forked from freebsd/freebsd-src
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathNOTES
3008 lines (2655 loc) · 106 KB
/
NOTES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# $FreeBSD$
#
# NOTES -- Lines that can be cut/pasted into kernel and hints configs.
#
# Lines that begin with 'device', 'options', 'machine', 'ident', 'maxusers',
# 'makeoptions', 'hints', etc. go into the kernel configuration that you
# run config(8) with.
#
# Lines that begin with 'hint.' are NOT for config(8), they go into your
# hints file. See /boot/device.hints and/or the 'hints' config(8) directive.
#
# Please use ``make LINT'' to create an old-style LINT file if you want to
# do kernel test-builds.
#
# This file contains machine independent kernel configuration notes. For
# machine dependent notes, look in /sys/<arch>/conf/NOTES.
#
#
# NOTES conventions and style guide:
#
# Large block comments should begin and end with a line containing only a
# comment character.
#
# To describe a particular object, a block comment (if it exists) should
# come first. Next should come device, options, and hints lines in that
# order. All device and option lines must be described by a comment that
# doesn't just expand the device or option name. Use only a concise
# comment on the same line if possible. Very detailed descriptions of
# devices and subsystems belong in man pages.
#
# A space followed by a tab separates 'options' from an option name. Two
# spaces followed by a tab separate 'device' from a device name. Comments
# after an option or device should use one space after the comment character.
# To comment out a negative option that disables code and thus should not be
# enabled for LINT builds, precede 'options' with "#!".
#
#
# This is the ``identification'' of the kernel. Usually this should
# be the same as the name of your kernel.
#
ident LINT
#
# The `maxusers' parameter controls the static sizing of a number of
# internal system tables by a formula defined in subr_param.c.
# Omitting this parameter or setting it to 0 will cause the system to
# auto-size based on physical memory.
#
maxusers 10
# To statically compile in device wiring instead of /boot/device.hints
#hints "LINT.hints" # Default places to look for devices.
# Use the following to compile in values accessible to the kernel
# through getenv() (or kenv(1) in userland). The format of the file
# is 'variable=value', see kenv(1)
#
#env "LINT.env"
#
# The `makeoptions' parameter allows variables to be passed to the
# generated Makefile in the build area.
#
# CONF_CFLAGS gives some extra compiler flags that are added to ${CFLAGS}
# after most other flags. Here we use it to inhibit use of non-optimal
# gcc built-in functions (e.g., memcmp).
#
# DEBUG happens to be magic.
# The following is equivalent to 'config -g KERNELNAME' and creates
# 'kernel.debug' compiled with -g debugging as well as a normal
# 'kernel'. Use 'make install.debug' to install the debug kernel
# but that isn't normally necessary as the debug symbols are not loaded
# by the kernel and are not useful there anyway.
#
# KERNEL can be overridden so that you can change the default name of your
# kernel.
#
# MODULES_OVERRIDE can be used to limit modules built to a specific list.
#
makeoptions CONF_CFLAGS=-fno-builtin #Don't allow use of memcmp, etc.
#makeoptions DEBUG=-g #Build kernel with gdb(1) debug symbols
#makeoptions KERNEL=foo #Build kernel "foo" and install "/foo"
# Only build ext2fs module plus those parts of the sound system I need.
#makeoptions MODULES_OVERRIDE="ext2fs sound/sound sound/driver/maestro3"
makeoptions DESTDIR=/tmp
#
# FreeBSD processes are subject to certain limits to their consumption
# of system resources. See getrlimit(2) for more details. Each
# resource limit has two values, a "soft" limit and a "hard" limit.
# The soft limits can be modified during normal system operation, but
# the hard limits are set at boot time. Their default values are
# in sys/<arch>/include/vmparam.h. There are two ways to change them:
#
# 1. Set the values at kernel build time. The options below are one
# way to allow that limit to grow to 1GB. They can be increased
# further by changing the parameters:
#
# 2. In /boot/loader.conf, set the tunables kern.maxswzone,
# kern.maxbcache, kern.maxtsiz, kern.dfldsiz, kern.maxdsiz,
# kern.dflssiz, kern.maxssiz and kern.sgrowsiz.
#
# The options in /boot/loader.conf override anything in the kernel
# configuration file. See the function init_param1 in
# sys/kern/subr_param.c for more details.
#
options MAXDSIZ=(1024UL*1024*1024)
options MAXSSIZ=(128UL*1024*1024)
options DFLDSIZ=(1024UL*1024*1024)
