diff options
41 files changed, 380 insertions, 0 deletions
diff --git a/fragments/base/common b/fragments/base/common new file mode 100644 index 0000000..1a26566 --- /dev/null +++ b/fragments/base/common @@ -0,0 +1,54 @@ +CONFIG_SMP=y + +CONFIG_SYSVIPC=y +CONFIG_POSIX_MQUEUE=y + +CONFIG_NO_HZ_IDLE=y +CONFIG_HIGH_RES_TIMERS=y + +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y + +CONFIG_SCHED_AUTOGROUP=y + +# We only really care about standard PC systems +# CONFIG_X86_EXTENDED_PLATFORM is not set + +CONFIG_NUMA=y + +# The following can be disabled since it is a legacy option, +# the kernel will use X86_64_ACPI_NUMA instead +# CONFIG_AMD_NUMA is not set + +CONFIG_PARTITION_ADVANCED=y + +# The kernel cites 65536 as a "reasonable" value here. +CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 + +# We want to support transparent hugepages, though want applications +# to ask for them specifically with madvise +CONFIG_TRANSPARENT_HUGEPAGE=y +CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y + +CONFIG_MD=y +CONFIG_BLK_DEV_DM=y +CONFIG_BLK_DEV_LOOP=y + +# CONFIG_LEGACY_PTYS is not set + +CONFIG_HPET=y + +CONFIG_HIDRAW=y + +CONFIG_EDAC=y +CONFIG_EDAC_SBRIDGE=y +# CONFIG_EDAC_LEGACY_SYSFS is not set + +CONFIG_RTC_CLASS=y + +# CONFIG_UNUSED_SYMBOLS is not set + +# https://lwn.net/Articles/681763/ +CONFIG_BLK_WBT=y +CONFIG_BLK_WBT_SQ=y +CONFIG_BLK_WBT_MQ=y diff --git a/fragments/base/crypto b/fragments/base/crypto new file mode 100644 index 0000000..0f63cdd --- /dev/null +++ b/fragments/base/crypto @@ -0,0 +1,4 @@ +CONFIG_DM_CRYPT=y +CONFIG_CRYPTO_AES_X86_64=y +CONFIG_CRYPTO_USER_API_HASH=y +CONFIG_CRYPTO_USER_API_SKCIPHER=y diff --git a/fragments/base/modules b/fragments/base/modules new file mode 100644 index 0000000..a3f5b21 --- /dev/null +++ b/fragments/base/modules @@ -0,0 +1,2 @@ +CONFIG_MODULES=y +CONFIG_MODULE_UNLOAD=y diff --git a/fragments/base/net b/fragments/base/net new file mode 100644 index 0000000..b0aefe2 --- /dev/null +++ b/fragments/base/net @@ -0,0 +1,40 @@ +CONFIG_NET=y + +# "Foo over UDP" is needed for any application that wants to tunnel +# traffic over UDP, like wireguard et al +CONFIG_NET_FOU=y + +CONFIG_RFKILL=y + +CONFIG_NETDEVICES=y +CONFIG_TUN=m +CONFIG_VETH=m + +CONFIG_VLAN_8021Q=y +CONFIG_BRIDGE=y + +CONFIG_PACKET=y +CONFIG_PACKET_DIAG=y +CONFIG_NETLINK_DIAG=y +CONFIG_UNIX=y +CONFIG_UNIX_DIAG=y +CONFIG_INET=y +CONFIG_XFRM_USER=y +CONFIG_IP_ADVANCED_ROUTER=y +CONFIG_IP_MULTIPLE_TABLES=y +CONFIG_IP_ROUTE_VERBOSE=y +CONFIG_SYN_COOKIES=y +CONFIG_INET_UDP_DIAG=y +CONFIG_INET_RAW_DIAG=y + +# The following options enable support for IPsec and are enabled by default. +# We think wireguard is the superior solution, and hence disable them. +# CONFIG_INET_XFRM_MODE_TRANSPORT is not set +# CONFIG_INET_XFRM_MODE_TUNNEL is not set +# CONFIG_INET_XFRM_MODE_BEET is not set +# CONFIG_INET6_XFRM_MODE_TRANSPORT is not set +# CONFIG_INET6_XFRM_MODE_TUNNEL is not set +# CONFIG_INET6_XFRM_MODE_BEET is not set + +# We do not need IPv6-in-IPv4 +# CONFIG_IPV6_SIT is not set diff --git a/fragments/base/security b/fragments/base/security new file mode 100644 index 0000000..5d8b95c --- /dev/null +++ b/fragments/base/security @@ -0,0 +1,14 @@ +CONFIG_REFCOUNT_FULL=y +CONFIG_GCC_PLUGINS=y +CONFIG_GCC_PLUGIN_STRUCTLEAK=y +CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y + +# CONFIG_COMPAT_BRK is not set +# CONFIG_SLAB_MERGE_DEFAULT is not set +CONFIG_SLAB_FREELIST_RANDOM=y +CONFIG_SLAB_FREELIST_HARDENED=y + +CONFIG_HARDENED_USERCOPY=y +CONFIG_FORTIFY_SOURCE=y + +CONFIG_IO_STRICT_DEVMEM=y diff --git a/fragments/boot/efi b/fragments/boot/efi new file mode 100644 index 0000000..c3dd195 --- /dev/null +++ b/fragments/boot/efi @@ -0,0 +1,5 @@ +CONFIG_EFI=y +CONFIG_EFI_STUB=y +CONFIG_EFI_VARS=y +CONFIG_RESET_ATTACK_MITIGATION=y +CONFIG_EFIVAR_FS=y diff --git a/fragments/boot/initrd b/fragments/boot/initrd new file mode 100644 index 0000000..f97f7a0 --- /dev/null +++ b/fragments/boot/initrd @@ -0,0 +1 @@ +CONFIG_BLK_DEV_INITRD=y diff --git a/fragments/cpu/amd b/fragments/cpu/amd new file mode 100644 index 0000000..f0dfd33 --- /dev/null +++ b/fragments/cpu/amd @@ -0,0 +1,13 @@ +CONFIG_GENERIC_CPU=y +CONFIG_X86_ACPI_CPUFREQ=y +CONFIG_X86_AMD_PLATFORM_DEVICE=y +CONFIG_PERF_EVENTS_AMD_POWER=y +CONFIG_MICROCODE_AMD=y + +CONFIG_SENSORS_K10TEMP=y +CONFIG_SENSORS_FAM15H_POWER=y + +CONFIG_EDAC_AMD64=y + +CONFIG_AMD_IOMMU=y +CONFIG_AMD_IOMMU_V2=y diff --git a/fragments/cpu/intel b/fragments/cpu/intel new file mode 100644 index 0000000..c64743e --- /dev/null +++ b/fragments/cpu/intel @@ -0,0 +1,7 @@ +CONFIG_INTEL_IDLE=y +CONFIG_INTEL_IOMMU=y +CONFIG_MCORE2=y + +CONFIG_X86_INTEL_TSX_MODE_ON=y + +CONFIG_SENSORS_CORETEMP=y diff --git a/fragments/devices/input/xpad b/fragments/devices/input/xpad new file mode 100644 index 0000000..38ed99f --- /dev/null +++ b/fragments/devices/input/xpad @@ -0,0 +1,3 @@ +CONFIG_INPUT_JOYSTICK=y +CONFIG_JOYSTICK_XPAD=m +CONFIG_JOYSTICK_XPAD_FF=y diff --git a/fragments/devices/net/r8169 