2015-03-24 21:34:54 +00:00
|
|
|
/*
|
|
|
|
|
|
|
|
WARNING/NOTE: whenever you want to add an option here you need to
|
|
|
|
either
|
|
|
|
|
|
|
|
* mark it as an optional one with `?` suffix,
|
|
|
|
* or make sure it works for all the versions in nixpkgs,
|
|
|
|
* or check for which kernel versions it will work (using kernel
|
|
|
|
changelog, google or whatever) and mark it with `versionOlder` or
|
|
|
|
`versionAtLeast`.
|
|
|
|
|
|
|
|
Then do test your change by building all the kernels (or at least
|
2016-07-11 12:30:29 +00:00
|
|
|
their configs) in Nixpkgs or else you will guarantee lots and lots
|
2015-03-24 21:34:54 +00:00
|
|
|
of pain to users trying to switch to an older kernel because of some
|
|
|
|
hardware problems with a new one.
|
|
|
|
|
|
|
|
*/
|
|
|
|
|
2014-05-07 22:26:33 +00:00
|
|
|
{ stdenv, version, kernelPlatform, extraConfig, features }:
|
2013-07-31 21:56:48 +00:00
|
|
|
|
|
|
|
with stdenv.lib;
|
|
|
|
|
|
|
|
''
|
2016-02-01 16:54:35 +00:00
|
|
|
# Compress kernel modules for a sizable disk space savings.
|
|
|
|
${optionalString (versionAtLeast version "3.18") ''
|
|
|
|
MODULE_COMPRESS y
|
|
|
|
MODULE_COMPRESS_XZ y
|
|
|
|
''}
|
|
|
|
|
2016-11-23 00:05:28 +00:00
|
|
|
KERNEL_XZ y
|
|
|
|
|
2015-03-04 15:37:42 +00:00
|
|
|
# Debugging.
|
2013-07-31 21:56:48 +00:00
|
|
|
DEBUG_KERNEL y
|
2016-09-05 14:15:45 +00:00
|
|
|
DYNAMIC_DEBUG y
|
2013-07-31 21:56:48 +00:00
|
|
|
BACKTRACE_SELF_TEST n
|
|
|
|
DEBUG_DEVRES n
|
|
|
|
DEBUG_STACK_USAGE n
|
2016-08-28 23:17:45 +00:00
|
|
|
DEBUG_STACKOVERFLOW n
|
2013-07-31 21:56:48 +00:00
|
|
|
RCU_TORTURE_TEST n
|
|
|
|
SCHEDSTATS n
|
2013-07-31 22:50:48 +00:00
|
|
|
DETECT_HUNG_TASK y
|
2013-07-31 21:56:48 +00:00
|
|
|
|
2017-03-22 00:30:37 +00:00
|
|
|
${optionalString (versionOlder version "4.10") ''
|
|
|
|
CPU_NOTIFIER_ERROR_INJECT? n
|
|
|
|
''}
|
|
|
|
|
2017-03-10 23:19:34 +00:00
|
|
|
${optionalString (versionOlder version "4.11") ''
|
|
|
|
TIMER_STATS y
|
|
|
|
DEBUG_NX_TEST n
|
|
|
|
''}
|
|
|
|
|
2016-07-11 10:16:19 +00:00
|
|
|
# Bump the maximum number of CPUs to support systems like EC2 x1.*
|
|
|
|
# instances and Xeon Phi.
|
2016-12-26 23:51:23 +00:00
|
|
|
${optionalString (stdenv.system == "x86_64-linux" || stdenv.system == "aarch64-linux") ''
|
2016-07-11 10:16:19 +00:00
|
|
|
NR_CPUS 384
|
|
|
|
''}
|
|
|
|
|
2016-01-07 11:48:12 +00:00
|
|
|
# Unix domain sockets.
|
|
|
|
UNIX y
|
|
|
|
|
2015-03-04 15:37:42 +00:00
|
|
|
# Power management.
|
|
|
|
${optionalString (versionOlder version "3.19") ''
|
|
|
|
PM_RUNTIME y
|
|
|
|
''}
|
|
|
|
PM_ADVANCED_DEBUG y
|
2015-10-16 10:36:18 +00:00
|
|
|
${optionalString (versionAtLeast version "3.11") ''
|
|
|
|
X86_INTEL_LPSS y
|
|
|
|
''}
|
2015-03-04 15:37:42 +00:00
|
|
|
${optionalString (versionAtLeast version "3.10") ''
|
|
|
|
X86_INTEL_PSTATE y
|
|
|
|
''}
|
2015-03-04 16:04:02 +00:00
|
|
|
INTEL_IDLE y
|
|
|
|
CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
|
2015-03-04 15:37:42 +00:00
|
|
|
${optionalString (versionOlder version "3.10") ''
