mirror of
https://github.com/hanzoai/vm.git
synced 2026-10-01 00:47:56 +00:00
zeekayandHanzo Dev
75619b3e88
cloud-hypervisor describes vCPUs as x2apic MADT entries; without CONFIG_X86_X2APIC the kernel ignored them and every x86_64 guest booted with a single CPU regardless of --cpus. DEFERRED_STRUCT_PAGE_INIT moves the largest silent stretch of early boot onto all CPUs (x86 guest boot 202 -> 130 ms); measured as a wash on arm64 (VZ and KVM), so only x86 takes it. Co-authored-by: Hanzo Dev <[email protected]>
236 lines
5.2 KiB
Plaintext
236 lines
5.2 KiB
Plaintext
# Hanzo VM microVM kernel config
|
|
# Minimal ARM64 kernel for Apple Virtualization.framework
|
|
# Based on allnoconfig + required features
|
|
# All drivers built-in (no loadable modules)
|
|
|
|
# Architecture
|
|
CONFIG_ARM64=y
|
|
CONFIG_ARCH_VIRT=y
|
|
CONFIG_SMP=y
|
|
CONFIG_NR_CPUS=16
|
|
# DEFERRED_STRUCT_PAGE_INIT measured as a wash here (VZ and KVM, 2 GB
|
|
# guests): the deferred pass costs what the serial pass saved. x86 keeps
|
|
# it because cloud-hypervisor guests measurably win.
|
|
|
|
# No loadable modules
|
|
# CONFIG_MODULES is not set
|
|
|
|
# General
|
|
CONFIG_SYSVIPC=y
|
|
CONFIG_POSIX_MQUEUE=y
|
|
CONFIG_NO_HZ_IDLE=y
|
|
CONFIG_HIGH_RES_TIMERS=y
|
|
CONFIG_PREEMPT_VOLUNTARY=y
|
|
CONFIG_HZ_100=y
|
|
CONFIG_SYSCTL=y
|
|
CONFIG_MULTIUSER=y
|
|
CONFIG_FHANDLE=y
|
|
CONFIG_EPOLL=y
|
|
CONFIG_SIGNALFD=y
|
|
CONFIG_TIMERFD=y
|
|
CONFIG_EVENTFD=y
|
|
CONFIG_AIO=y
|
|
CONFIG_IO_URING=y
|
|
|
|
# Size optimization
|
|
CONFIG_CC_OPTIMIZE_FOR_SIZE=y
|
|
# CONFIG_DEBUG_KERNEL is not set
|
|
# CONFIG_DEBUG_INFO is not set
|
|
# CONFIG_FTRACE is not set
|
|
# CONFIG_KPROBES is not set
|
|
# CONFIG_PROFILING is not set
|
|
|
|
# PCI (Apple Virtualization.framework uses PCI transport)
|
|
CONFIG_PCI=y
|
|
CONFIG_PCI_HOST_GENERIC=y
|
|
|
|
# VirtIO core
|
|
CONFIG_VIRTIO=y
|
|
CONFIG_VIRTIO_PCI=y
|
|
CONFIG_VIRTIO_MENU=y
|
|
|
|
# VirtIO devices (all built-in)
|
|
CONFIG_VIRTIO_BLK=y
|
|
CONFIG_VIRTIO_CONSOLE=y
|
|
CONFIG_VIRTIO_NET=y
|
|
CONFIG_VIRTIO_BALLOON=y
|
|
CONFIG_VIRTIO_MMIO=y
|
|
CONFIG_HW_RANDOM=y
|
|
CONFIG_HW_RANDOM_VIRTIO=y
|
|
CONFIG_VIRTIO_FS=y
|
|
CONFIG_VIRTIO_INPUT=y
|
|
|
|
# vsock (all built-in)
|
|
CONFIG_VSOCKETS=y
|
|
CONFIG_VIRTIO_VSOCKETS=y
|
|
CONFIG_VIRTIO_VSOCKETS_COMMON=y
|
|
|
