mirror of
https://github.com/hanzoai/vm.git
synced 2026-10-01 00:47:56 +00:00
kernel: add x86_64 defconfig and arch-aware build script
Same feature set as the arm64 config (virtio-pci, virtio-console, vsock, netfilter, cgroup2 + k3s set); the arch section swaps GICv3/PL011 for PVH direct boot, kvmclock, and ACPI. cloud-hypervisor loads the uncompressed ELF vmlinux via its PVH entry, so the build strips vmlinux into Image instead of taking arch/*/boot/Image. Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
Hanzo Dev
@@ -0,0 +1,227 @@
|
||||
# Hanzo VM microVM kernel config — x86_64 / cloud-hypervisor
|
||||
# Same feature set as vm_defconfig (arm64); arch section swapped for
|
||||
# PVH direct boot, kvmclock, and ACPI CPU/device enumeration.
|
||||
# All drivers built-in (no loadable modules)
|
||||
|
||||
# Architecture
|
||||
CONFIG_64BIT=y
|
||||
CONFIG_SMP=y
|
||||
CONFIG_NR_CPUS=16
|
||||
CONFIG_HYPERVISOR_GUEST=y
|
||||
CONFIG_PARAVIRT=y
|
||||
CONFIG_KVM_GUEST=y
|
||||
CONFIG_PVH=y
|
||||
CONFIG_ACPI=y
|
||||
|
||||
# No loadable modules
|
||||
# CONFIG_MODULES is not set
|
||||
|
||||
# General
|
||||
CONFIG_SYSVIPC=y
|
||||
CONFIG_POSIX_MQUEUE=y
|
||||
CONFIG_NO_HZ_IDLE=y
|
||||
CONFIG_HIGH_RES_TIMERS=y
|
||||
CONFIG_PREEMPT_VOLUNTARY=y
|
||||
CONFIG_HZ_100=y
|
||||
CONFIG_SYSCTL=y
|
||||
CONFIG_MULTIUSER=y
|
||||
CONFIG_FHANDLE=y
|
||||
CONFIG_EPOLL=y
|
||||
CONFIG_SIGNALFD=y
|
||||
CONFIG_TIMERFD=y
|
||||
CONFIG_EVENTFD=y
|
||||
CONFIG_AIO=y
|
||||
CONFIG_IO_URING=y
|
||||
|
||||
# Size optimization
|
||||
CONFIG_CC_OPTIMIZE_FOR_SIZE=y
|
||||
# CONFIG_DEBUG_KERNEL is not set
|
||||
# CONFIG_DEBUG_INFO is not set
|
||||
# CONFIG_FTRACE is not set
|
||||
# CONFIG_KPROBES is not set
|
||||
# CONFIG_PROFILING is not set
|
||||
|
||||
# PCI (cloud-hypervisor uses PCI transport)
|
||||
CONFIG_PCI=y
|
||||
CONFIG_PCI_MSI=y
|
||||
|
||||
# VirtIO core
|
||||
CONFIG_VIRTIO=y
|
||||
CONFIG_VIRTIO_PCI=y
|
||||
CONFIG_VIRTIO_MENU=y
|
||||
|
||||
# VirtIO devices (all built-in)
|
||||
CONFIG_VIRTIO_BLK=y
|
||||
CONFIG_VIRTIO_CONSOLE=y
|
||||
CONFIG_VIRTIO_NET=y
|
||||
CONFIG_VIRTIO_BALLOON=y
|
||||
CONFIG_VIRTIO_MMIO=y
|
||||
CONFIG_HW_RANDOM=y
|
||||
CONFIG_HW_RANDOM_VIRTIO=y
|
||||
CONFIG_VIRTIO_FS=y
|
||||
CONFIG_VIRTIO_INPUT=y
|
||||
|
||||
# vsock (all built-in)
|
||||
CONFIG_VSOCKETS=y
|
||||
CONFIG_VIRTIO_VSOCKETS=y
|
||||
CONFIG_VIRTIO_VSOCKETS_COMMON=y
|
||||
|
||||
# Block layer
|
||||
CONFIG_BLOCK=y
|
||||
CONFIG_BLK_DEV=y
|
||||
CONFIG_BLK_DEV_INITRD=y
|
||||
|
||||
# Filesystems
|
||||
CONFIG_EXT4_FS=y
|
||||
CONFIG_EXT4_FS_POSIX_ACL=y
|
||||
CONFIG_EXT4_USE_FOR_EXT2=y
|
||||
CONFIG_OVERLAY_FS=y
|
||||
CONFIG_FUSE_FS=y
|
||||
CONFIG_TMPFS=y
|
||||
CONFIG_TMPFS_POSIX_ACL=y
|
||||
CONFIG_PROC_FS=y
|
||||
CONFIG_PROC_SYSCTL=y
|
||||