|
|
|
|
USB_SUSPEND y
|
|
|
|
''}
|
2016-07-11 12:19:55 +00:00
|
|
|
PM_WAKELOCKS y
|
2015-03-04 15:37:42 +00:00
|
|
|
|
2013-07-31 21:56:48 +00:00
|
|
|
# Support drivers that need external firmware.
|
|
|
|
STANDALONE n
|
|
|
|
|
2013-09-04 04:45:36 +00:00
|
|
|
# Make /proc/config.gz available.
|
2015-06-04 08:15:31 +00:00
|
|
|
IKCONFIG y
|
2013-07-31 21:56:48 +00:00
|
|
|
IKCONFIG_PROC y
|
|
|
|
|
|
|
|
# Optimize with -O2, not -Os.
|
|
|
|
CC_OPTIMIZE_FOR_SIZE n
|
|
|
|
|
|
|
|
# Enable the kernel's built-in memory tester.
|
|
|
|
MEMTEST y
|
|
|
|
|
|
|
|
# Include the CFQ I/O scheduler in the kernel, rather than as a
|
|
|
|
# module, so that the initrd gets a good I/O scheduler.
|
|
|
|
IOSCHED_CFQ y
|
|
|
|
BLK_CGROUP y # required by CFQ
|
|
|
|
|
|
|
|
# Enable NUMA.
|
|
|
|
NUMA? y
|
|
|
|
|
|
|
|
# Disable some expensive (?) features.
|
|
|
|
PM_TRACE_RTC n
|
|
|
|
|
|
|
|
# Enable various subsystems.
|
|
|
|
ACCESSIBILITY y # Accessibility support
|
|
|
|
AUXDISPLAY y # Auxiliary Display support
|
|
|
|
DONGLE y # Serial dongle support
|
|
|
|
HIPPI y
|
|
|
|
MTD_COMPLEX_MAPPINGS y # needed for many devices
|
|
|
|
SCSI_LOWLEVEL y # enable lots of SCSI devices
|
|
|
|
SCSI_LOWLEVEL_PCMCIA y
|
2014-10-17 20:31:08 +00:00
|
|
|
SCSI_SAS_ATA y # added to enable detection of hard drive
|
2013-07-31 21:56:48 +00:00
|
|
|
SPI y # needed for many devices
|
|
|
|
SPI_MASTER y
|
|
|
|
WAN y
|
|
|
|
|
|
|
|
# Networking options.
|
2016-08-29 00:01:25 +00:00
|
|
|
NET y
|
2013-07-31 21:56:48 +00:00
|
|
|
IP_PNP n
|
2014-01-20 03:35:24 +00:00
|
|
|
${optionalString (versionOlder version "3.13") ''
|
2014-11-10 19:21:28 +00:00
|
|
|
IPV6_PRIVACY y
|
2014-01-20 03:35:24 +00:00
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
NETFILTER_ADVANCED y
|
2016-08-05 01:39:17 +00:00
|
|
|
IP_ROUTE_VERBOSE y
|
|
|
|
IP_MROUTE_MULTIPLE_TABLES y
|
2013-07-31 21:56:48 +00:00
|
|
|
IP_VS_PROTO_TCP y
|
|
|
|
IP_VS_PROTO_UDP y
|
|
|
|
IP_VS_PROTO_ESP y
|
|
|
|
IP_VS_PROTO_AH y
|
|
|
|
IP_DCCP_CCID3 n # experimental
|
2017-03-04 02:19:58 +00:00
|
|
|
IP_MULTICAST y
|
2016-08-05 01:39:17 +00:00
|
|
|
IPV6_ROUTER_PREF y
|
|
|
|
IPV6_ROUTE_INFO y
|
|
|
|
IPV6_OPTIMISTIC_DAD y
|
|
|
|
IPV6_MULTIPLE_TABLES y
|
|
|
|
IPV6_SUBTREES y
|
|
|
|
IPV6_MROUTE y
|
|
|
|
IPV6_MROUTE_MULTIPLE_TABLES y
|
|
|
|
IPV6_PIMSM_V2 y
|
2016-11-17 06:48:44 +00:00
|
|
|
${optionalString (versionAtLeast version "4.7") ''
|
|
|
|
IPV6_FOU_TUNNEL m
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
CLS_U32_PERF y
|
|
|
|
CLS_U32_MARK y
|
2014-11-10 19:21:28 +00:00
|
|
|
${optionalString (stdenv.system == "x86_64-linux") ''
|
|
|
|
BPF_JIT y
|
|
|
|
''}
|
2016-04-06 13:25:14 +00:00
|
|
|
${optionalString (versionAtLeast version "4.4") ''
|
|
|
|
NET_CLS_BPF m
|
|
|
|
NET_ACT_BPF m
|
|
|
|
''}
|
2016-08-05 01:39:17 +00:00
|
|
|
L2TP_V3 y
|
|
|
|
L2TP_IP m
|
|
|
|
L2TP_ETH m
|
|
|
|
BRIDGE_VLAN_FILTERING y
|
2017-01-17 23:21:08 +00:00
|
|
|
BONDING m
|
2017-03-11 06:15:47 +00:00
|
|
|
NET_L3_MASTER_DEV? y
|
|
|
|
NET_FOU_IP_TUNNELS? y
|
2013-07-31 21:56:48 +00:00
|
|
|
|
|
|
|
# Wireless networking.
|
nixos: make several kernel common-config options optional
Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.
The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.
This is really just an arbitrary picking at the moment, but it should be
OK.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-17 23:30:51 +00:00
|
|
|
CFG80211_WEXT? y # Without it, ipw2200 drivers don't build
|
|
|
|
IPW2100_MONITOR? y # support promiscuous mode
|
|
|
|
IPW2200_MONITOR? y # support promiscuous mode
|
|
|
|
HOSTAP_FIRMWARE? y # Support downloading firmware images with Host AP driver
|
|
|
|
HOSTAP_FIRMWARE_NVRAM? y
|
|
|
|
ATH9K_PCI? y # Detect Atheros AR9xxx cards on PCI(e) bus
|
|
|
|
ATH9K_AHB? y # Ditto, AHB bus
|
2016-07-11 12:19:55 +00:00
|
|
|
B43_PHY_HT? y
|
nixos: make several kernel common-config options optional
Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.
The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.
