 @@ CONFIG_CC_HAS_ASSUME=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_CC_HAS_COUNTED_BY=y
 CONFIG_CC_HAS_COUNTED_BY_PTR=y
+CONFIG_CC_HAS_ALLOC_TOKEN=y
 CONFIG_CC_HAS_MULTIDIMENSIONAL_NONSTRING=y
 CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY=y
 CONFIG_RUSTC_HAS_SPAN_FILE=y
 CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES=y
 CONFIG_RUSTC_HAS_FILE_WITH_NUL=y
 CONFIG_RUSTC_HAS_FILE_AS_C_STR=y
-CONFIG_PAHOLE_VERSION=131
+CONFIG_RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS=y
+CONFIG_PAHOLE_VERSION=132
 CONFIG_IRQ_WORK=y
 CONFIG_BUILDTIME_TABLE_SORT=y
 CONFIG_THREAD_INFO_IN_TASK=y
@@ -38,6 +41,7 @@ CONFIG_THREAD_INFO_IN_TASK=y
 #
 # General setup
 #
+CONFIG_CACHY=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 # CONFIG_COMPILE_TEST is not set
 # CONFIG_WERROR is not set
@@ -91,7 +95,6 @@ CONFIG_SPARSE_IRQ=y
 CONFIG_CLOCKSOURCE_WATCHDOG=y
 CONFIG_ARCH_CLOCKSOURCE_INIT=y
 CONFIG_ARCH_WANTS_CLOCKSOURCE_READ_INLINE=y
-CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST_IDLE=y
@@ -186,13 +189,12 @@ CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
 CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y
 CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y
 CONFIG_CC_HAS_INT128=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough"
 CONFIG_CC_MS_EXTENSIONS="-fms-extensions"
 CONFIG_GCC10_NO_ARRAY_BOUNDS=y
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_NO_STRINGOP_OVERFLOW=y
-CONFIG_CC_NO_STRINGOP_OVERFLOW=y
 CONFIG_ARCH_SUPPORTS_INT128=y
+CONFIG_SCHED_CACHE=y
 CONFIG_SLAB_OBJ_EXT=y
 CONFIG_CGROUPS=y
 CONFIG_PAGE_COUNTER=y
@@ -229,11 +231,13 @@ CONFIG_PID_NS=y
 CONFIG_NET_NS=y
 # CONFIG_CHECKPOINT_RESTORE is not set
 CONFIG_SCHED_AUTOGROUP=y
+CONFIG_SCHED_POC_SELECTOR=y
 # CONFIG_RELAY is not set
 # CONFIG_BLK_DEV_INITRD is not set
 # CONFIG_BOOT_CONFIG is not set
 CONFIG_CMDLINE_LOG_WRAP_IDEAL_LEN=1021
 # CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
+# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3 is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_LD_ORPHAN_WARN=y
 CONFIG_LD_ORPHAN_WARN_LEVEL="warn"
@@ -255,6 +259,7 @@ CONFIG_PRINTK=y
 CONFIG_FUTEX=y
 CONFIG_FUTEX_PI=y
 CONFIG_FUTEX_PRIVATE_HASH=y
+CONFIG_HAVE_FUTEX_ROBUST_UNLOCK=y
 CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
@@ -347,6 +352,9 @@ CONFIG_PARAVIRT_CLOCK=y
 # CONFIG_BHYVE_GUEST is not set
 CONFIG_CC_HAS_MARCH_NATIVE=y
 # CONFIG_X86_NATIVE_CPU is not set
+CONFIG_GENERIC_CPU=y
+# CONFIG_MZEN4 is not set
+CONFIG_X86_64_VERSION=1
 CONFIG_X86_INTERNODE_CACHE_SHIFT=6
 CONFIG_X86_L1_CACHE_SHIFT=6
 CONFIG_X86_TSC=y
@@ -420,6 +428,9 @@ CONFIG_X86_INTEL_TSX_MODE_AUTO=y
 # CONFIG_HZ_100 is not set
 # CONFIG_HZ_250 is not set
 # CONFIG_HZ_300 is not set
+# CONFIG_HZ_500 is not set
+# CONFIG_HZ_600 is not set
+# CONFIG_HZ_750 is not set
 CONFIG_HZ_1000=y
 CONFIG_HZ=1000
 CONFIG_SCHED_HRTICK=y
@@ -450,12 +461,11 @@ CONFIG_HAVE_KLP_BUILD=y
 # CONFIG_X86_BUS_LOCK_DETECT is not set
 # end of Processor type and features