#
# BLKDEV_IOSIZE sets the default block size used in user block
# device I/O. Note that this value will be overridden by the label
# when specifying a block device from a label with a non-0
# partition blocksize. The default is PAGE_SIZE.
#
options BLKDEV_IOSIZE=8192
#
# MAXPHYS and DFLTPHYS
#
# These are the maximal and safe 'raw' I/O block device access sizes.
# Reads and writes will be split into MAXPHYS chunks for known good
# devices and DFLTPHYS for the rest. Some applications have better
# performance with larger raw I/O access sizes. Note that certain VM
# parameters are derived from these values and making them too large
# can make an unbootable kernel.
#
# The defaults are 64K and 128K respectively.
options DFLTPHYS=(64*1024)
options MAXPHYS=(128*1024)
# This allows you to actually store this configuration file into
# the kernel binary itself. See config(8) for more details.
#
options INCLUDE_CONFIG_FILE # Include this file in kernel
#
# Compile-time defaults for various boot parameters
#
options BOOTVERBOSE=1
options BOOTHOWTO=RB_MULTIPLE
#
# Compile-time defaults for dmesg boot tagging
#
# Default boot tag; may use 'kern.boot_tag' loader tunable to override. The
# current boot's tag is also exposed via the 'kern.boot_tag' sysctl.
options BOOT_TAG=\"\"
# Maximum boot tag size the kernel's static buffer should accomodate. Maximum
# size for both BOOT_TAG and the assocated tunable.
options BOOT_TAG_SZ=32
options GEOM_BDE # Disk encryption.
options GEOM_BSD # BSD disklabels (obsolete, gone in 12)
options GEOM_CACHE # Disk cache.
options GEOM_CONCAT # Disk concatenation.
options GEOM_ELI # Disk encryption.
options GEOM_FOX # Redundant path mitigation (obsolete, gone in 12)
options GEOM_GATE # Userland services.
options GEOM_JOURNAL # Journaling.
options GEOM_LABEL # Providers labelization.
options GEOM_LINUX_LVM # Linux LVM2 volumes
options GEOM_MAP # Map based partitioning
options GEOM_MBR # DOS/MBR partitioning (obsolete, gone in 12)
options GEOM_MIRROR # Disk mirroring.
options GEOM_MULTIPATH # Disk multipath
options GEOM_NOP # Test class.
options GEOM_PART_APM # Apple partitioning
options GEOM_PART_BSD # BSD disklabel
options GEOM_PART_BSD64 # BSD disklabel64
options GEOM_PART_EBR # Extended Boot Records
options GEOM_PART_EBR_COMPAT # Backward compatible partition names
options GEOM_PART_GPT # GPT partitioning
options GEOM_PART_LDM # Logical Disk Manager
options GEOM_PART_MBR # MBR partitioning
options GEOM_PART_VTOC8 # SMI VTOC8 disk label
options GEOM_RAID # Soft RAID functionality.
options GEOM_RAID3 # RAID3 functionality.
options GEOM_SHSEC # Shared secret.
options GEOM_STRIPE # Disk striping.
options GEOM_SUNLABEL # Sun/Solaris partitioning (obsolete, gone in 12)
options GEOM_UZIP # Read-only compressed disks
options GEOM_VINUM # Vinum logical volume manager
options GEOM_VIRSTOR # Virtual storage.
options GEOM_VOL # Volume names from UFS superblock (obsolete, gone in 12)
options GEOM_ZERO # Performance testing helper.
#
# The root device and filesystem type can be compiled in;
# this provides a fallback option if the root device cannot
# be correctly guessed by the bootstrap code, or an override if
# the RB_DFLTROOT flag (-r) is specified when booting the kernel.
#
options ROOTDEVNAME=\"ufs:da0s2e\"
