[Pedro Henrique Penna (ppenna)]

Summary

doc/build.md described the kernel configuration requirements in three separate paragraphs and missed the network group that f745c42 (guest: configure the portable profile's IPv6 identity) added. Since that commit, every kernel build requires IPv4, IPv6 without the SIT driver, and virtio-net so guests can configure the portable network profile's dual-stack NIC. The guide also left out the virtio-console, shared-interrupt-status, and watchdog groups. It said the checks ran in the "native" build, but the Docker build runs the same build-kernel command. It also didn't say what nvx.py verify checks.

This PR replaces those statements with one Kernel configuration checks section: a table of every group that build-kernel checks after olddefconfig, what each group is for, and where packaging and verify check the configuration again. The existing rationale for the time-ABI and hardening settings stays where it was.

Changes

Statement	Evidence
New: the build requires the network group (CONFIG_INET, CONFIG_IPV6, no CONFIG_IPV6_SIT, CONFIG_VIRTIO_NET) to support the portable profile's dual-stack NIC, and SIT would add an sit0 decapsulation device	KernelBuildConstants.REQUIRED_NETWORK_CONFIG in scripts/nvx_tools/build_constants.py; _assert_network_kernel_config in scripts/nvx_tools/build.py; commit f745c42
The table lists all eight groups: direct boot, virtio console, sandbox, network, shared interrupt status, time ABI, hardening, and watchdogs	assert_required_kernel_config and the REQUIRED_*_CONFIG / DEBUG_WATCHDOG_CONFIG constants
Before: "The native kernel build ... fails if ...". Now the checks run in build-kernel, which the Docker build also runs	build_kernel calls assert_required_kernel_config right after olddefconfig (build.py); docker/Dockerfile runs python3 scripts/nvx.py build-kernel
Packaging runs the checks again on the packaged config	package_release → _validate_kernel_provenance → assert_required_kernel_config (scripts/nvx_tools/release.py)
verify checks the checked-in kernel/config-microvm for the direct-boot, sandbox, network, time-ABI, and hardening groups plus xe9 and virtio-fs, and checks an existing build/vmlinux.config for the direct-boot, sandbox, and network groups plus xe9	verify_source_tree in release.py
Removed: the old sentence "The build fails if olddefconfig drops any required option" and the separate paragraph on Unix sockets, seccomp, and overlayfs redirects. Their content is now in the sandbox row	REQUIRED_SANDBOX_CONFIG

No design documents changed. The only changed path is doc/build.md.

Follow-ups (out of scope)

• scripts/nvx.py --help still describes init as "initialize the private submodule", but openvmm/ comes from the public nanvix/openvmm, as doc/contribute.md and doc/project-structure.md say. This is a code change, so it's left to a separate PR.
• The repository root tracks a unittest_results.txt file that doc/project-structure.md doesn't list. It looks like an accidental commit, so I didn't document it. Maintainers should decide whether to remove it.
• build.md's list of build_constants.py namespaces doesn't name AzureLinuxBuildConstants. This is minor and separate from this topic.
• Open PRs touch scripts/setup/README.md (ci: record benchmark host provenance and storage telemetry #479), which is documentation outside doc/, and several doc/ files. I left all of them alone.

Validation

• python -m unittest scripts.test_nvx_tools.CliTests scripts.test_performance.PerformanceTests: Ran 110 tests, OK (skipped=1)
• A throwaway link checker kept outside the repo: every relative link and anchor in doc/build.md and the 7 Markdown files that link to it resolves; build.md has one H1 and balanced code fences; doc/design.md links every chapter in doc/design/.
• git diff --check: clean
• python scripts/nvx.py verify: passes (dev cb0fba8baea62dc2b367199c1903927c7aa17e27, OpenVMM pin 7bf0ee28b826374a2d386067df0456b81bcae818)

[Copilot]

🟡 Changes recommended

The guide overstates verify hardening coverage because it does not reject arbitrary module options.

1 open finding

• verify_source_tree omits the no-module hardening check · New

What changed in this PR

Documents the kernel configuration validation performed during build, packaging, and verification.

Changes:

• Consolidates kernel requirements into eight configuration groups.
• Clarifies Docker and native build validation.
• Describes packaging and verify coverage.

File	Description
doc/​build.md	Adds consolidated kernel configuration checks and validation details.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.