-CONFIG_CC_HAS_NAMED_AS=y
 CONFIG_CC_HAS_NAMED_AS_FIXED_SANITIZERS=y
-CONFIG_USE_X86_SEG_SUPPORT=y
 CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_CC_HAS_ENTRY_PADDING=y
+CONFIG_CC_HAS_KCFI_ARITY=y
 CONFIG_FUNCTION_PADDING_CFI=11
 CONFIG_FUNCTION_PADDING_BYTES=16
 # CONFIG_CPU_MITIGATIONS is not set
@@ -585,7 +595,6 @@ CONFIG_AMD_NODE=y
 #
 CONFIG_IA32_EMULATION=y
 # CONFIG_IA32_EMULATION_DEFAULT_DISABLED is not set
-# CONFIG_X86_X32_ABI is not set
 CONFIG_COMPAT_32=y
 CONFIG_COMPAT=y
 CONFIG_COMPAT_FOR_U64_ALIGNMENT=y
@@ -672,6 +681,7 @@ CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y
 CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y
 CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
 CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_MEMORY_ORDER_TSO=y
 CONFIG_HAVE_ASM_MODVERSIONS=y
 CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
 CONFIG_HAVE_RSEQ=y
@@ -711,10 +721,17 @@ CONFIG_HAVE_STACKPROTECTOR=y
 # CONFIG_STACKPROTECTOR is not set
 CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
 CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
+CONFIG_HAS_LTO_CLANG=y
 CONFIG_LTO_NONE=y
-CONFIG_ARCH_SUPPORTS_AUTOFDO_CLANG=y
-CONFIG_ARCH_SUPPORTS_PROPELLER_CLANG=y
+# CONFIG_LTO_CLANG_FULL is not set
+# CONFIG_LTO_CLANG_THIN is not set
+# CONFIG_LTO_CLANG_THIN_DIST is not set
+# CONFIG_AUTOFDO_CLANG is not set
+# CONFIG_PROPELLER_CLANG is not set
 CONFIG_ARCH_SUPPORTS_CFI=y
+# CONFIG_CFI is not set
+CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS=y
+CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC=y
 CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y
 CONFIG_HAVE_CONTEXT_TRACKING_USER=y
 CONFIG_HAVE_CONTEXT_TRACKING_USER_OFFSTACK=y
@@ -788,11 +805,9 @@ CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
 # end of GCOV-based kernel profiling

 CONFIG_HAVE_GCC_PLUGINS=y
-# CONFIG_GCC_PLUGINS is not set
 CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FUNCTION_ALIGNMENT_16B=y
 CONFIG_FUNCTION_ALIGNMENT=16
-CONFIG_CC_HAS_MIN_FUNCTION_ALIGNMENT=y
 CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT=y
 # end of General architecture-dependent options

@@ -819,11 +834,15 @@ CONFIG_MSDOS_PARTITION=y
 CONFIG_EFI_PARTITION=y
 # end of Partition Types

+# CONFIG_BLK_ERROR_INJECTION is not set
+
 #
 # IO Schedulers
 #
 CONFIG_MQ_IOSCHED_DEADLINE=y
 CONFIG_MQ_IOSCHED_KYBER=y
+CONFIG_MQ_IOSCHED_ADIOS=y
+# CONFIG_MQ_IOSCHED_DEFAULT_ADIOS is not set
 # CONFIG_IOSCHED_BFQ is not set
 # end of IO Schedulers