This is really just an arbitrary picking at the moment, but it should be
OK.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-17 23:30:51 +00:00
|
|
|
BCMA_HOST_PCI? y
|
2013-07-31 21:56:48 +00:00
|
|
|
|
|
|
|
# Enable various FB devices.
|
|
|
|
FB y
|
|
|
|
FB_EFI y
|
|
|
|
FB_NVIDIA_I2C y # Enable DDC Support
|
|
|
|
FB_RIVA_I2C y
|
|
|
|
FB_ATY_CT y # Mach64 CT/VT/GT/LT (incl. 3D RAGE) support
|
|
|
|
FB_ATY_GX y # Mach64 GX support
|
|
|
|
FB_SAVAGE_I2C y
|
|
|
|
FB_SAVAGE_ACCEL y
|
|
|
|
FB_SIS_300 y
|
|
|
|
FB_SIS_315 y
|
|
|
|
FB_3DFX_ACCEL y
|
2015-06-03 20:43:17 +00:00
|
|
|
FB_VESA y
|
|
|
|
FRAMEBUFFER_CONSOLE y
|
2016-01-07 15:47:50 +00:00
|
|
|
FRAMEBUFFER_CONSOLE_ROTATION y
|
2016-07-11 12:19:55 +00:00
|
|
|
${optionalString (stdenv.system == "i686-linux") ''
|
2013-09-04 04:49:22 +00:00
|
|
|
FB_GEODE y
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
|
|
|
|
# Video configuration.
|
|
|
|
# Enable KMS for devices whose X.org driver supports it.
|
2016-01-10 19:07:45 +00:00
|
|
|
${optionalString (versionOlder version "4.3" && !(features.chromiumos or false)) ''
|
2015-09-21 19:42:00 +00:00
|
|
|
DRM_I915_KMS y
|
|
|
|
''}
|
2015-08-04 20:38:38 +00:00
|
|
|
# Allow specifying custom EDID on the kernel command line
|
|
|
|
DRM_LOAD_EDID_FIRMWARE y
|
2016-07-11 12:19:55 +00:00
|
|
|
VGA_SWITCHEROO y # Hybrid graphics support
|
2016-08-04 22:14:12 +00:00
|
|
|
DRM_GMA600 y
|
|
|
|
DRM_GMA3600 y
|
2016-10-18 14:11:05 +00:00
|
|
|
${optionalString (versionAtLeast version "4.5" && (versionOlder version "4.9")) ''
|
2016-08-26 05:32:05 +00:00
|
|
|
DRM_AMD_POWERPLAY y # necessary for amdgpu polaris support
|
|
|
|
''}
|
2017-01-15 22:29:50 +00:00
|
|
|
${optionalString (versionAtLeast version "4.9") ''
|
2017-02-20 12:29:47 +00:00
|
|
|
DRM_AMDGPU_SI y # (experimental) amdgpu support for verde and newer chipsets
|
2017-01-15 22:29:50 +00:00
|
|
|
DRM_AMDGPU_CIK y # (stable) amdgpu support for bonaire and newer chipsets
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
|
|
|
|
# Sound.
|
2014-04-18 19:06:34 +00:00
|
|
|
SND_DYNAMIC_MINORS y
|
2013-07-31 21:56:48 +00:00
|
|
|
SND_AC97_POWER_SAVE y # AC97 Power-Saving Mode
|
|
|
|
SND_HDA_INPUT_BEEP y # Support digital beep via input layer
|
|
|
|
SND_USB_CAIAQ_INPUT y
|
|
|
|
PSS_MIXER y # Enable PSS mixer (Beethoven ADSP-16 and other compatible)
|
|
|
|
|
|
|
|
# USB serial devices.
|
|
|
|
USB_SERIAL_GENERIC y # USB Generic Serial Driver
|
|
|
|
USB_SERIAL_KEYSPAN_MPR y # include firmware for various USB serial devices
|
|
|
|
USB_SERIAL_KEYSPAN_USA28 y
|
|
|
|
USB_SERIAL_KEYSPAN_USA28X y
|
|
|
|
USB_SERIAL_KEYSPAN_USA28XA y
|
|
|
|
USB_SERIAL_KEYSPAN_USA28XB y
|
|
|
|
USB_SERIAL_KEYSPAN_USA19 y
|
|
|
|
USB_SERIAL_KEYSPAN_USA18X y
|
|
|
|
USB_SERIAL_KEYSPAN_USA19W y
|
|
|
|
USB_SERIAL_KEYSPAN_USA19QW y
|
|
|
|
USB_SERIAL_KEYSPAN_USA19QI y
|
|
|
|
USB_SERIAL_KEYSPAN_USA49W y
|
|
|
|
USB_SERIAL_KEYSPAN_USA49WLC y
|
|
|
|
|
|
|
|
# Filesystem options - in particular, enable extended attributes and
|
|
|
|
# ACLs for all filesystems that support them.
|
2015-02-12 18:39:44 +00:00
|
|
|
FANOTIFY y
|
2016-08-29 00:01:25 +00:00
|
|
|
TMPFS y
|
2017-01-17 23:21:08 +00:00
|
|
|
TMPFS_POSIX_ACL y
|
2016-10-19 13:39:00 +00:00
|
|
|
FS_ENCRYPTION? m
|
2013-07-31 21:56:48 +00:00
|
|
|
EXT2_FS_XATTR y
|
|
|
|
EXT2_FS_POSIX_ACL y
|
2014-08-18 12:33:09 +00:00
|
|
|
EXT2_FS_SECURITY y
|
2015-03-04 14:38:17 +00:00
|
|
|
${optionalString (versionOlder version "4.0") ''
|
|
|
|
EXT2_FS_XIP y # Ext2 execute in place support
|
|
|
|
''}
|
2014-08-18 12:33:09 +00:00
|
|
|
EXT3_FS_POSIX_ACL y
|
|
|
|
EXT3_FS_SECURITY y
|
2013-07-31 21:56:48 +00:00
|
|
|
EXT4_FS_POSIX_ACL y
|
2017-02-20 12:29:47 +00:00
|
|
|
EXT4_ENCRYPTION? ${if versionOlder version "4.8" then "m" else "y"}
|
2013-07-31 21:56:48 +00:00
|
|
|
EXT4_FS_SECURITY y
|
nixos: make several kernel common-config options optional
Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.