b/fragments/devices/net/r8169 new file mode 100644 index 0000000..811d42a --- /dev/null +++ b/fragments/devices/net/r8169 @@ -0,0 +1 @@ +CONFIG_R8169=y diff --git a/fragments/devices/net/tigon3 b/fragments/devices/net/tigon3 new file mode 100644 index 0000000..7659e32 --- /dev/null +++ b/fragments/devices/net/tigon3 @@ -0,0 +1 @@ +CONFIG_TIGON3=y diff --git a/fragments/devices/usb/bluetooth b/fragments/devices/usb/bluetooth new file mode 100644 index 0000000..87df533 --- /dev/null +++ b/fragments/devices/usb/bluetooth @@ -0,0 +1 @@ +CONFIG_BT_HCIBTUSB=m diff --git a/fragments/devices/usb/sound b/fragments/devices/usb/sound new file mode 100644 index 0000000..fdd348d --- /dev/null +++ b/fragments/devices/usb/sound @@ -0,0 +1 @@ +CONFIG_SND_USB_AUDIO=y diff --git a/fragments/drivers/i2c b/fragments/drivers/i2c new file mode 100644 index 0000000..5fd23e6 --- /dev/null +++ b/fragments/drivers/i2c @@ -0,0 +1,2 @@ +CONFIG_I2C=y +CONFIG_I2C_CHARDEV=y diff --git a/fragments/drivers/pci b/fragments/drivers/pci new file mode 100644 index 0000000..56b5a87 --- /dev/null +++ b/fragments/drivers/pci @@ -0,0 +1,2 @@ +CONFIG_PCIEPORTBUS=y +CONFIG_PCI_MSI=y diff --git a/fragments/drivers/raid b/fragments/drivers/raid new file mode 100644 index 0000000..2ebb46d --- /dev/null +++ b/fragments/drivers/raid @@ -0,0 +1,7 @@ +CONFIG_BLK_DEV_MD=y +CONFIG_MD_AUTODETECT=y +CONFIG_MD_LINEAR=y +CONFIG_MD_RAID0=y +CONFIG_MD_RAID1=y +CONFIG_MD_RAID10=y +CONFIG_MD_RAID456=y diff --git a/fragments/drivers/sata b/fragments/drivers/sata new file mode 100644 index 0000000..bd4fc1d --- /dev/null +++ b/fragments/drivers/sata @@ -0,0 +1,7 @@ +CONFIG_ATA=y +# CONFIG_ATA_SFF is not set +CONFIG_BLK_DEV_SD=y +CONFIG_BLK_DEV_SR=y +CONFIG_CHR_DEV_SG=y +CONFIG_SATA_AHCI=y +CONFIG_SCSI_CONSTANTS=y diff --git a/fragments/drivers/sound b/fragments/drivers/sound new file mode 100644 index 0000000..9ea12a5 --- /dev/null +++ b/fragments/drivers/sound @@ -0,0 +1,7 @@ +CONFIG_SOUND=y +CONFIG_SND=y +CONFIG_SND_HRTIMER=y +# CONFIG_SND_SUPPORT_OLD_API is not set + +# pulseaudio recommends the following +CONFIG_SND_HDA_PREALLOC_SIZE=2048 diff --git a/fragments/drivers/usb b/fragments/drivers/usb new file mode 100644 index 0000000..764451d --- /dev/null +++ b/fragments/drivers/usb @@ -0,0 +1,11 @@ +CONFIG_USB=y +CONFIG_USB_HID=y +CONFIG_USB_HIDDEV=y +CONFIG_USB_ANNOUNCE_NEW_DEVICES=y +CONFIG_USB_MON=y +CONFIG_USB_XHCI_HCD=y +CONFIG_USB_EHCI_HCD=y +CONFIG_USB_EHCI_ROOT_HUB_TT=y +CONFIG_USB_OHCI_HCD=y +CONFIG_USB_UHCI_HCD=y +CONFIG_USB_STORAGE=y diff --git a/fragments/fs/cifs b/fragments/fs/cifs new file mode 100644 index 0000000..2512c7c --- /dev/null +++ b/fragments/fs/cifs @@ -0,0 +1,4 @@ +CONFIG_CIFS=y +CONFIG_CIFS_XATTR=y +CONFIG_CIFS_POSIX=y +CONFIG_CIFS_ACL=y diff --git a/fragments/fs/devtmpfs b/fragments/fs/devtmpfs new file mode 100644 index 0000000..5e9cf98 --- /dev/null +++ b/fragments/fs/devtmpfs @@ -0,0 +1,2 @@ +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y diff --git a/fragments/fs/ext4 b/fragments/fs/ext4 new file mode 100644 index 0000000..c229a59 --- /dev/null +++ b/fragments/fs/ext4 @@ -0,0 +1,4 @@ +CONFIG_EXT4_FS=y +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_EXT4_ENCRYPTION=y diff --git a/fragments/fs/foreign b/fragments/fs/foreign new file mode 100644 index 0000000..6efa183 --- /dev/null +++ b/fragments/fs/foreign @@ -0,0 +1,9 @@ +CONFIG_ISO9660_FS=y +CONFIG_JOLIET=y +CONFIG_ZISOFS=y +CONFIG_UDF_FS=y +CONFIG_VFAT_FS=y + +CONFIG_NLS_CODEPAGE_437=y +CONFIG_NLS_ISO8859_1=y +CONFIG_NLS_UTF8=y diff --git a/fragments/fs/fuse b/fragments/fs/fuse new file mode 100644 index 0000000..43e95f2 --- /dev/null +++ b/fragments/fs/fuse @@ -0,0 +1 @@ +CONFIG_FUSE_FS=y diff --git a/fragments/fs/tmpfs b/fragments/fs/tmpfs new file mode 100644 index 0000000..9b5a40b --- /dev/null +++ b/fragments/fs/tmpfs @@ -0,0 +1,2 @@ +CONFIG_TMPFS=y +CONFIG_TMPFS_POSIX_ACL=y diff --git a/fragments/hosts/coleridge b/fragments/hosts/coleridge new file mode 100644 index 0000000..8ad4c9b --- /dev/null +++ b/fragments/hosts/coleridge @@ -0,0 +1 @@ +CONFIG_EXTRA_FIRMWARE="amd-ucode/microcode_amd_fam15h.bin" diff --git a/fragments/hosts/nabokov b/fragments/hosts/nabokov new file mode 100644 index 0000000..f24a95e --- /dev/null +++ b/fragments/hosts/nabokov @@ -0,0 +1,3 @@ +CONFIG_CMDLINE_BOOL=y +CONFIG_CMDLINE="root=PARTUUID=580f465c-a0ed-324d-8a10-04bb7027b492" +CONFIG_EXTRA_FIRMWARE="intel-ucode/06-3c-03" diff --git a/fragments/net/bluetooth b/fragments/net/bluetooth new file mode 100644 index 0000000..da900ed --- /dev/null +++ b/fragments/net/bluetooth @@ -0,0 +1,3 @@ +CONFIG_BT=m +CONFIG_BT_RFCOMM=m +CONFIG_BT_HIDP=y diff --git a/fragments/net/nftables b/fragments/net/nftables new file mode 100644 index 0000000..148d48f --- /dev/null +++ b/fragments/net/nftables @@ -0,0 +1,67 @@ +CONFIG_NETFILTER=y +CONFIG_NETFILTER_NETLINK_ACCT=y +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_LOG=y +CONFIG_NETFILTER_NETLINK_OSF=y +CONFIG_NF_CONNTRACK=y +# CONFIG_NF_CONNTRACK_PROCFS