@@ -911,7 +930,6 @@ CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_NEVER=y
 # CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_WITHIN_SIZE is not set
 # CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ADVISE is not set
 CONFIG_THP_SWAP=y
-# CONFIG_READ_ONLY_THP_FOR_FS is not set
 # CONFIG_NO_PAGE_MAPCOUNT is not set
 CONFIG_PAGE_MAPCOUNT=y
 CONFIG_PGTABLE_HAS_HUGE_LEAVES=y
@@ -1041,7 +1059,6 @@ CONFIG_NET_PTP_CLASSIFY=y
 # CONFIG_NET_DSA is not set
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_LLC2 is not set
-# CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
 # CONFIG_PHONET is not set
@@ -1138,11 +1155,6 @@ CONFIG_PCI_LOCKLESS_CONFIG=y
 # CONFIG_PCI_PASID is not set
 # CONFIG_PCIE_TPH is not set
 CONFIG_PCI_LABEL=y
-# CONFIG_PCIE_BUS_TUNE_OFF is not set
-CONFIG_PCIE_BUS_DEFAULT=y
-# CONFIG_PCIE_BUS_SAFE is not set
-# CONFIG_PCIE_BUS_PERFORMANCE is not set
-# CONFIG_PCIE_BUS_PEER2PEER is not set
 CONFIG_VGA_ARB=y
 CONFIG_VGA_ARB_MAX_GPUS=16
 # CONFIG_HOTPLUG_PCI is not set
@@ -1316,7 +1328,6 @@ CONFIG_VIRTIO_BLK=y
 # CONFIG_ISL29020 is not set
 # CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_SENSORS_BH1770 is not set
-# CONFIG_SENSORS_APDS990X is not set
 # CONFIG_HMC6352 is not set
 # CONFIG_DS1682 is not set
 # CONFIG_SRAM is not set
@@ -1568,6 +1579,7 @@ CONFIG_SERIAL_8250_DWLIB=y
 #
 # Non-8250 serial port support
 #
+# CONFIG_SERIAL_MAX310X is not set
 # CONFIG_SERIAL_UARTLITE is not set
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
@@ -1600,7 +1612,6 @@ CONFIG_HW_RANDOM_AMD=y
 CONFIG_HW_RANDOM_VIA=y
 CONFIG_HW_RANDOM_VIRTIO=y
 # CONFIG_HW_RANDOM_XIPHERA is not set
-# CONFIG_APPLICOM is not set
 # CONFIG_DEVMEM is not set
 # CONFIG_NVRAM is not set
 # CONFIG_DEVPORT is not set
@@ -1785,6 +1796,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_K10TEMP is not set
 # CONFIG_SENSORS_FAM15H_POWER is not set
 # CONFIG_SENSORS_APPLESMC is not set
+# CONFIG_SENSORS_APPLESMC_T2 is not set
 # CONFIG_SENSORS_ASB100 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_CHIPCAP2 is not set
@@ -1824,6 +1836,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_LTC4260 is not set
 # CONFIG_SENSORS_LTC4261 is not set
 # CONFIG_SENSORS_LTC4282 is not set
+# CONFIG_SENSORS_LTC4283 is not set
 # CONFIG_SENSORS_MAX127 is not set
 # CONFIG_SENSORS_MAX16065 is not set
 # CONFIG_SENSORS_MAX1619 is not set
@@ -1879,6 +1892,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_DME1737 is not set
 # CONFIG_SENSORS_EMC1403 is not set
+# CONFIG_SENSORS_EMC1812 is not set
 # CONFIG_SENSORS_EMC2103 is not set
 # CONFIG_SENSORS_EMC2305 is not set
 # CONFIG_SENSORS_EMC6W201 is not set
@@ -2073,7 +2087,6 @@ CONFIG_SCREEN_INFO=y
 CONFIG_VIDEO=y
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_AGP is not set
-# CONFIG_VGA_SWITCHEROO is not set
 CONFIG_DRM=y