The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.
This is really just an arbitrary picking at the moment, but it should be
OK.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-17 23:30:51 +00:00
|
|
|
REISERFS_FS_XATTR? y
|
|
|
|
REISERFS_FS_POSIX_ACL? y
|
|
|
|
REISERFS_FS_SECURITY? y
|
|
|
|
JFS_POSIX_ACL? y
|
|
|
|
JFS_SECURITY? y
|
|
|
|
XFS_QUOTA? y
|
|
|
|
XFS_POSIX_ACL? y
|
|
|
|
XFS_RT? y # XFS Realtime subvolume support
|
|
|
|
OCFS2_DEBUG_MASKLOG? n
|
2013-07-31 21:56:48 +00:00
|
|
|
BTRFS_FS_POSIX_ACL y
|
nixos: make several kernel common-config options optional
Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.
The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.
This is really just an arbitrary picking at the moment, but it should be
OK.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-17 23:30:51 +00:00
|
|
|
UBIFS_FS_ADVANCED_COMPR? y
|
2016-10-19 13:39:00 +00:00
|
|
|
F2FS_FS m
|
|
|
|
F2FS_FS_SECURITY? y
|
|
|
|
F2FS_FS_ENCRYPTION? y
|
|
|
|
UDF_FS m
|
2016-03-27 02:06:58 +00:00
|
|
|
${optionalString (versionAtLeast version "4.0" && versionOlder version "4.6") ''
|
2015-05-15 23:33:45 +00:00
|
|
|
NFSD_PNFS y
|
|
|
|
''}
|
|
|
|
NFSD_V2_ACL y
|
|
|
|
NFSD_V3 y
|
|
|
|
NFSD_V3_ACL y
|
|
|
|
NFSD_V4 y
|
|
|
|
${optionalString (versionAtLeast version "3.11") ''
|
|
|
|
NFSD_V4_SECURITY_LABEL y
|
|
|
|
''}
|
|
|
|
NFS_FSCACHE y
|
2016-07-11 12:19:55 +00:00
|
|
|
NFS_SWAP y
|
2015-05-15 23:33:45 +00:00
|
|
|
NFS_V3_ACL y
|
2014-04-23 14:47:50 +00:00
|
|
|
${optionalString (versionAtLeast version "3.11") ''
|
|
|
|
NFS_V4_1 y # NFSv4.1 client support
|
|
|
|
NFS_V4_2 y
|
2015-05-15 23:33:45 +00:00
|
|
|
NFS_V4_SECURITY_LABEL y
|
2014-04-23 14:47:50 +00:00
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
CIFS_XATTR y
|
|
|
|
CIFS_POSIX y
|
|
|
|
CIFS_FSCACHE y
|
2016-09-05 10:05:32 +00:00
|
|
|
CIFS_STATS y
|
|
|
|
CIFS_WEAK_PW_HASH y
|
|
|
|
CIFS_UPCALL y
|
|
|
|
CIFS_ACL y
|
|
|
|
CIFS_DFS_UPCALL y
|
2016-11-07 07:43:34 +00:00
|
|
|
CIFS_SMB2 y
|
2014-11-08 10:44:19 +00:00
|
|
|
${optionalString (versionAtLeast version "3.12") ''
|
|
|
|
CEPH_FSCACHE y
|
|
|
|
''}
|
|
|
|
${optionalString (versionAtLeast version "3.14") ''
|
|
|
|
CEPH_FS_POSIX_ACL y
|
|
|
|
''}
|
2015-03-20 21:41:03 +00:00
|
|
|
${optionalString (versionAtLeast version "3.13") ''
|
|
|
|
SQUASHFS_FILE_DIRECT y
|
|
|
|
SQUASHFS_DECOMP_MULTI_PERCPU y
|
|
|
|
''}
|
2015-02-16 18:42:10 +00:00
|
|
|
SQUASHFS_XATTR y
|
|
|
|
SQUASHFS_ZLIB y
|
|
|
|
SQUASHFS_LZO y
|
|
|
|
SQUASHFS_XZ y
|
2015-03-20 21:41:03 +00:00
|
|
|
${optionalString (versionAtLeast version "3.19") ''
|
|
|
|
SQUASHFS_LZ4 y
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
|
2016-09-13 10:51:14 +00:00
|
|
|
# Native Language Support modules, needed by some filesystems
|
|
|
|
NLS y
|
|
|
|
NLS_DEFAULT utf8
|
|
|
|
NLS_UTF8 m
|
|
|
|
NLS_CODEPAGE_437 m # VFAT default for the codepage= mount option
|
|
|
|
NLS_ISO8859_1 m # VFAT default for the iocharset= mount option
|
|
|
|
|
2014-11-01 00:07:06 +00:00
|
|
|
# Runtime security tests
|
2017-03-22 00:30:37 +00:00
|
|
|
${optionalString (versionOlder version "4.11") ''