CONFIG_SYSFS=y
|
||||
CONFIG_DEVTMPFS=y
|
||||
CONFIG_DEVTMPFS_MOUNT=y
|
||||
CONFIG_DEVPTS_FS=y
|
||||
CONFIG_CONFIGFS_FS=y
|
||||
|
||||
# Networking
|
||||
CONFIG_NET=y
|
||||
CONFIG_NETDEVICES=y
|
||||
CONFIG_LOOPBACK=y
|
||||
CONFIG_PACKET=y
|
||||
CONFIG_UNIX=y
|
||||
CONFIG_INET=y
|
||||
CONFIG_IP_MULTICAST=y
|
||||
CONFIG_IP_ADVANCED_ROUTER=y
|
||||
CONFIG_IP_MULTIPLE_TABLES=y
|
||||
CONFIG_IP_ROUTE_MULTIPATH=y
|
||||
CONFIG_IPV6=y
|
||||
CONFIG_BRIDGE=y
|
||||
|
||||
# Netfilter (for iptables REDIRECT in proxy mode)
|
||||
CONFIG_NETFILTER=y
|
||||
CONFIG_NETFILTER_ADVANCED=y
|
||||
CONFIG_NETFILTER_XTABLES=y
|
||||
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
|
||||
CONFIG_NETFILTER_XT_MATCH_STATE=y
|
||||
CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
|
||||
CONFIG_NF_CONNTRACK=y
|
||||
CONFIG_NF_NAT=y
|
||||
CONFIG_NF_TABLES=y
|
||||
CONFIG_NF_TABLES_INET=y
|
||||
CONFIG_NFT_NAT=y
|
||||
CONFIG_NFT_REDIR=y
|
||||
CONFIG_NFT_CT=y
|
||||
CONFIG_IP_NF_IPTABLES=y
|
||||
CONFIG_IP_NF_FILTER=y
|
||||
CONFIG_IP_NF_NAT=y
|
||||
CONFIG_IP_NF_TARGET_REDIRECT=y
|
||||
CONFIG_IP_NF_TARGET_MASQUERADE=y
|
||||
|
||||
# CRC32 (required by ext4)
|
||||
CONFIG_CRC32=y
|
||||
CONFIG_LIBCRC32C=y
|
||||
CONFIG_CRYPTO_CRC32C=y
|
||||
|
||||
# TTY / Console
|
||||
CONFIG_TTY=y
|
||||
CONFIG_VT=y
|
||||
CONFIG_HVC_DRIVER=y
|
||||
CONFIG_PRINTK=y
|
||||
|
||||
# PTY support (for shell/TTY exec)
|
||||
CONFIG_UNIX98_PTYS=y
|
||||
|
||||
# Cgroups (future container features)
|
||||
CONFIG_CGROUPS=y
|
||||
CONFIG_CGROUP_CPUACCT=y
|
||||
CONFIG_CGROUP_DEVICE=y
|
||||
CONFIG_CGROUP_FREEZER=y
|
||||
CONFIG_CGROUP_PIDS=y
|
||||
CONFIG_CGROUP_SCHED=y
|
||||
CONFIG_MEMCG=y
|
||||
|
||||
# Namespaces
|
||||
CONFIG_NAMESPACES=y
|
||||
CONFIG_UTS_NS=y
|
||||
CONFIG_IPC_NS=y
|
||||
CONFIG_PID_NS=y
|
||||
CONFIG_NET_NS=y
|
||||
CONFIG_USER_NS=y
|
||||
|
||||
# inotify (used by many tools)
|
||||
CONFIG_INOTIFY_USER=y
|
||||
|
||||
# Disable unnecessary subsystems
|
||||
# CONFIG_SOUND is not set
|
||||
# CONFIG_USB_SUPPORT is not set
|
||||
# CONFIG_WLAN is not set
|
||||
# CONFIG_WIRELESS is not set
|
||||
# CONFIG_INPUT_KEYBOARD is not set
|
||||
# CONFIG_INPUT_MOUSE is not set
|
||||
# CONFIG_INPUT_TOUCHSCREEN is not set
|
||||
# CONFIG_SCSI is not set
|
||||
# CONFIG_ATA is not set
|
||||
# CONFIG_DRM is not set
|
||||
# CONFIG_FB is not set
|
||||
# CONFIG_VGA_CONSOLE is not set
|
||||
# CONFIG_SELINUX is not set
|
||||
# CONFIG_SECURITY is not set
|
||||
# CONFIG_AUDIT is not set
|
||||
# CONFIG_SWAP is not set
|
||||
# CONFIG_NFS_FS is not set
|
||||
# CONFIG_CIFS is not set
|
||||
# CONFIG_BTRFS_FS is not set
|
||||
# CONFIG_XFS_FS is not set
|
||||
# CONFIG_BLK_DEV_LOOP is not set
|
||||
# CONFIG_BLK_DEV_RAM is not set
|
||||
# CONFIG_PCMCIA is not set
|