is not set +CONFIG_NF_CONNTRACK_MARK=y +CONFIG_NF_CONNTRACK_LABELS=y +# CONFIG_NF_CT_PROTO_DCCP is not set +# CONFIG_NF_CT_PROTO_SCTP is not set +# CONFIG_NF_CT_PROTO_UDPLITE is not set +CONFIG_NF_TABLES=y +CONFIG_NF_TABLES_SET=y +CONFIG_NF_TABLES_INET=y +CONFIG_NF_TABLES_NETDEV=y +CONFIG_NFT_NUMGEN=y +CONFIG_NFT_CT=y +CONFIG_NFT_COUNTER=y +CONFIG_NFT_CONNLIMIT=y +CONFIG_NFT_LOG=y +CONFIG_NFT_LIMIT=y +CONFIG_NFT_MASQ=y +CONFIG_NFT_REDIR=y +CONFIG_NFT_NAT=y +CONFIG_NFT_TUNNEL=y +CONFIG_NFT_OBJREF=y +CONFIG_NFT_QUEUE=y +CONFIG_NFT_QUOTA=y +CONFIG_NFT_REJECT=y +CONFIG_NFT_HASH=y +CONFIG_NFT_SOCKET=y +CONFIG_NFT_OSF=y +CONFIG_NFT_TPROXY=y +CONFIG_NF_DUP_NETDEV=y +CONFIG_NFT_DUP_NETDEV=y +CONFIG_NFT_FWD_NETDEV=y +CONFIG_NF_FLOW_TABLE_INET=y +CONFIG_NF_FLOW_TABLE=y +CONFIG_NFT_CHAIN_ROUTE_IPV4=y +CONFIG_NFT_DUP_IPV4=y +CONFIG_NFT_FIB_INET=y +CONFIG_NFT_FIB_IPV4=y +CONFIG_NFT_FLOW_OFFLOAD=y +CONFIG_NF_TABLES_ARP=y +CONFIG_NF_FLOW_TABLE_IPV4=y +CONFIG_NF_LOG_ARP=y +CONFIG_NF_LOG_IPV4=y +CONFIG_NF_NAT_IPV4=y +CONFIG_NFT_CHAIN_NAT_IPV4=y +CONFIG_NFT_MASQ_IPV4=y +CONFIG_NFT_REDIR_IPV4=y +CONFIG_NFT_CHAIN_ROUTE_IPV6=y +CONFIG_NFT_DUP_IPV6=y +CONFIG_NFT_FIB_IPV6=y +CONFIG_NFT_FIB_NETDEV=y +CONFIG_NF_FLOW_TABLE_IPV6=y +CONFIG_NF_LOG_IPV6=y +CONFIG_NF_NAT_IPV6=y +CONFIG_NFT_CHAIN_NAT_IPV6=y +CONFIG_NFT_MASQ_IPV6=y +CONFIG_NFT_REDIR_IPV6=y +CONFIG_BRIDGE_NETFILTER=y +CONFIG_BRIDGE_VLAN_FILTERING=y +CONFIG_NF_TABLES_BRIDGE=y +CONFIG_NFT_BRIDGE_REJECT=y +CONFIG_NF_LOG_BRIDGE=y diff --git a/fragments/profile/desktop b/fragments/profile/desktop new file mode 100644 index 0000000..8d035c2 --- /dev/null +++ b/fragments/profile/desktop @@ -0,0 +1,7 @@ +CONFIG_PREEMPT_VOLUNTARY=y + +CONFIG_HZ_1000=y +CONFIG_INPUT_MOUSEDEV=y +CONFIG_INPUT_EVDEV=y + +CONFIG_DRM=y diff --git a/fragments/profile/server b/fragments/profile/server new file mode 100644 index 0000000..36580b4 --- /dev/null +++ b/fragments/profile/server @@ -0,0 +1,5 @@ +CONFIG_PREEMPT_NONE=y + +CONFIG_HZ_300=y + +# CONFIG_SUSPEND is not set diff --git a/fragments/profile/vm b/fragments/profile/vm new file mode 100644 index 0000000..bf6bc2d --- /dev/null +++ b/fragments/profile/vm @@ -0,0 +1,9 @@ +CONFIG_KVM=y +CONFIG_KVM_INTEL=y +CONFIG_KVM_AMD=y +CONFIG_VHOST_NET=m + +CONFIG_MACVLAN=m +CONFIG_MACVTAP=m +CONFIG_IPVLAN=m +CONFIG_IPVTAP=m diff --git a/fragments/security/audit b/fragments/security/audit new file mode 100644 index 0000000..f594b65 --- /dev/null +++ b/fragments/security/audit @@ -0,0 +1,4 @@ +CONFIG_AUDIT=y +CONFIG_AUDITSYSCALL=y +CONFIG_AUDIT_WATCH=y +CONFIG_AUDIT_TREE=y diff --git a/fragments/security/cgroups b/fragments/security/cgroups new file mode 100644 index 0000000..e3ed289 --- /dev/null +++ b/fragments/security/cgroups @@ -0,0 +1,7 @@ +CONFIG_CGROUPS=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_PIDS=y +CONFIG_CGROUP_SCHED=y +CONFIG_MEMCG=y +CONFIG_MEMCG_SWAP=y +CONFIG_MEMCG_SWAP_ENABLED=y diff --git a/fragments/security/namespaces b/fragments/security/namespaces new file mode 100644 index 0000000..14935f8 --- /dev/null +++ b/fragments/security/namespaces @@ -0,0 +1,5 @@ +CONFIG_IPC_NS=y +CONFIG_NET_NS=y +CONFIG_PID_NS=y +CONFIG_USER_NS=y +CONFIG_UTS_NS=y diff --git a/merge.sh b/merge.sh new file mode 100755 index 0000000..69e3c37 --- /dev/null +++ b/merge.sh @@ -0,0 +1,23 @@ +#!/bin/sh + +errx() { + printf "$@" >&2 + exit 1 +} + +set -e + +host=${1:-$(hostname)} + +if ! test -r "kernfrag/templates/base"; then + errx "config: Could not find base template\n" +fi + +if ! test -r "kernfrag/templates/$host"; then + errx "config: Could not find template for '%s'\n" "$host" +fi + +printf "Starting merge for %s...\n\n" "$host" + +awk 'NF { printf "%s%s\0", "kernfrag/fragments/", $1 }' \ + "kernfrag/templates/base" "kernfrag/templates/$host" | xargs -0 scripts/kconfig/merge_config.sh diff --git a/templates/base b/templates/base new file mode 100644 index 0000000..f41d62b --- /dev/null +++ b/templates/base @@ -0,0 +1,16 @@ +base/common +base/crypto +base/modules +base/net +base/security +drivers/i2c +drivers/pci +drivers/sata +drivers/usb +fs/devtmpfs +fs/ext4 +fs/fuse +fs/tmpfs +net/nftables +security/cgroups +security/namespaces diff --git a/templates/coleridge b/templates/coleridge new file mode 100644 index 0000000..3261442 --- /dev/null +++ b/templates/coleridge @@ -0,0 +1,8 @@ +boot/initrd +cpu/amd +devices/net/r8169 +drivers/raid +hosts/coleridge +profile/server +profile/vm +security/audit diff --git a/templates/demeter b/templates/demeter new file mode 100644 index 0000000..5cd3804 --- /dev/null +++ b/templates/demeter @@ -0,0 +1,6 @@ +boot/initrd +cpu/intel +devices/net/tigon3 +drivers/raid +fs/cifs +profile/server diff --git a/templates/nabokov b/templates/nabokov new file mode 100644 index 0000000..fd3d4d3 --- /dev/null +++ b/templates/nabokov @@ -0,0 +1,11 @@ +cpu/intel +devices/input/xpad +devices/net/r8169 +devices/usb/bluetooth +devices/usb/sound +drivers/sound +fs/foreign +hosts/nabokov +net/bluetooth +profile/desktop +profile/vm |