|
|
|
|
DEBUG_SET_MODULE_RONX? y # Detect writes to read-only module pages
|
|
|
|
''}
|
2014-11-01 00:07:06 +00:00
|
|
|
|
2013-07-31 21:56:48 +00:00
|
|
|
# Security related features.
|
2016-08-06 13:38:57 +00:00
|
|
|
RANDOMIZE_BASE? y
|
2013-07-31 21:56:48 +00:00
|
|
|
STRICT_DEVMEM y # Filter access to /dev/mem
|
2013-07-31 22:08:44 +00:00
|
|
|
SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
|
2016-10-08 14:49:23 +00:00
|
|
|
SECURITY_YAMA? y # Prevent processes from ptracing non-children processes
|
2016-05-17 03:20:04 +00:00
|
|
|
DEVKMEM n # Disable /dev/kmem
|
2014-04-02 21:58:54 +00:00
|
|
|
${if versionOlder version "3.14" then ''
|
2014-05-18 00:44:03 +00:00
|
|
|
CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
|
2014-04-02 21:58:54 +00:00
|
|
|
'' else ''
|
2014-05-18 00:44:03 +00:00
|
|
|
CC_STACKPROTECTOR_REGULAR? y
|
2014-04-01 00:54:47 +00:00
|
|
|
''}
|
2013-09-25 10:49:49 +00:00
|
|
|
${optionalString (versionAtLeast version "3.12") ''
|
|
|
|
USER_NS y # Support for user namespaces
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
|
2014-05-07 22:59:29 +00:00
|
|
|
# AppArmor support
|
|
|
|
SECURITY_APPARMOR y
|
|
|
|
DEFAULT_SECURITY_APPARMOR y
|
|
|
|
|
2015-03-25 18:29:57 +00:00
|
|
|
# Microcode loading support
|
|
|
|
MICROCODE y
|
|
|
|
MICROCODE_INTEL y
|
|
|
|
MICROCODE_AMD y
|
2015-11-18 01:21:25 +00:00
|
|
|
${optionalString (versionAtLeast version "3.11" && versionOlder version "4.4") ''
|
2015-03-25 18:29:57 +00:00
|
|
|
MICROCODE_EARLY y
|
|
|
|
MICROCODE_INTEL_EARLY y
|
|
|
|
MICROCODE_AMD_EARLY y
|
|
|
|
''}
|
|
|
|
|
2013-07-31 21:56:48 +00:00
|
|
|
# Misc. options.
|
|
|
|
8139TOO_8129 y
|
|
|
|
8139TOO_PIO n # PIO is slower
|
|
|
|
AIC79XX_DEBUG_ENABLE n
|
|
|
|
AIC7XXX_DEBUG_ENABLE n
|
|
|
|
AIC94XX_DEBUG n
|
2014-01-20 03:35:24 +00:00
|
|
|
${optionalString (versionAtLeast version "3.3" && versionOlder version "3.13") ''
|
2013-07-31 21:56:48 +00:00
|
|
|
AUDIT_LOGINUID_IMMUTABLE y
|
|
|
|
''}
|
2015-11-18 01:21:25 +00:00
|
|
|
${optionalString (versionOlder version "4.4") ''
|
|
|
|
B43_PCMCIA? y
|
|
|
|
''}
|
2016-08-29 00:01:25 +00:00
|
|
|
BLK_DEV_INITRD y
|
2013-07-31 21:56:48 +00:00
|
|
|
BLK_DEV_INTEGRITY y
|
|
|
|
BSD_PROCESS_ACCT_V3 y
|
nixos: make several kernel common-config options optional
Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.
The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.
This is really just an arbitrary picking at the moment, but it should be
OK.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-17 23:30:51 +00:00
|
|
|
BT_HCIUART_BCSP? y
|
|
|
|
BT_HCIUART_H4? y # UART (H4) protocol support
|
|
|
|
BT_HCIUART_LL? y
|
2016-07-11 12:19:55 +00:00
|
|
|
BT_RFCOMM_TTY? y # RFCOMM TTY support
|
|
|
|
CLEANCACHE? y
|
2013-08-12 02:30:10 +00:00
|
|
|
CRASH_DUMP? n
|
2013-07-31 21:56:48 +00:00
|
|
|
DVB_DYNAMIC_MINORS? y # we use udev
|
2016-07-11 12:19:55 +00:00
|
|
|
EFI_STUB y # EFI bootloader in the bzImage itself
|
2016-08-29 00:01:25 +00:00
|
|
|
CGROUPS y # used by systemd
|
2013-07-31 21:56:48 +00:00
|
|
|
FHANDLE y # used by systemd
|
2016-08-18 13:33:46 +00:00
|
|
|
SECCOMP y # used by systemd >= 231
|
2016-11-09 23:14:35 +00:00
|
|
|
SECCOMP_FILTER y # ditto
|
2016-08-29 00:01:25 +00:00
|
|
|
POSIX_MQUEUE y
|
2016-07-11 12:19:55 +00:00
|
|
|
FRONTSWAP y
|
2013-07-31 21:56:48 +00:00
|
|
|
FUSION y # Fusion MPT device support
|
2016-07-11 12:30:29 +00:00
|
|
|
IDE n # deprecated IDE support
|
2016-07-11 12:19:55 +00:00
|
|
|
${optionalString (versionAtLeast version "4.3") ''
|
|
|
|
IDLE_PAGE_TRACKING y
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
IRDA_ULTRA y # Ultra (connectionless) protocol
|
nixos: make several kernel common-config options optional
Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.
The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.