|
# Block layer
|
|
CONFIG_BLOCK=y
|
|
CONFIG_BLK_DEV=y
|
|
CONFIG_BLK_DEV_INITRD=y
|
|
|
|
# Filesystems
|
|
CONFIG_EXT4_FS=y
|
|
CONFIG_EXT4_FS_POSIX_ACL=y
|
|
CONFIG_EXT4_USE_FOR_EXT2=y
|
|
CONFIG_OVERLAY_FS=y
|
|
CONFIG_FUSE_FS=y
|
|
CONFIG_TMPFS=y
|
|
CONFIG_TMPFS_POSIX_ACL=y
|
|
CONFIG_PROC_FS=y
|
|
CONFIG_PROC_SYSCTL=y
|
|
CONFIG_SYSFS=y
|
|
CONFIG_DEVTMPFS=y
|
|
CONFIG_DEVTMPFS_MOUNT=y
|
|
CONFIG_DEVPTS_FS=y
|
|
CONFIG_CONFIGFS_FS=y
|
|
|
|
# Networking
|
|
CONFIG_NET=y
|
|
CONFIG_NETDEVICES=y
|
|
CONFIG_LOOPBACK=y
|
|
CONFIG_PACKET=y
|
|
CONFIG_UNIX=y
|
|
CONFIG_INET=y
|
|
CONFIG_IP_MULTICAST=y
|
|
CONFIG_IP_ADVANCED_ROUTER=y
|
|
CONFIG_IP_MULTIPLE_TABLES=y
|
|
CONFIG_IP_ROUTE_MULTIPATH=y
|
|
CONFIG_IPV6=y
|
|
CONFIG_BRIDGE=y
|
|
|
|
# Netfilter (for iptables REDIRECT in proxy mode)
|
|
CONFIG_NETFILTER=y
|
|
CONFIG_NETFILTER_ADVANCED=y
|
|
CONFIG_NETFILTER_XTABLES=y
|
|
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
|
|
CONFIG_NETFILTER_XT_MATCH_STATE=y
|
|
CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
|
|
CONFIG_NF_CONNTRACK=y
|
|
CONFIG_NF_NAT=y
|
|
CONFIG_NF_TABLES=y
|
|
CONFIG_NF_TABLES_INET=y
|
|
CONFIG_NFT_NAT=y
|
|
CONFIG_NFT_REDIR=y
|
|
CONFIG_NFT_CT=y
|
|
CONFIG_IP_NF_IPTABLES=y
|
|
CONFIG_IP_NF_FILTER=y
|
|
CONFIG_IP_NF_NAT=y
|
|
CONFIG_IP_NF_TARGET_REDIRECT=y
|
|
CONFIG_IP_NF_TARGET_MASQUERADE=y
|
|
|
|
# CRC32 (required by ext4)
|
|
CONFIG_CRC32=y
|
|
CONFIG_LIBCRC32C=y
|
|
CONFIG_CRYPTO_CRC32C=y
|
|
|
|
# TTY / Console
|
|
CONFIG_TTY=y
|
|
CONFIG_VT=y
|
|
CONFIG_SERIAL_EARLYCON=y
|
|
CONFIG_HVC_DRIVER=y
|
|
CONFIG_PRINTK=y
|
|
|
|
# PTY support (for shell/TTY exec)
|
|
CONFIG_UNIX98_PTYS=y
|
|
|
|
# Cgroups (future container features)
|
|
CONFIG_CGROUPS=y
|
|
CONFIG_CGROUP_CPUACCT=y
|
|
CONFIG_CGROUP_DEVICE=y
|
|
CONFIG_CGROUP_FREEZER=y
|
|
CONFIG_CGROUP_PIDS=y
|
|
CONFIG_CGROUP_SCHED=y
|
|
CONFIG_MEMCG=y
|
|
|
|
# Namespaces
|
|
CONFIG_NAMESPACES=y
|
|
CONFIG_UTS_NS=y
|
|
CONFIG_IPC_NS=y
|
|
CONFIG_PID_NS=y
|
|
CONFIG_NET_NS=y
|
|
CONFIG_USER_NS=y
|
|
|
|
# inotify (used by many tools)
|
|
CONFIG_INOTIFY_USER=y
|
|
|
|
# RTC (PL031 — exposed by Virtualization.framework device tree)
|
|
CONFIG_RTC_CLASS=y
|
|
CONFIG_RTC_HCTOSYS=y
|
|
CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
|
|
CONFIG_RTC_INTF_SYSFS=y
|
|
CONFIG_RTC_INTF_DEV=y