#####################################################################
# Scheduler options:
#
# Specifying one of SCHED_4BSD or SCHED_ULE is mandatory. These options
# select which scheduler is compiled in.
#
# SCHED_4BSD is the historical, proven, BSD scheduler. It has a global run
# queue and no CPU affinity which makes it suboptimal for SMP. It has very
# good interactivity and priority selection.
#
# SCHED_ULE provides significant performance advantages over 4BSD on many
# workloads on SMP machines. It supports cpu-affinity, per-cpu runqueues
# and scheduler locks. It also has a stronger notion of interactivity
# which leads to better responsiveness even on uniprocessor machines. This
# is the default scheduler.
#
# SCHED_STATS is a debugging option which keeps some stats in the sysctl
# tree at 'kern.sched.stats' and is useful for debugging scheduling decisions.
#
options SCHED_4BSD
options SCHED_STATS
#options SCHED_ULE
#####################################################################
# SMP OPTIONS:
#
# SMP enables building of a Symmetric MultiProcessor Kernel.
# Mandatory:
options SMP # Symmetric MultiProcessor Kernel
# EARLY_AP_STARTUP releases the Application Processors earlier in the
# kernel startup process (before devices are probed) rather than at the
# end. This is a temporary option for use during the transition from
# late to early AP startup.
options EARLY_AP_STARTUP
# MAXCPU defines the maximum number of CPUs that can boot in the system.
# A default value should be already present, for every architecture.
options MAXCPU=32
# NUMA enables use of Non-Uniform Memory Access policies in various kernel
# subsystems.
options NUMA
# MAXMEMDOM defines the maximum number of memory domains that can boot in the
# system. A default value should already be defined by every architecture.
options MAXMEMDOM=2
# ADAPTIVE_MUTEXES changes the behavior of blocking mutexes to spin
# if the thread that currently owns the mutex is executing on another
# CPU. This behavior is enabled by default, so this option can be used
# to disable it.
options NO_ADAPTIVE_MUTEXES
# ADAPTIVE_RWLOCKS changes the behavior of reader/writer locks to spin
# if the thread that currently owns the rwlock is executing on another
# CPU. This behavior is enabled by default, so this option can be used
# to disable it.
options NO_ADAPTIVE_RWLOCKS
# ADAPTIVE_SX changes the behavior of sx locks to spin if the thread that
# currently owns the sx lock is executing on another CPU.
# This behavior is enabled by default, so this option can be used to
# disable it.
options NO_ADAPTIVE_SX
# MUTEX_NOINLINE forces mutex operations to call functions to perform each
# operation rather than inlining the simple cases. This can be used to
# shrink the size of the kernel text segment. Note that this behavior is
# already implied by the INVARIANT_SUPPORT, INVARIANTS, KTR, LOCK_PROFILING,
# and WITNESS options.
options MUTEX_NOINLINE
# RWLOCK_NOINLINE forces rwlock operations to call functions to perform each
# operation rather than inlining the simple cases. This can be used to
# shrink the size of the kernel text segment. Note that this behavior is
# already implied by the INVARIANT_SUPPORT, INVARIANTS, KTR, LOCK_PROFILING,
# and WITNESS options.
options RWLOCK_NOINLINE
# SX_NOINLINE forces sx lock operations to call functions to perform each
# operation rather than inlining the simple cases. This can be used to
# shrink the size of the kernel text segment. Note that this behavior is
# already implied by the INVARIANT_SUPPORT, INVARIANTS, KTR, LOCK_PROFILING,
# and WITNESS options.
options SX_NOINLINE
# SMP Debugging Options:
#
# CALLOUT_PROFILING enables rudimentary profiling of the callwheel data
# structure used as backend in callout(9).
# PREEMPTION allows the threads that are in the kernel to be preempted by
# higher priority [interrupt] threads. It helps with interactivity
# and allows interrupt threads to run sooner rather than waiting.
# WARNING! Only tested on amd64 and i386.
# FULL_PREEMPTION instructs the kernel to preempt non-realtime kernel
# threads. Its sole use is to expose race conditions and other
# bugs during development. Enabling this option will reduce
# performance and increase the frequency of kernel panics by
# design. If you aren't sure that you need it then you don't.
# Relies on the PREEMPTION option. DON'T TURN THIS ON.
# SLEEPQUEUE_PROFILING enables rudimentary profiling of the hash table
# used to hold active sleep queues as well as sleep wait message
# frequency.
# TURNSTILE_PROFILING enables rudimentary profiling of the hash table
# used to hold active lock queues.
# UMTX_PROFILING enables rudimentary profiling of the hash table used
# to hold active lock queues.
# WITNESS enables the witness code which detects deadlocks and cycles
# during locking operations.
# WITNESS_KDB causes the witness code to drop into the kernel debugger if
# a lock hierarchy violation occurs or if locks are held when going to
# sleep.
# WITNESS_SKIPSPIN disables the witness checks on spin mutexes.
options PREEMPTION
options FULL_PREEMPTION
options WITNESS
options WITNESS_KDB
options WITNESS_SKIPSPIN
# LOCK_PROFILING - Profiling locks. See LOCK_PROFILING(9) for details.
options LOCK_PROFILING
# Set the number of buffers and the hash size. The hash size MUST be larger
# than the number of buffers. Hash size should be prime.
options MPROF_BUFFERS="1536"
options MPROF_HASH_SIZE="1543"