This is really just an arbitrary picking at the moment, but it should be
OK.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-17 23:30:51 +00:00
|
|
|
JOYSTICK_IFORCE_232? y # I-Force Serial joysticks and wheels
|
|
|
|
JOYSTICK_IFORCE_USB? y # I-Force USB joysticks and wheels
|
|
|
|
JOYSTICK_XPAD_FF? y # X-Box gamepad rumble support
|
|
|
|
JOYSTICK_XPAD_LEDS? y # LED Support for Xbox360 controller 'BigX' LED
|
2016-07-13 10:49:18 +00:00
|
|
|
KEXEC_FILE? y
|
|
|
|
KEXEC_JUMP? y
|
2013-07-31 21:56:48 +00:00
|
|
|
LDM_PARTITION y # Windows Logical Disk Manager (Dynamic Disk) support
|
|
|
|
LOGIRUMBLEPAD2_FF y # Logitech Rumblepad 2 force feedback
|
|
|
|
LOGO n # not needed
|
|
|
|
MEDIA_ATTACH y
|
|
|
|
MEGARAID_NEWGEN y
|
2016-08-29 18:21:07 +00:00
|
|
|
${optionalString (versionAtLeast version "3.15" && versionOlder version "4.8") ''
|
2015-05-15 23:36:54 +00:00
|
|
|
MLX4_EN_VXLAN y
|
|
|
|
''}
|
2016-11-28 00:47:34 +00:00
|
|
|
${optionalString (versionOlder version "4.9") ''
|
|
|
|
MODVERSIONS y
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
MOUSE_PS2_ELANTECH y # Elantech PS/2 protocol extension
|
|
|
|
MTRR_SANITIZER y
|
|
|
|
NET_FC y # Fibre Channel driver support
|
2015-10-16 10:36:18 +00:00
|
|
|
${optionalString (versionAtLeast version "3.11") ''
|
|
|
|
PINCTRL_BAYTRAIL y # GPIO on Intel Bay Trail, for some Chromebook internal eMMC disks
|
|
|
|
''}
|
2016-01-11 08:27:58 +00:00
|
|
|
MMC_BLOCK_MINORS 32 # 8 is default. Modern gpt tables on eMMC may go far beyond 8.
|
2013-07-31 21:56:48 +00:00
|
|
|
PPP_MULTILINK y # PPP multilink support
|
2014-11-02 12:39:14 +00:00
|
|
|
PPP_FILTER y
|
2013-07-31 21:56:48 +00:00
|
|
|
REGULATOR y # Voltage and Current Regulator Support
|
2016-07-11 12:19:55 +00:00
|
|
|
RC_DEVICES? y # Enable IR devices
|
|
|
|
RT2800USB_RT55XX y
|
|
|
|
SCHED_AUTOGROUP y
|
2013-07-31 21:56:48 +00:00
|
|
|
SCSI_LOGGING y # SCSI logging facility
|
|
|
|
SERIAL_8250 y # 8250/16550 and compatible serial support
|
|
|
|
SLIP_COMPRESSED y # CSLIP compressed headers
|
|
|
|
SLIP_SMART y
|
2015-09-21 19:42:00 +00:00
|
|
|
HWMON y
|
2013-07-31 21:56:48 +00:00
|
|
|
THERMAL_HWMON y # Hardware monitoring support
|
2015-04-06 12:00:03 +00:00
|
|
|
${optionalString (versionAtLeast version "3.15") ''
|
|
|
|
UEVENT_HELPER n
|
|
|
|
''}
|
2015-03-20 22:05:43 +00:00
|
|
|
${optionalString (versionOlder version "3.15") ''
|
|
|
|
USB_DEBUG? n
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
USB_EHCI_ROOT_HUB_TT y # Root Hub Transaction Translators
|
|
|
|
USB_EHCI_TT_NEWSCHED y # Improved transaction translator scheduling
|
2016-07-11 12:19:55 +00:00
|
|
|
${optionalString (versionAtLeast version "4.3") ''
|
|
|
|
USERFAULTFD y
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
X86_CHECK_BIOS_CORRUPTION y
|
|
|
|
X86_MCE y
|
|
|
|
|
2016-02-01 10:07:08 +00:00
|
|
|
# PCI-Expresscard hotplug support
|
2016-02-25 22:07:47 +00:00
|
|
|
${optionalString (versionAtLeast version "3.12") "HOTPLUG_PCI_PCIE y"}
|
2016-02-01 10:07:08 +00:00
|
|
|
|
2013-07-31 21:56:48 +00:00
|
|
|
# Linux containers.
|
2015-07-01 09:36:55 +00:00
|
|
|
NAMESPACES? y # Required by 'unshare' used by 'nixos-install'
|
2016-10-05 10:52:45 +00:00
|
|
|
RT_GROUP_SCHED n
|
2013-07-31 21:56:48 +00:00
|
|
|
CGROUP_DEVICE? y
|
2016-07-11 12:19:55 +00:00
|
|
|
MEMCG y
|
|
|
|
MEMCG_SWAP y
|
2016-07-04 08:40:28 +00:00
|
|
|
${optionalString (versionOlder version "4.7") "DEVPTS_MULTIPLE_INSTANCES y"}
|
2013-09-17 14:00:36 +00:00
|
|
|
BLK_DEV_THROTTLING y
|
|
|
|
CFQ_GROUP_IOSCHED y
|
2016-07-11 12:19:55 +00:00
|
|
|
${optionalString (versionAtLeast version "4.3") ''
