1 #
2 # FIRECRACKER -- kernel configuration file for Firecracker VM
3 #
4 # This is largely a stripped-down version of the GENERIC kernel configuration
5 # file, without drivers for hardware which will never appear inside the
6 # Firecracker VM environment. It adds support for the Virtio MMIO bus,
7 # which Firecracker uses for exposing devices, and legacy mptable, which
8 # Firecracker uses for exposing information about CPUs (since it doesn't
9 # support ACPI).
10 #
11 # Since Firecracker loads the kernel directly via the PVH boot protocol,
12 # it bypasses the boot loader; some environment variables are hard-coded
13 # here which would normally be provided via device hints or loader.conf.
14 #
15 # For more information about the Firecracker VM, see:
16 #
17 # https://firecracker-microvm.github.io/
18
19 cpu HAMMER
20 ident FIRECRACKER
21
22 makeoptions DEBUG=-g # Build kernel with gdb(1) debug symbols
23 makeoptions WITH_CTF=1 # Run ctfconvert(1) for DTrace support
24
25 options SCHED_ULE # ULE scheduler
26 options NUMA # Non-Uniform Memory Architecture support
27 options PREEMPTION # Enable kernel thread preemption
28 options VIMAGE # Subsystem virtualization, e.g. VNET
29 options INET # InterNETworking
30 options INET6 # IPv6 communications protocols
31 options IPSEC_SUPPORT # Allow kldload of ipsec and tcpmd5
32 options ROUTE_MPATH # Multipath routing support
33 options FIB_ALGO # Modular fib lookups
34 options TCP_OFFLOAD # TCP offload
35 options TCP_BLACKBOX # Enhanced TCP event logging
36 options TCP_HHOOK # hhook(9) framework for TCP
37 options TCP_RFC7413 # TCP Fast Open
38 options SCTP_SUPPORT # Allow kldload of SCTP
39 options KERN_TLS # TLS transmit & receive offload
40 options FFS # Berkeley Fast Filesystem
41 options SOFTUPDATES # Enable FFS soft updates support
42 options UFS_ACL # Support for access control lists
43 options UFS_DIRHASH # Improve performance on big directories
44 options UFS_GJOURNAL # Enable gjournal-based UFS journaling
45 options QUOTA # Enable disk quotas for UFS
46 options MD_ROOT # MD is a potential root device
47 options NFSCL # Network Filesystem Client
48 options NFSD # Network Filesystem Server
49 options NFSLOCKD # Network Lock Manager
50 options NFS_ROOT # NFS usable as /, requires NFSCL
51 options MSDOSFS # MSDOS Filesystem
52 options CD9660 # ISO 9660 Filesystem
53 options PROCFS # Process filesystem (requires PSEUDOFS)
54 options PSEUDOFS # Pseudo-filesystem framework
55 options TMPFS # Efficient memory filesystem
56 options GEOM_RAID # Soft RAID functionality.
57 options GEOM_LABEL # Provides labelization
58 options EFIRT # EFI Runtime Services support
59 options COMPAT_FREEBSD32 # Compatible with i386 binaries
60 options COMPAT_FREEBSD4 # Compatible with FreeBSD4
61 options COMPAT_FREEBSD5 # Compatible with FreeBSD5
62 options COMPAT_FREEBSD6 # Compatible with FreeBSD6
63 options COMPAT_FREEBSD7 # Compatible with FreeBSD7
64 options COMPAT_FREEBSD9 # Compatible with FreeBSD9
65 options COMPAT_FREEBSD10 # Compatible with FreeBSD10
66 options COMPAT_FREEBSD11 # Compatible with FreeBSD11
67 options COMPAT_FREEBSD12 # Compatible with FreeBSD12
68 options COMPAT_FREEBSD13 # Compatible with FreeBSD13
69 options SCSI_DELAY=5000 # Delay (in ms) before probing SCSI
70 options KTRACE # ktrace(1) support
71 options STACK # stack(9) support
72 options SYSVSHM # SYSV-style shared memory
73 options SYSVMSG # SYSV-style message queues
74 options SYSVSEM # SYSV-style semaphores
75 options _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
76 options PRINTF_BUFR_SIZE=128 # Prevent printf output being interspersed.
77 options KBD_INSTALL_CDEV # install a CDEV entry in /dev
78 options HWPMC_HOOKS # Necessary kernel hooks for hwpmc(4)
79 options AUDIT # Security event auditing
80 options CAPABILITY_MODE # Capsicum capability mode
81 options CAPABILITIES # Capsicum capabilities
82 options MAC # TrustedBSD MAC Framework
83 options KDTRACE_FRAME # Ensure frames are compiled in
84 options KDTRACE_HOOKS # Kernel DTrace hooks
85 options DDB_CTF # Kernel ELF linker loads CTF data
86 options INCLUDE_CONFIG_FILE # Include this file in kernel
87 options RACCT # Resource accounting framework
88 options RACCT_DEFAULT_TO_DISABLED # Set kern.racct.enable=0 by default
89 options RCTL # Resource limits
90
91 # Debugging support. Always need this:
92 options KDB # Enable kernel debugger support.