# Profiling for the callout(9) backend.
options CALLOUT_PROFILING
# Profiling for internal hash tables.
options SLEEPQUEUE_PROFILING
options TURNSTILE_PROFILING
options UMTX_PROFILING
#####################################################################
# COMPATIBILITY OPTIONS
#
# Implement system calls compatible with 4.3BSD and older versions of
# FreeBSD. You probably do NOT want to remove this as much current code
# still relies on the 4.3 emulation. Note that some architectures that
# are supported by FreeBSD do not include support for certain important
# aspects of this compatibility option, namely those related to the
# signal delivery mechanism.
#
options COMPAT_43
# Old tty interface.
options COMPAT_43TTY
# Note that as a general rule, COMPAT_FREEBSD<n> depends on
# COMPAT_FREEBSD<n+1>, COMPAT_FREEBSD<n+2>, etc.
# Enable FreeBSD4 compatibility syscalls
options COMPAT_FREEBSD4
# Enable FreeBSD5 compatibility syscalls
options COMPAT_FREEBSD5
# Enable FreeBSD6 compatibility syscalls
options COMPAT_FREEBSD6
# Enable FreeBSD7 compatibility syscalls
options COMPAT_FREEBSD7
# Enable FreeBSD9 compatibility syscalls
options COMPAT_FREEBSD9
# Enable FreeBSD10 compatibility syscalls
options COMPAT_FREEBSD10
# Enable FreeBSD11 compatibility syscalls
options COMPAT_FREEBSD11
# Enable Linux Kernel Programming Interface
options COMPAT_LINUXKPI
#
# These three options provide support for System V Interface
# Definition-style interprocess communication, in the form of shared
# memory, semaphores, and message queues, respectively.
#
options SYSVSHM
options SYSVSEM
options SYSVMSG
#####################################################################
# DEBUGGING OPTIONS
#
# Compile with kernel debugger related code.
#
options KDB
#
# Print a stack trace of the current thread on the console for a panic.
#
options KDB_TRACE
#
# Don't enter the debugger for a panic. Intended for unattended operation
# where you may want to enter the debugger from the console, but still want
# the machine to recover from a panic.
#
options KDB_UNATTENDED
#
# Enable the ddb debugger backend.
#
options DDB
#
# Print the numerical value of symbols in addition to the symbolic
# representation.
#
options DDB_NUMSYM
#
# Enable the remote gdb debugger backend.
#
options GDB
#
# SYSCTL_DEBUG enables a 'sysctl' debug tree that can be used to dump the
# contents of the registered sysctl nodes on the console. It is disabled by
# default because it generates excessively verbose console output that can
# interfere with serial console operation.
#
options SYSCTL_DEBUG
#
# Enable textdump by default, this disables kernel core dumps.
#
options TEXTDUMP_PREFERRED
#
# Enable extra debug messages while performing textdumps.
#
options TEXTDUMP_VERBOSE
#
# NO_SYSCTL_DESCR omits the sysctl node descriptions to save space in the
# resulting kernel.
options NO_SYSCTL_DESCR
#
# MALLOC_DEBUG_MAXZONES enables multiple uma zones for malloc(9)
# allocations that are smaller than a page. The purpose is to isolate
# different malloc types into hash classes, so that any buffer
# overruns or use-after-free will usually only affect memory from
# malloc types in that hash class. This is purely a debugging tool;
# by varying the hash function and tracking which hash class was
# corrupted, the intersection of the hash classes from each instance
# will point to a single malloc type that is being misused. At this
# point inspection or memguard(9) can be used to catch the offending
# code.
#
options MALLOC_DEBUG_MAXZONES=8
#
# DEBUG_MEMGUARD builds and enables memguard(9), a replacement allocator
# for the kernel used to detect modify-after-free scenarios. See the
# memguard(9) man page for more information on usage.
#
options DEBUG_MEMGUARD
#
# DEBUG_REDZONE enables buffer underflows and buffer overflows detection for
# malloc(9).
#
options DEBUG_REDZONE
#
# EARLY_PRINTF enables support for calling a special printf (eprintf)
# very early in the kernel (before cn_init() has been called). This
# should only be used for debugging purposes early in boot. Normally,
# it is not defined. It is commented out here because this feature
# isn't generally available. And the required eputc() isn't defined.
#
#options EARLY_PRINTF
#
# KTRACE enables the system-call tracing facility ktrace(2). To be more
# SMP-friendly, KTRACE uses a worker thread to process most trace events
# asynchronously to the thread generating the event. This requires a
# pre-allocated store of objects representing trace events. The
# KTRACE_REQUEST_POOL option specifies the initial size of this store.
# The size of the pool can be adjusted both at boottime and runtime via
# the kern.ktrace_request_pool tunable and sysctl.
#
options KTRACE #kernel tracing
options KTRACE_REQUEST_POOL=101
#
# KTR is a kernel tracing facility imported from BSD/OS. It is
# enabled with the KTR option. KTR_ENTRIES defines the number of
# entries in the circular trace buffer; it may be an arbitrary number.
# KTR_BOOT_ENTRIES defines the number of entries during the early boot,
# before malloc(9) is functional.
# KTR_COMPILE defines the mask of events to compile into the kernel as
# defined by the KTR_* constants in <sys/ktr.h>. KTR_MASK defines the
# initial value of the ktr_mask variable which determines at runtime
# what events to trace. KTR_CPUMASK determines which CPU's log
# events, with bit X corresponding to CPU X. The layout of the string
# passed as KTR_CPUMASK must match a series of bitmasks each of them
# separated by the "," character (ie:
# KTR_CPUMASK=0xAF,0xFFFFFFFFFFFFFFFF). KTR_VERBOSE enables
# dumping of KTR events to the console by default. This functionality
# can be toggled via the debug.ktr_verbose sysctl and defaults to off
# if KTR_VERBOSE is not defined. See ktr(4) and ktrdump(8) for details.
#
options KTR
options KTR_BOOT_ENTRIES=1024
options KTR_ENTRIES=(128*1024)
options KTR_COMPILE=(KTR_ALL)