||||
# CONFIG_HWMON is not set
|
||||
# CONFIG_THERMAL is not set
|
||||
# CONFIG_WATCHDOG is not set
|
||||
# CONFIG_MEDIA_SUPPORT is not set
|
||||
# CONFIG_POWER_SUPPLY is not set
|
||||
# CONFIG_MD is not set
|
||||
|
||||
# Cgroup v2 controllers k3s requires (cpuset is fatal when missing)
|
||||
CONFIG_CPUSETS=y
|
||||
CONFIG_PROC_PID_CPUSET=y
|
||||
CONFIG_FAIR_GROUP_SCHED=y
|
||||
CONFIG_CFS_BANDWIDTH=y
|
||||
CONFIG_BLK_CGROUP=y
|
||||
CONFIG_CGROUP_BPF=y
|
||||
CONFIG_BPF=y
|
||||
CONFIG_BPF_SYSCALL=y
|
||||
|
||||
# Container runtime (runc: session keyring, seccomp, cgroup2 device bpf)
|
||||
CONFIG_KEYS=y
|
||||
CONFIG_SECCOMP=y
|
||||
CONFIG_SECCOMP_FILTER=y
|
||||
|
||||
# Pod networking: flannel vxlan, CNI bridge/veth, kube-proxy iptables
|
||||
CONFIG_VETH=y
|
||||
CONFIG_VXLAN=y
|
||||
CONFIG_BRIDGE_NETFILTER=y
|
||||
CONFIG_NETFILTER_XT_MARK=y
|
||||
CONFIG_NETFILTER_XT_NAT=y
|
||||
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
|
||||
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
|
||||
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
|
||||
CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
|
||||
CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y
|
||||
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
|
||||
CONFIG_IP_NF_MANGLE=y
|
||||
CONFIG_IP_NF_RAW=y
|
||||
CONFIG_IP_NF_TARGET_REJECT=y
|
||||
CONFIG_IP6_NF_IPTABLES=y
|
||||
CONFIG_IP6_NF_FILTER=y
|
||||
CONFIG_IP6_NF_MANGLE=y
|
||||
CONFIG_IP6_NF_NAT=y
|
||||
CONFIG_IP6_NF_TARGET_MASQUERADE=y
|
||||
CONFIG_IP6_NF_TARGET_REJECT=y
|
||||
CONFIG_NFT_COMPAT=y
|
||||
CONFIG_NFT_MASQ=y
|
||||
CONFIG_NFT_REJECT=y
|
||||
+15
-1
@@ -28,7 +28,21 @@ if [ ! -d "${BUILD_DIR}/linux-${KERNEL_VERSION}" ]; then
|
||||
rm -f "${BUILD_DIR}/linux-${KERNEL_VERSION}.tar.xz"
|
||||
fi
|
||||
|
||||
if [ "$(uname -m)" = "aarch64" ] && [ "$(uname -s)" = "Linux" ]; then
|
||||
if [ "$(uname -m)" = "x86_64" ] && [ "$(uname -s)" = "Linux" ]; then
|
||||
echo " Native x86_64 Linux detected, building without Docker"
|
||||
|
||||
cd "${BUILD_DIR}/linux-${KERNEL_VERSION}"
|
||||
|
||||
cp "${REPO_DIR}/kernel/vm_defconfig_x86" arch/x86/configs/vm_defconfig
|
||||
make ARCH=x86_64 vm_defconfig
|
||||
|
||||
echo " Compiling kernel (this takes a few minutes)..."
|
||||
make ARCH=x86_64 -j"$(nproc)" vmlinux 2>&1 | tail -5
|
||||
|
||||
# cloud-hypervisor direct-boots the uncompressed ELF via its PVH entry.
|
||||
strip -o "${DATA_DIR}/Image" vmlinux
|
||||
echo " Kernel built: $(du -h "${DATA_DIR}/Image" | cut -f1)"
|
||||
elif [ "$(uname -m)" = "aarch64" ] && [ "$(uname -s)" = "Linux" ]; then
|
||||
echo " Native aarch64 Linux detected, building without Docker"
|
||||
|
||||
cd "${BUILD_DIR}/linux-${KERNEL_VERSION}"
|
||||
|
||||
Reference in New Issue
Block a user