 #
@@ -2114,7 +2127,6 @@ CONFIG_DRM_PANEL_BRIDGE=y
 # Display Interface Bridges
 #
 # CONFIG_DRM_I2C_NXP_TDA998X is not set
-# CONFIG_DRM_ANALOGIX_ANX78XX is not set
 # end of Display Interface Bridges

 # CONFIG_DRM_ETNAVIV is not set
@@ -2148,6 +2160,7 @@ CONFIG_DRM_PANEL=y
 # CONFIG_DRM_VGEM is not set
 CONFIG_DRM_VIRTIO_GPU=y
 CONFIG_DRM_VIRTIO_GPU_KMS=y
+CONFIG_VIRTIO_GPU_NV=y
 # CONFIG_DRM_VKMS is not set
 # CONFIG_DRM_VMWGFX is not set
 # CONFIG_DRM_XE is not set
@@ -2166,6 +2179,7 @@ CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 # CONFIG_BACKLIGHT_AW99706 is not set
 # CONFIG_BACKLIGHT_KTZ8866 is not set
+# CONFIG_BACKLIGHT_MAX25014 is not set
 # CONFIG_BACKLIGHT_APPLE is not set
 # CONFIG_BACKLIGHT_QCOM_WLED is not set
 # CONFIG_BACKLIGHT_SAHARA is not set
@@ -2242,6 +2256,7 @@ CONFIG_HID_GENERIC=y
 # CONFIG_HID_MAGICMOUSE is not set
 # CONFIG_HID_MALTRON is not set
 # CONFIG_HID_MAYFLASH is not set
+# CONFIG_HID_RAKK is not set
 # CONFIG_HID_REDRAGON is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
@@ -2253,7 +2268,6 @@ CONFIG_HID_GENERIC=y
 # CONFIG_HID_PICOLCD is not set
 # CONFIG_HID_PLANTRONICS is not set
 # CONFIG_HID_PXRC is not set
-# CONFIG_HID_RAPOO is not set
 # CONFIG_HID_RAZER is not set
 # CONFIG_HID_PRIMAX is not set
 # CONFIG_HID_SAITEK is not set
@@ -2322,7 +2336,6 @@ CONFIG_RTC_MC146818_LIB=y
 CONFIG_SYNC_FILE=y
 CONFIG_UDMABUF=y
 # CONFIG_DMABUF_DEBUG is not set
-# CONFIG_DMABUF_SELFTESTS is not set
 # CONFIG_DMABUF_HEAPS is not set
 # end of DMABUF options

@@ -2809,6 +2822,8 @@ CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 # CONFIG_INIT_STACK_NONE is not set
 # CONFIG_INIT_STACK_ALL_PATTERN is not set
 CONFIG_INIT_STACK_ALL_ZERO=y
+CONFIG_CC_HAS_SANCOV_STACK_DEPTH_CALLBACK=y
+# CONFIG_KSTACK_ERASE is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
 CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
@@ -2829,7 +2844,9 @@ CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
 # CONFIG_BUG_ON_DATA_CORRUPTION is not set
 # end of Hardening of kernel data structures

+CONFIG_CC_HAS_RANDSTRUCT=y
 CONFIG_RANDSTRUCT_NONE=y
+# CONFIG_RANDSTRUCT_FULL is not set
 # end of Kernel hardening options
 # end of Security options