|
|
CONFIG_RTC_DRV_PL031=y
|
|
|
|
# Disable unnecessary subsystems
|
|
# CONFIG_SOUND is not set
|
|
# CONFIG_USB_SUPPORT is not set
|
|
# CONFIG_WLAN is not set
|
|
# CONFIG_WIRELESS is not set
|
|
# CONFIG_INPUT_KEYBOARD is not set
|
|
# CONFIG_INPUT_MOUSE is not set
|
|
# CONFIG_INPUT_TOUCHSCREEN is not set
|
|
# CONFIG_SCSI is not set
|
|
# CONFIG_ATA is not set
|
|
# CONFIG_DRM is not set
|
|
# CONFIG_FB is not set
|
|
# CONFIG_VGA_CONSOLE is not set
|
|
# CONFIG_SELINUX is not set
|
|
# CONFIG_SECURITY is not set
|
|
# CONFIG_AUDIT is not set
|
|
# CONFIG_SWAP is not set
|
|
# CONFIG_NFS_FS is not set
|
|
# CONFIG_CIFS is not set
|
|
# CONFIG_BTRFS_FS is not set
|
|
# CONFIG_XFS_FS is not set
|
|
# CONFIG_BLK_DEV_LOOP is not set
|
|
# CONFIG_BLK_DEV_RAM is not set
|
|
# CONFIG_PCMCIA is not set
|
|
# CONFIG_HWMON is not set
|
|
# CONFIG_THERMAL is not set
|
|
# CONFIG_WATCHDOG is not set
|
|
# CONFIG_MEDIA_SUPPORT is not set
|
|
# CONFIG_POWER_SUPPLY is not set
|
|
# CONFIG_MD is not set
|
|
|
|
# Cgroup v2 controllers k3s requires (cpuset is fatal when missing)
|
|
CONFIG_CPUSETS=y
|
|
CONFIG_PROC_PID_CPUSET=y
|
|
CONFIG_FAIR_GROUP_SCHED=y
|
|
CONFIG_CFS_BANDWIDTH=y
|
|
CONFIG_BLK_CGROUP=y
|
|
CONFIG_CGROUP_BPF=y
|
|
CONFIG_BPF=y
|
|
CONFIG_BPF_SYSCALL=y
|
|
|
|
# Container runtime (runc: session keyring, seccomp, cgroup2 device bpf)
|
|
CONFIG_KEYS=y
|
|
CONFIG_SECCOMP=y
|
|
CONFIG_SECCOMP_FILTER=y
|
|
|
|
# Pod networking: flannel vxlan, CNI bridge/veth, kube-proxy iptables
|
|
CONFIG_VETH=y
|
|
CONFIG_VXLAN=y
|
|
CONFIG_BRIDGE_NETFILTER=y
|
|
CONFIG_NETFILTER_XT_MARK=y
|
|
CONFIG_NETFILTER_XT_NAT=y
|
|
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
|
|
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
|
|
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
|
|
CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
|
|
CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y
|
|
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
|
|
CONFIG_IP_NF_MANGLE=y
|
|
CONFIG_IP_NF_RAW=y
|
|
CONFIG_IP_NF_TARGET_REJECT=y
|
|
CONFIG_IP6_NF_IPTABLES=y
|
|
CONFIG_IP6_NF_FILTER=y
|
|
CONFIG_IP6_NF_MANGLE=y
|
|
CONFIG_IP6_NF_NAT=y
|
|
CONFIG_IP6_NF_TARGET_MASQUERADE=y
|
|
CONFIG_IP6_NF_TARGET_REJECT=y
|
|
CONFIG_NFT_COMPAT=y
|
|
CONFIG_NFT_MASQ=y
|
|
CONFIG_NFT_REJECT=y
|