options KTR_MASK=KTR_INTR
options KTR_CPUMASK=0x3
options KTR_VERBOSE
#
# ALQ(9) is a facility for the asynchronous queuing of records from the kernel
# to a vnode, and is employed by services such as ktr(4) to produce trace
# files based on a kernel event stream. Records are written asynchronously
# in a worker thread.
#
options ALQ
options KTR_ALQ
#
# The INVARIANTS option is used in a number of source files to enable
# extra sanity checking of internal structures. This support is not
# enabled by default because of the extra time it would take to check
# for these conditions, which can only occur as a result of
# programming errors.
#
options INVARIANTS
#
# The INVARIANT_SUPPORT option makes us compile in support for
# verifying some of the internal structures. It is a prerequisite for
# 'INVARIANTS', as enabling 'INVARIANTS' will make these functions be
# called. The intent is that you can set 'INVARIANTS' for single
# source files (by changing the source file or specifying it on the
# command line) if you have 'INVARIANT_SUPPORT' enabled. Also, if you
# wish to build a kernel module with 'INVARIANTS', then adding
# 'INVARIANT_SUPPORT' to your kernel will provide all the necessary
# infrastructure without the added overhead.
#
options INVARIANT_SUPPORT
#
# The KASSERT_PANIC_OPTIONAL option allows kasserts to fire without
# necessarily inducing a panic. Panic is the default behavior, but
# runtime options can configure it either entirely off, or off with a
# limit.
#
options KASSERT_PANIC_OPTIONAL
#
# The DIAGNOSTIC option is used to enable extra debugging information
# from some parts of the kernel. As this makes everything more noisy,
# it is disabled by default.
#
options DIAGNOSTIC
#
# REGRESSION causes optional kernel interfaces necessary only for regression
# testing to be enabled. These interfaces may constitute security risks
# when enabled, as they permit processes to easily modify aspects of the
# run-time environment to reproduce unlikely or unusual (possibly normally
# impossible) scenarios.
#
options REGRESSION
#
# This option lets some drivers co-exist that can't co-exist in a running
# system. This is used to be able to compile all kernel code in one go for
# quality assurance purposes (like this file, which the option takes it name
# from.)
#
options COMPILING_LINT
#
# STACK enables the stack(9) facility, allowing the capture of kernel stack
# for the purpose of procinfo(1), etc. stack(9) will also be compiled in
# automatically if DDB(4) is compiled into the kernel.
#
options STACK
#
# The NUM_CORE_FILES option specifies the limit for the number of core
# files generated by a particular process, when the core file format
# specifier includes the %I pattern. Since we only have 1 character for
# the core count in the format string, meaning the range will be 0-9, the
# maximum value allowed for this option is 10.
# This core file limit can be adjusted at runtime via the debug.ncores
# sysctl.
#
options NUM_CORE_FILES=5
#
# The TSLOG option enables timestamped logging of events, especially
# function entries/exits, in order to track the time spent by the kernel.
# In particular, this is useful when investigating the early boot process,
# before it is possible to use more sophisticated tools like DTrace.
# The TSLOGSIZE option controls the size of the (preallocated, fixed
# length) buffer used for storing these events (default: 262144 records).
#
# For security reasons the TSLOG option should not be enabled on systems
# used in production.
#
options TSLOG
options TSLOGSIZE=262144
#####################################################################
# PERFORMANCE MONITORING OPTIONS
#
# The hwpmc driver that allows the use of in-CPU performance monitoring
# counters for performance monitoring. The base kernel needs to be configured
# with the 'options' line, while the hwpmc device can be either compiled
# in or loaded as a loadable kernel module.
#
# Additional configuration options may be required on specific architectures,
# please see hwpmc(4).
device hwpmc # Driver (also a loadable module)
options HWPMC_DEBUG
options HWPMC_HOOKS # Other necessary kernel hooks
#####################################################################
# NETWORKING OPTIONS
#
# Protocol families
#
options INET #Internet communications protocols
options INET6 #IPv6 communications protocols
options RATELIMIT # TX rate limiting support
options ROUTETABLES=2 # allocated fibs up to 65536. default is 1.
# but that would be a bad idea as they are large.
options TCP_OFFLOAD # TCP offload support.
options TCPHPTS
# In order to enable IPSEC you MUST also add device crypto to
# your kernel configuration
options IPSEC #IP security (requires device crypto)