@@ -2841,6 +2858,7 @@ CONFIG_BINARY_PRINTF=y
 #
 # CONFIG_PACKING is not set
 CONFIG_BITREVERSE=y
+CONFIG_GENERIC_BITREVERSE=y
 CONFIG_GENERIC_STRNCPY_FROM_USER=y
 CONFIG_GENERIC_STRNLEN_USER=y
 CONFIG_GENERIC_NET_UTILS=y
@@ -2929,9 +2947,7 @@ CONFIG_DEBUG_INFO_NONE=y
 # CONFIG_DEBUG_INFO_DWARF5 is not set
 CONFIG_FRAME_WARN=1280
 # CONFIG_STRIP_ASM_SYMS is not set
-# CONFIG_READABLE_ASM is not set
 # CONFIG_HEADERS_INSTALL is not set
-# CONFIG_DEBUG_SECTION_MISMATCH is not set
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 # CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set
 CONFIG_OBJTOOL=y
@@ -3000,6 +3016,8 @@ CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 CONFIG_HAVE_ARCH_KFENCE=y
 # CONFIG_KFENCE is not set
 CONFIG_HAVE_ARCH_KMSAN=y
+CONFIG_HAVE_KMSAN_COMPILER=y
+# CONFIG_KMSAN is not set
 # end of Memory Debugging

 # CONFIG_DEBUG_SHIRQ is not set
@@ -13,6 +13,8 @@
 # ── Gaming needs ─────────────────────────────────────────
 # NTSYNC is a great improvement over fsync and esync approaches.
 CONFIG_NTSYNC=y
+# Performance CPU governor
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y

 # ── Controllers ──────────────────────────────────────────
 # A controller of a family the box can rebuild is made here as the device
@@ -157,10 +159,47 @@ CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_PREEMPT_DYNAMIC=y
 CONFIG_LRU_GEN=y
 CONFIG_LRU_GEN_ENABLED=y
-CONFIG_TRANSPARENT_HUGEPAGE=y
-CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
 CONFIG_PSI=y

+# Huge pages for every anonymous mapping that can have one, not only those that
+# ask. Games map large, long-lived heaps and never call madvise() for them, so
+# madvise-only would give them none, and a guest's TLB misses are the dearer
+# kind: each one walks two page-table levels.
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
+# CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set
+
+# The CachyOS scheduler and block-layer additions. The tree defaults these on,
+# but they are tree patches, so a different tree would quietly lose them.
+CONFIG_CACHY=y
+# Wakeup placement: finds an idle CPU from cached bitmasks instead of scanning,
+# which the frame pipeline pays for on every few-millisecond wakeup.
+CONFIG_SCHED_POC_SELECTOR=y
+# Keeps one process's threads inside a single last-level-cache domain.
+CONFIG_SCHED_CACHE=y
+# ADIOS as the multiqueue default: latency-driven, and the root is virtio-blk.
+CONFIG_MQ_IOSCHED_ADIOS=y
+CONFIG_MQ_IOSCHED_DEFAULT_ADIOS=y
+
+# BBR3 as the default congestion control. It paces itself, so it needs no fq
+# qdisc, and it holds a steady rate on lossy links where cubic backs off.
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR3=y
+CONFIG_DEFAULT_BBR3=y
+CONFIG_DEFAULT_TCP_CONG="bbr3"
+
+# ── CPU count ────────────────────────────────────────────
+# The per-CPU areas and cpumasks are sized for this at build time. No size tier
+# comes near it, and a distro-sized value only costs memory and cache.
+CONFIG_NR_CPUS=32
+
+# ── Thin-LTO ─────────────────────────────────────────────
+# Whole-kernel inlining across translation units, which matters most on the
+# syscall and scheduler paths. Needs clang and ld.lld, so scripts/kernel-build.sh
+# builds with LLVM=1. Thin rather than full: the link is parallel and does not
+# need tens of gigabytes of memory.
+CONFIG_LTO_CLANG_THIN=y
+
 # ── Undoing the minimal seed ─────────────────────────────
 # base.config descends from a size-minimised config with EXPERT on, and EXPERT
 # is what makes each of these promptable. Every one is `default y` (or the
@@ -173,9 +212,9 @@ CONFIG_PSI=y
 # guest allocates constantly: network buffers, GPU ioctls, io_uring, futexes.
 # CONFIG_SLUB_TINY is not set
 #
-# Without ADVISE_SYSCALLS, madvise() and fadvise() return ENOSYS. THP above is
-# madvise-only, so no user mapping could ever get a huge page, and allocators
-# could never hand memory back with MADV_DONTNEED or MADV_FREE.
+# Without ADVISE_SYSCALLS, madvise() and fadvise() return ENOSYS, so allocators
+# could never hand memory back with MADV_DONTNEED or MADV_FREE, nor ask for
+# (or refuse) a huge page for one mapping.
 CONFIG_ADVISE_SYSCALLS=y
 #
 # Without MEMBARRIER, Wine and the .NET runtime fall back to an mprotect() trick
@@ -220,3 +259,14 @@ CONFIG_JUMP_LABEL=y
 # What would change this: running two players' sessions on one box at the same
 # time, or anything of value living inside the guest. Neither is true today.
 # CONFIG_CPU_MITIGATIONS is not set
+
+# The rest of what a general-purpose distro config pays for, off for the same
+# reason: one tenant, no untrusted code in the guest that the VM boundary does
+# not already contain. Pinned because a reseed from a distro config turns them
+# on, and each costs on the allocation, syscall or call path.
+# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
+# CONFIG_SLAB_FREELIST_HARDENED is not set
+# CONFIG_SLAB_FREELIST_RANDOM is not set
+# CONFIG_STACKPROTECTOR is not set
+# CONFIG_SCHED_STACK_END_CHECK is not set
+CONFIG_DEBUG_INFO_NONE=y
@@ -170,6 +170,19 @@ grep -qx 'obj-$(CONFIG_VIRTIO_GPU_NV) += nvgpu/' drivers/gpu/drm/Makefile \
    || sed -i '/^obj-\$(CONFIG_DRM_VIRTIO_GPU) += virtio\/$/a obj-$(CONFIG_VIRTIO_GPU_NV) += nvgpu/' \
        drivers/gpu/drm/Makefile