93 options KDB_TRACE # Print a stack trace for a panic.
94 # For full debugger support use (turn off in stable branch):
95 options BUF_TRACKING # Track buffer history
96 options DDB # Support DDB.
97 options FULL_BUF_TRACKING # Track more buffer history
98 options GDB # Support remote GDB.
99 options DEADLKRES # Enable the deadlock resolver
100 options INVARIANTS # Enable calls of extra sanity checking
101 options INVARIANT_SUPPORT # Extra sanity checks of internal structures, required by INVARIANTS
102 options QUEUE_MACRO_DEBUG_TRASH # Trash queue(2) internal pointers on invalidation
103 options WITNESS # Enable checks to detect deadlocks and cycles
104 options WITNESS_SKIPSPIN # Don't run witness on spinlocks for speed
105 options MALLOC_DEBUG_MAXZONES=8 # Separate malloc(9) zones
106 options VERBOSE_SYSINIT=0 # Support debug.verbose_sysinit, off by default
107
108 # Kernel dump features.
109 options EKCD # Support for encrypted kernel dumps
110 options GZIO # gzip-compressed kernel and user dumps
111 options ZSTDIO # zstd-compressed kernel and user dumps
112 options DEBUGNET # debugnet networking
113 options NETDUMP # netdump(4) client support
114 options NETGDB # netgdb(4) client support
115
116 # Make an SMP-capable kernel by default
117 options SMP # Symmetric MultiProcessor Kernel
118 options EARLY_AP_STARTUP
119
120 # Pseudo devices.
121 device crypto # core crypto support
122 device aesni # AES-NI OpenCrypto module
123 device loop # Network loopback
124 device rdrand_rng # Intel Bull Mountain RNG
125 device ether # Ethernet support
126 device vlan # 802.1Q VLAN support
127 device tuntap # Packet tunnel.
128 device md # Memory "disks"
129 device gif # IPv6 and IPv4 tunneling
130 device firmware # firmware assist module
131 device xz # lzma decompression
132 device bpf # Berkeley packet filter
133
134 # Serial (COM) ports
135 device uart # Generic UART driver
136
137 # VirtIO support
138 device virtio # Generic VirtIO bus (required)
139 device virtio_mmio # VirtIO MMIO bus
140 device vtnet # VirtIO Ethernet device
141 device virtio_blk # VirtIO Block device
142
143 # Linux KVM paravirtualization support
144 device kvm_clock # KVM paravirtual clock driver
145
146 # Netmap provides direct access to TX/RX rings on supported NICs
147 device netmap # netmap(4) support
148
149 # Firecracker exposes information via the legacy MP Table mechanism
150 # rather than via ACPI (which it does not implement).
151 device mptable
152
153 # Firecracker launches the FreeBSD kernel directly, via the PVH boot
154 # protocol, rather than via the boot loader; as such, we need to bake
155 # device hints into the kernel configuration rather than relying on
156 # device.hints being loaded, and likewise have no loader.conf to place
157 # other settings into.
158 envvar hint.uart.0.at="isa"
159 envvar hint.uart.0.port="0x3F8"
160 envvar hint.uart.0.flags="0x10"
161 envvar hint.uart.0.irq="0x4"
162 envvar hint.acpi.0.disabled="1"
163
164 # Inside a VM, "power off" doesn't really yank the AC power, so there's
165 # no need to worry about disks flushing caches before losing power.
166 envvar kern.shutdown.poweroff_delay="0"
167
168 # Firecracker seems to have a bug in its UART emulation. This works
169 # around the problem.
170 envvar hw.broken_txfifo="1"
171
172 # We don't have an early timecounter to calibrate the TSC against, so
173 # skip that; later in the boot process we have other timecounters.
174 envvar machdep.disable_tsc_calibration="1"
175
176 # Provide bug-for-bug compatiblity with Linux in MP Table searching
177 # and parsing. Firecracker relies on these bugs.
178 options MPTABLE_LINUX_BUG_COMPAT
179
180 # Disable the automatic registration of a PCI bridge; we do in fact
181 # not have one.
182 options NO_LEGACY_PCIB
183
184 # Bus support.
185 # Note that Firecracker provides neither ACPI nor PCI; but removing these
186 # devices currently (2022-07-09) prevents the kernel from building.
187 device acpi
188 device pci
189
190 # Xen HVM Guest Optimizations
191 # NOTE: XENHVM depends on xenpci and xentimer.
192 # They must be added or removed together.
193 # NOTE: These are present in FIRECRACKER because the PVH boot method
194 # originates from Xen; once that code is untangled these can be removed.
195 options XENHVM # Xen HVM kernel infrastructure
196 device xenpci # Xen HVM Hypervisor services driver
197 device xentimer # Xen x86 PV timer device
Cache object: e333f78676945c2d6053ca9ae1db67fa
|