# Option IPSEC_SUPPORT does not enable IPsec, but makes it possible to
# load it as a kernel module. You still MUST add device crypto to your kernel
# configuration.
options IPSEC_SUPPORT
#options IPSEC_DEBUG #debug for IP security
#
# SMB/CIFS requester
# NETSMB enables support for SMB protocol, it requires LIBMCHAIN and LIBICONV
# options.
options NETSMB #SMB/CIFS requester
# mchain library. It can be either loaded as KLD or compiled into kernel
options LIBMCHAIN
# libalias library, performing NAT
options LIBALIAS
#
# SCTP is a NEW transport protocol defined by
# RFC2960 updated by RFC3309 and RFC3758.. and
# soon to have a new base RFC and many many more
# extensions. This release supports all the extensions
# including many drafts (most about to become RFC's).
# It is the reference implementation of SCTP
# and is quite well tested.
#
# Note YOU MUST have both INET and INET6 defined.
# You don't have to enable V6, but SCTP is
# dual stacked and so far we have not torn apart
# the V6 and V4.. since an association can span
# both a V6 and V4 address at the SAME time :-)
#
options SCTP
# There are bunches of options:
# this one turns on all sorts of
# nastily printing that you can
# do. It's all controlled by a
# bit mask (settable by socket opt and
# by sysctl). Including will not cause
# logging until you set the bits.. but it
# can be quite verbose.. so without this
# option we don't do any of the tests for
# bits and prints.. which makes the code run
# faster.. if you are not debugging don't use.
options SCTP_DEBUG
#
# All that options after that turn on specific types of
# logging. You can monitor CWND growth, flight size
# and all sorts of things. Go look at the code and
# see. I have used this to produce interesting
# charts and graphs as well :->
#
# I have not yet committed the tools to get and print
# the logs, I will do that eventually .. before then
# if you want them send me an email [email protected]
# You basically must have ktr(4) enabled for these
# and you then set the sysctl to turn on/off various
# logging bits. Use ktrdump(8) to pull the log and run
# it through a display program.. and graphs and other
# things too.
#
options SCTP_LOCK_LOGGING
options SCTP_MBUF_LOGGING
options SCTP_MBCNT_LOGGING
options SCTP_PACKET_LOGGING
options SCTP_LTRACE_CHUNKS
options SCTP_LTRACE_ERRORS
# altq(9). Enable the base part of the hooks with the ALTQ option.
# Individual disciplines must be built into the base system and can not be
# loaded as modules at this point. ALTQ requires a stable TSC so if yours is
# broken or changes with CPU throttling then you must also have the ALTQ_NOPCC
# option.
options ALTQ
options ALTQ_CBQ # Class Based Queueing
options ALTQ_RED # Random Early Detection
options ALTQ_RIO # RED In/Out
options ALTQ_CODEL # CoDel Active Queueing
options ALTQ_HFSC # Hierarchical Packet Scheduler
options ALTQ_FAIRQ # Fair Packet Scheduler
options ALTQ_CDNR # Traffic conditioner
options ALTQ_PRIQ # Priority Queueing
options ALTQ_NOPCC # Required if the TSC is unusable
options ALTQ_DEBUG
# netgraph(4). Enable the base netgraph code with the NETGRAPH option.
# Individual node types can be enabled with the corresponding option
# listed below; however, this is not strictly necessary as netgraph
# will automatically load the corresponding KLD module if the node type
# is not already compiled into the kernel. Each type below has a
# corresponding man page, e.g., ng_async(8).
options NETGRAPH # netgraph(4) system
options NETGRAPH_DEBUG # enable extra debugging, this
# affects netgraph(4) and nodes
# Node types
options NETGRAPH_ASYNC
options NETGRAPH_ATMLLC
options NETGRAPH_ATM_ATMPIF
options NETGRAPH_BLUETOOTH # ng_bluetooth(4)
options NETGRAPH_BLUETOOTH_BT3C # ng_bt3c(4)
options NETGRAPH_BLUETOOTH_HCI # ng_hci(4)
options NETGRAPH_BLUETOOTH_L2CAP # ng_l2cap(4)
options NETGRAPH_BLUETOOTH_SOCKET # ng_btsocket(4)
options NETGRAPH_BLUETOOTH_UBT # ng_ubt(4)
options NETGRAPH_BLUETOOTH_UBTBCMFW # ubtbcmfw(4)
options NETGRAPH_BPF
options NETGRAPH_BRIDGE
options NETGRAPH_CAR
options NETGRAPH_CHECKSUM
options NETGRAPH_CISCO
options NETGRAPH_DEFLATE
options NETGRAPH_DEVICE
options NETGRAPH_ECHO
options NETGRAPH_EIFACE
options NETGRAPH_ETHER
options NETGRAPH_FRAME_RELAY
options NETGRAPH_GIF
options NETGRAPH_GIF_DEMUX
options NETGRAPH_HOLE
options NETGRAPH_IFACE
options NETGRAPH_IP_INPUT
options NETGRAPH_IPFW
options NETGRAPH_KSOCKET
options NETGRAPH_L2TP
options NETGRAPH_LMI
options NETGRAPH_MPPC_COMPRESSION
options NETGRAPH_MPPC_ENCRYPTION
options NETGRAPH_NETFLOW
options NETGRAPH_NAT
options NETGRAPH_ONE2MANY
options NETGRAPH_PATCH
options NETGRAPH_PIPE
options NETGRAPH_PPP
options NETGRAPH_PPPOE
options NETGRAPH_PPTPGRE
options NETGRAPH_PRED1
options NETGRAPH_RFC1490
options NETGRAPH_SOCKET
options NETGRAPH_SPLIT
options NETGRAPH_SPPP
options NETGRAPH_TAG
options NETGRAPH_TCPMSS
options NETGRAPH_TEE
options NETGRAPH_UI
options NETGRAPH_VJC
options NETGRAPH_VLAN
# NgATM - Netgraph ATM
options NGATM_ATM
options NGATM_ATMBASE
options NGATM_SSCOP
options NGATM_SSCFU
options NGATM_UNI
options NGATM_CCATM
device mn # Munich32x/Falc54 Nx64kbit/sec cards.