+# ── Toolchain ───────────────────────────────────────────
+# Thin-LTO is clang's, and whether it is offered at all is decided when Kconfig
+# runs: HAS_LTO_CLANG is false under gcc, and olddefconfig would then drop
+# LTO_CLANG_THIN without a word. So LLVM=1 goes to every make below, config
+# steps included, and the tools are checked before any of it starts.
+for tool in clang ld.lld llvm-ar llvm-nm llvm-objcopy llvm-strip; do
+    command -v "${tool}" >/dev/null || {
+        echo "kernel: ${tool} not found; the kernel is built with clang for thin-LTO" >&2
+        exit 1
+    }
+done
+make_args=(LLVM=1)
+
 # ── Config ──────────────────────────────────────────────
 # A fresh tree has no .config. The seed is a known-good minimal config that
 # olddefconfig migrates to whatever version the tree is at; it only saves a
@@ -184,7 +197,7 @@ echo "kernel: merging kernel/nestri.fragment"
 # -m merges without running a config target, so olddefconfig resolves
 # dependencies once, in one place.
 ./scripts/kconfig/merge_config.sh -m .config "${FRAGMENT}" >/dev/null
-make olddefconfig >/dev/null
+make "${make_args[@]}" olddefconfig >/dev/null

 # ── Verify the fragment actually took ───────────────────
 # merge_config.sh warns about overridden symbols but exits 0, and olddefconfig
@@ -217,7 +230,6 @@ echo "kernel: all ${total} fragment entries hold"
 # and gcc applies those as a mask over -march regardless of flag order, so the
 # kernel gets v3's integer ISA (BMI2, LZCNT, MOVBE) and its scheduling model
 # and never touches a vector register.
-make_args=()
 if [[ -n "${KERNEL_MARCH:-}" ]]; then
    make_args+=("KCFLAGS=-march=${KERNEL_MARCH}")
    echo "kernel: building with -march=${KERNEL_MARCH}"