|
|
|
|
CGROUP_PIDS y
|
|
|
|
''}
|
2013-07-31 21:56:48 +00:00
|
|
|
|
|
|
|
# Enable staging drivers. These are somewhat experimental, but
|
|
|
|
# they generally don't hurt.
|
|
|
|
STAGING y
|
|
|
|
|
|
|
|
# PROC_EVENTS requires that the netlink connector is not built
|
|
|
|
# as a module. This is required by libcgroup's cgrulesengd.
|
|
|
|
CONNECTOR y
|
|
|
|
PROC_EVENTS y
|
|
|
|
|
|
|
|
# Tracing.
|
|
|
|
FTRACE y
|
2015-03-11 16:11:41 +00:00
|
|
|
KPROBES y
|
2013-07-31 21:56:48 +00:00
|
|
|
FUNCTION_TRACER y
|
|
|
|
FTRACE_SYSCALLS y
|
|
|
|
SCHED_TRACER y
|
2015-03-11 16:11:41 +00:00
|
|
|
STACK_TRACER y
|
2017-03-22 00:30:37 +00:00
|
|
|
|
|
|
|
${optionalString (versionOlder version "4.11") ''
|
|
|
|
UPROBE_EVENT? y
|
|
|
|
''}
|
|
|
|
|
2016-04-06 13:25:14 +00:00
|
|
|
${optionalString (versionAtLeast version "4.4") ''
|
|
|
|
BPF_SYSCALL y
|
|
|
|
BPF_EVENTS y
|
|
|
|
''}
|
2015-03-11 16:11:41 +00:00
|
|
|
FUNCTION_PROFILER y
|
|
|
|
RING_BUFFER_BENCHMARK n
|
2013-07-31 21:56:48 +00:00
|
|
|
|
|
|
|
# Devtmpfs support.
|
|
|
|
DEVTMPFS y
|
|
|
|
|
|
|
|
# Easier debugging of NFS issues.
|
2016-07-11 12:19:55 +00:00
|
|
|
SUNRPC_DEBUG y
|
2013-07-31 21:56:48 +00:00
|
|
|
|
|
|
|
# Virtualisation.
|
2014-05-17 21:28:56 +00:00
|
|
|
PARAVIRT? y
|
2016-07-11 12:19:55 +00:00
|
|
|
HYPERVISOR_GUEST y
|
|
|
|
PARAVIRT_SPINLOCKS? y
|
2016-08-29 18:07:15 +00:00
|
|
|
${optionalString (versionOlder version "4.8") ''
|
|
|
|
KVM_APIC_ARCHITECTURE y
|
|
|
|
''}
|
2015-05-15 23:50:20 +00:00
|
|
|
KVM_ASYNC_PF y
|
|
|
|
${optionalString (versionAtLeast version "4.0") ''
|
2015-06-09 21:27:33 +00:00
|
|
|
KVM_COMPAT? y
|
2015-05-15 23:50:20 +00:00
|
|
|
''}
|
2016-07-11 12:19:55 +00:00
|
|
|
KVM_DEVICE_ASSIGNMENT? y
|
2015-05-15 23:50:20 +00:00
|
|
|
${optionalString (versionAtLeast version "4.0") ''
|
|
|
|
KVM_GENERIC_DIRTYLOG_READ_PROTECT y
|
|
|
|
''}
|
2016-05-17 03:20:48 +00:00
|
|
|
KVM_GUEST y
|
2015-05-15 23:50:20 +00:00
|
|
|
KVM_MMIO y
|
|
|
|
${optionalString (versionAtLeast version "3.13") ''
|
|
|
|
KVM_VFIO y
|
|
|
|
''}
|
2014-05-17 21:28:56 +00:00
|
|
|
XEN? y
|
2013-07-31 21:56:48 +00:00
|
|
|
XEN_DOM0? y
|
2015-02-10 15:53:03 +00:00
|
|
|
${optionalString ((versionAtLeast version "3.18") && (features.xen_dom0 or false)) ''
|
|
|
|
PCI_XEN? y
|
|
|
|
HVC_XEN? y
|
|
|
|
HVC_XEN_FRONTEND? y
|
|
|
|
XEN_SYS_HYPERVISOR? y
|
|
|
|
SWIOTLB_XEN? y
|
|
|
|
XEN_BACKEND? y
|
|
|
|
XEN_BALLOON? y
|
|
|
|
XEN_BALLOON_MEMORY_HOTPLUG? y
|
|
|
|
XEN_EFI? y
|
|
|
|
XEN_HAVE_PVMMU? y
|
|
|
|
XEN_MCE_LOG? y
|
|
|
|
XEN_PVH? y
|
|
|
|
XEN_PVHVM? y
|
|
|
|
XEN_SAVE_RESTORE? y
|
|
|
|
XEN_SCRUB_PAGES? y
|
|
|
|
XEN_SELFBALLOONING? y
|
|
|
|
XEN_STUB? y
|
|
|
|
XEN_TMEM? y
|
|
|
|
''}
|
2013-08-01 12:01:59 +00:00
|
|
|
KSM y
|
|
|
|
${optionalString (!stdenv.is64bit) ''
|
|
|
|
HIGHMEM64G? y # We need 64 GB (PAE) support for Xen guest support.
|
|
|
|
''}
|
2016-07-11 12:19:55 +00:00
|
|
|
${optionalString (stdenv.is64bit) ''
|
2014-11-08 10:44:19 +00:00
|
|
|
VFIO_PCI_VGA y
|
|
|
|
''}
|
|
|
|
VIRT_DRIVERS y
|
2013-07-31 21:56:48 +00:00
|
|
|
|
|
|
|
# Media support.
|
2016-07-11 12:19:55 +00:00
|
|
|
MEDIA_DIGITAL_TV_SUPPORT y
|
|
|
|
MEDIA_CAMERA_SUPPORT y
|
|
|
|
MEDIA_RC_SUPPORT y
|
|
|
|
MEDIA_USB_SUPPORT y
|
|
|
|
${optionalString (!(features.chromiumos or false)) ''
|
|
|
|
MEDIA_PCI_SUPPORT y
|
2013-07-31 21:56:48 +00:00
|
|
|
''}
|
|
|
|
|
|
|
|
# Our initrd init uses shebang scripts, so can't be modular.
|
2016-07-11 12:19:55 +00:00
|
|
|
BINFMT_SCRIPT y
|
2013-07-31 21:56:48 +00:00
|
|
|
|
2016-04-28 17:46:34 +00:00
|
|
|
# For systemd-binfmt
|
|
|
|
BINFMT_MISC? y
|
|
|
|
|
2013-07-31 21:56:48 +00:00
|
|
|
# Enable the 9P cache to speed up NixOS VM tests.
|
nixos: make several kernel common-config options optional
Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.
The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.