# Network stack virtualization.
options VIMAGE
options VNET_DEBUG # debug for VIMAGE
#
# Network interfaces:
# The `loop' device is MANDATORY when networking is enabled.
device loop
# The `ether' device provides generic code to handle
# Ethernets; it is MANDATORY when an Ethernet device driver is
# configured.
device ether
# The `vlan' device implements the VLAN tagging of Ethernet frames
# according to IEEE 802.1Q.
device vlan
# The `vxlan' device implements the VXLAN encapsulation of Ethernet
# frames in UDP packets according to RFC7348.
device vxlan
# The `wlan' device provides generic code to support 802.11
# drivers, including host AP mode; it is MANDATORY for the wi,
# and ath drivers and will eventually be required by all 802.11 drivers.
device wlan
options IEEE80211_DEBUG #enable debugging msgs
options IEEE80211_SUPPORT_MESH #enable 802.11s D3.0 support
options IEEE80211_SUPPORT_TDMA #enable TDMA support
# The `wlan_wep', `wlan_tkip', and `wlan_ccmp' devices provide
# support for WEP, TKIP, and AES-CCMP crypto protocols optionally
# used with 802.11 devices that depend on the `wlan' module.
device wlan_wep
device wlan_ccmp
device wlan_tkip
# The `wlan_xauth' device provides support for external (i.e. user-mode)
# authenticators for use with 802.11 drivers that use the `wlan'
# module and support 802.1x and/or WPA security protocols.
device wlan_xauth
# The `wlan_acl' device provides a MAC-based access control mechanism
# for use with 802.11 drivers operating in ap mode and using the
# `wlan' module.
# The 'wlan_amrr' device provides AMRR transmit rate control algorithm
device wlan_acl
device wlan_amrr
# The `sppp' device serves a similar role for certain types
# of synchronous PPP links (like `cx', `ar').
device sppp
# The `bpf' device enables the Berkeley Packet Filter. Be
# aware of the legal and administrative consequences of enabling this
# option. DHCP requires bpf.
device bpf
# The `netmap' device implements memory-mapped access to network
# devices from userspace, enabling wire-speed packet capture and
# generation even at 10Gbit/s. Requires support in the device
# driver. Supported drivers are ixgbe, e1000, re.
device netmap
# The `disc' device implements a minimal network interface,
# which throws away all packets sent and never receives any. It is
# included for testing and benchmarking purposes.
device disc
# The `epair' device implements a virtual back-to-back connected Ethernet
# like interface pair.
device epair
# The `edsc' device implements a minimal Ethernet interface,
# which discards all packets sent and receives none.
device edsc
# The `tap' device is a pty-like virtual Ethernet interface
device tap
# The `tun' device implements (user-)ppp and nos-tun(8)
device tun
# The `gif' device implements IPv6 over IP4 tunneling,
# IPv4 over IPv6 tunneling, IPv4 over IPv4 tunneling and
# IPv6 over IPv6 tunneling.
# The `gre' device implements GRE (Generic Routing Encapsulation) tunneling,
# as specified in the RFC 2784 and RFC 2890.
# The `me' device implements Minimal Encapsulation within IPv4 as
# specified in the RFC 2004.
# The XBONEHACK option allows the same pair of addresses to be configured on
# multiple gif interfaces.
device gif
device gre
device me
options XBONEHACK
# The `stf' device implements 6to4 encapsulation.
device stf
# The pf packet filter consists of three devices:
# The `pf' device provides /dev/pf and the firewall code itself.
# The `pflog' device provides the pflog0 interface which logs packets.
# The `pfsync' device provides the pfsync0 interface used for
# synchronization of firewall state tables (over the net).
device pf
device pflog
device pfsync
# Bridge interface.
device if_bridge
# Common Address Redundancy Protocol. See carp(4) for more details.
device carp
# IPsec interface.
device enc
# Link aggregation interface.
device lagg
#
# Internet family options:
#
# MROUTING enables the kernel multicast packet forwarder, which works
# with mrouted and XORP.
#
# IPFIREWALL enables support for IP firewall construction, in
# conjunction with the `ipfw' program. IPFIREWALL_VERBOSE sends
# logged packets to the system logger. IPFIREWALL_VERBOSE_LIMIT
# limits the number of times a matching entry can be logged.
#
# WARNING: IPFIREWALL defaults to a policy of "deny ip from any to any"
# and if you do not add other rules during startup to allow access,
# YOU WILL LOCK YOURSELF OUT. It is suggested that you set firewall_type=open
# in /etc/rc.conf when first enabling this feature, then refining the
# firewall rules in /etc/rc.firewall after you've tested that the new kernel
# feature works properly.
#
# IPFIREWALL_DEFAULT_TO_ACCEPT causes the default rule (at boot) to
# allow everything. Use with care, if a cracker can crash your
# firewall machine, they can get to your protected machines. However,
# if you are using it as an as-needed filter for specific problems as
# they arise, then this may be for you. Changing the default to 'allow'
# means that you won't get stuck if the kernel and /sbin/ipfw binary get
# out of sync.
#
# IPDIVERT enables the divert IP sockets, used by ``ipfw divert''. It
# depends on IPFIREWALL if compiled into the kernel.
#
# IPFIREWALL_NAT adds support for in kernel nat in ipfw, and it requires
# LIBALIAS.
#
# IPFIREWALL_NAT64 adds support for in kernel NAT64 in ipfw.
#
# IPFIREWALL_NPTV6 adds support for in kernel NPTv6 in ipfw.
#
# IPFIREWALL_PMOD adds support for protocols modification module. Currently
# it supports only TCP MSS modification.
#
# IPSTEALTH enables code to support stealth forwarding (i.e., forwarding
# packets without touching the TTL). This can be useful to hide firewalls
# from traceroute and similar tools.
#
# PF_DEFAULT_TO_DROP causes the default pf(4) rule to deny everything.
#
# TCPDEBUG enables code which keeps traces of the TCP state machine
# for sockets with the SO_DEBUG option set, which can then be examined
# using the trpt(8) utility.
#
# TCPPCAP enables code which keeps the last n packets sent and received
# on a TCP socket.
#
# TCP_BLACKBOX enables enhanced TCP event logging.
#
# TCP_HHOOK enables the hhook(9) framework hooks for the TCP stack.
#
# RADIX_MPATH provides support for equal-cost multi-path routing.
#
options MROUTING # Multicast routing
options IPFIREWALL #firewall
options IPFIREWALL_VERBOSE #enable logging to syslogd(8)