This is really just an arbitrary picking at the moment, but it should be
OK.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-17 23:30:51 +00:00
|
|
|
9P_FSCACHE? y
|
|
|
|
9P_FS_POSIX_ACL? y
|
2013-07-31 21:56:48 +00:00
|
|
|
|
2014-04-16 20:30:58 +00:00
|
|
|
# Enable transparent support for huge pages.
|
|
|
|
TRANSPARENT_HUGEPAGE? y
|
|
|
|
TRANSPARENT_HUGEPAGE_ALWAYS? n
|
|
|
|
TRANSPARENT_HUGEPAGE_MADVISE? y
|
|
|
|
|
2014-10-20 11:18:33 +00:00
|
|
|
# zram support (e.g for in-memory compressed swap).
|
2014-04-24 12:03:18 +00:00
|
|
|
ZRAM m
|
2016-08-06 13:38:57 +00:00
|
|
|
ZSWAP? y
|
2016-09-16 13:08:06 +00:00
|
|
|
ZBUD? y
|
|
|
|
${optionalString (versionOlder version "3.18") ''
|
|
|
|
ZSMALLOC y
|
|
|
|
''}
|
|
|
|
${optionalString (versionAtLeast version "3.18") ''
|
|
|
|
ZSMALLOC m
|
|
|
|
''}
|
2014-10-20 11:18:33 +00:00
|
|
|
|
2015-10-03 19:22:52 +00:00
|
|
|
# Enable PCIe and USB for the brcmfmac driver
|
2015-10-03 19:35:06 +00:00
|
|
|
BRCMFMAC_USB? y
|
|
|
|
BRCMFMAC_PCIE? y
|
2015-10-03 19:22:52 +00:00
|
|
|
|
2015-10-26 15:17:22 +00:00
|
|
|
# Support x2APIC (which requires IRQ remapping).
|
2015-10-28 10:09:59 +00:00
|
|
|
${optionalString (stdenv.system == "x86_64-linux") ''
|
|
|
|
X86_X2APIC y
|
|
|
|
IRQ_REMAP y
|
|
|
|
''}
|
2015-10-26 15:17:22 +00:00
|
|
|
|
2015-10-30 17:31:51 +00:00
|
|
|
# Disable the firmware helper fallback, udev doesn't implement it any more
|
|
|
|
FW_LOADER_USER_HELPER_FALLBACK? n
|
|
|
|
|
2016-01-10 19:07:45 +00:00
|
|
|
# ChromiumOS support
|
|
|
|
${optionalString (features.chromiumos or false) ''
|
|
|
|
CHROME_PLATFORMS y
|
|
|
|
VGA_SWITCHEROO n
|
|
|
|
MMC_SDHCI_PXAV2 n
|
|
|
|
NET_IPVTI n
|
|
|
|
IPV6_VTI n
|
|
|
|
REGULATOR_FIXED_VOLTAGE n
|
|
|
|
TPS6105X n
|
|
|
|
CPU_FREQ_STAT y
|
|
|
|
IPV6 y
|
|
|
|
MFD_CROS_EC y
|
|
|
|
MFD_CROS_EC_LPC y
|
|
|
|
MFD_CROS_EC_DEV y
|
|
|
|
CHARGER_CROS_USB_PD y
|
|
|
|
I2C y
|
|
|
|
MEDIA_SUBDRV_AUTOSELECT n
|
|
|
|
VIDEO_IR_I2C n
|
|
|
|
BLK_DEV_DM y
|
|
|
|
ANDROID_PARANOID_NETWORK n
|
|
|
|
DM_VERITY n
|
|
|
|
DRM_VGEM n
|
|
|
|
CPU_FREQ_GOV_INTERACTIVE n
|
|
|
|
INPUT_KEYRESET n
|
|
|
|
DM_BOOTCACHE n
|
|
|
|
UID_CPUTIME n
|
|
|
|
|
|
|
|
${optionalString (versionAtLeast version "3.18") ''
|
|
|
|
CPUFREQ_DT n
|
|
|
|
EXTCON_CROS_EC n
|
|
|
|
DRM_POWERVR_ROGUE n
|
|
|
|
CHROMEOS_OF_FIRMWARE y
|
|
|
|
TEST_RHASHTABLE n
|
|
|
|
BCMDHD n
|
|
|
|
TRUSTY n
|
|
|
|
''}
|
|
|
|
|
|
|
|
${optionalString (versionOlder version "3.18") ''
|
|
|
|
MALI_MIDGARD n
|
|
|
|
DVB_USB_DIB0700 n
|
|
|
|
DVB_USB_DW2102 n
|
|
|
|
DVB_USB_PCTV452E n
|
|
|
|
DVB_USB_TTUSB2 n
|
|
|
|
DVB_USB_AF9015 n
|
|
|
|
DVB_USB_AF9035 n
|
|
|
|
DVB_USB_ANYSEE n
|
|
|
|
DVB_USB_AZ6007 n
|
|
|
|
DVB_USB_IT913X n
|
|
|
|
DVB_USB_LME2510 n
|
|
|
|
DVB_USB_RTL28XXU n
|
|
|
|
USB_S2255 n
|
|
|
|
VIDEO_EM28XX n
|
|
|
|
VIDEO_TM6000 n
|
|
|
|
USB_DWC2 n
|
|
|
|
USB_GSPCA n
|
|
|
|
SPEAKUP n
|
|
|
|
XO15_EBOOK n
|
|
|
|
USB_GADGET n
|
|
|
|
''}
|
|
|
|
''}
|
|
|
|
|
2013-07-31 21:56:48 +00:00
|
|
|
${kernelPlatform.kernelExtraConfig or ""}
|
|
|
|
${extraConfig}
|
|
|
|
''
|