-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathhyperion.config
More file actions
4985 lines (4679 loc) ยท 202 KB
/
hyperion.config
File metadata and controls
4985 lines (4679 loc) ยท 202 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#
#
# HYPERION KERNEL v2.2.4 -- Linux 6.19.6
# Author: Soumalya Das | Year: 2026 | Arch: x86_64
#
# Goal: MONOLITHIC BEAST -- Zero modules, all built-in
# Universal daily-driver - DKMS-safe - Zero OOM
# God-tier: gamers - devs - modders - hobbyists
#
# Sources: CachyOS - XanMod - Nobara - Liquorix - Arch -
# Fedora - Ubuntu - kernel.org - LKML - Phoronix -
# r/linux_gaming - XDA - ChromeOS/Android kernel teams
# sched-ext/scx - CachyOS-Settings - RHEL Perf Guide
# SELinux/NSA - kernel.org/doc/html/latest/security/
#
#
# Compiler: gcc (GCC) 2.2.4
#
CONFIG_CC_VERSION_TEXT="gcc (GCC) 14.2.0"
CONFIG_CC_IS_GCC=y
CONFIG_GCC_VERSION=140200
CONFIG_CLANG_VERSION=0
CONFIG_AS_IS_GNU=y
CONFIG_AS_VERSION=23800
CONFIG_LD_IS_BFD=y
CONFIG_LD_VERSION=23800
CONFIG_LLD_VERSION=0
# RUST: Rust language support in the Linux kernel.
# Required for new Rust-based kernel drivers (Apple Silicon GPU,
# NVMe-rust, network drivers in development). Zero overhead when
# no Rust drivers are loaded. Requires rustc >= 1.78 + bindgen.
# Source: rust-for-linux.com, merged Linux 6.1 (Linus Torvalds)
CONFIG_RUST_IS_AVAILABLE=y
CONFIG_HAVE_RUST=y
CONFIG_RUST=y
CONFIG_RUST_BUILD_ASSERT_ALLOW=n
# ==============================================================
# KERNEL IDENTITY
# uname -r -> 6.19.6-Hyperion-2.2.4
# uname -v -> #1 SMP PREEMPT Linux 6.19.6-Hyperion-2.2.4 (Soumalya Das) 2026
# ==============================================================
CONFIG_VERSION=6
CONFIG_PATCHLEVEL=19
CONFIG_SUBLEVEL=6
CONFIG_EXTRAVERSION=""
CONFIG_LOCALVERSION="-Hyperion-2.2.4"
CONFIG_LOCALVERSION_AUTO=n
CONFIG_BUILD_SALT=""
CONFIG_DEFAULT_HOSTNAME="hyperion"
# ==============================================================
# COMPILER OPTIMISATION
# CC_OPTIMIZE_FOR_PERFORMANCE: -O2 with arch-specific tuning
# Source: Clear Linux, CachyOS, XanMod build configs
# ==============================================================
CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
CONFIG_WERROR=n
CONFIG_COMPILE_TEST=n
# ==============================================================
# LINK-TIME OPTIMISATION (LTO) -- GCC build
# With GCC, Thin-LTO is only available via Clang (CONFIG_LTO_CLANG_THIN).
# For GCC builds, link-time optimisation is achieved via -flto=auto
# passed in KCFLAGS/CFLAGS. The Kconfig option below documents this.
# To enable Clang ThinLTO: rebuild with CC=clang LD=ld.lld AR=llvm-ar.
# GCC perf flags (pass via: make KCFLAGS="...")):
# -fivopts -- induction variable optimisation (tight loops)
# -fmodulo-sched -- software pipelining (audio, codec inner loops)
# -fno-semantic-interposition -- faster function calls in vmlinux DSO
# -fgraphite-identity -- Graphite loop transforms (GCC >= 12)
# Source: Clear Linux CFLAGS, CachyOS build system, gentoo/make.conf
# Usage: make -j$(nproc) KCFLAGS="-fivopts -fmodulo-sched -fno-semantic-interposition"
# ==============================================================
CONFIG_LTO_NONE=y
# ZSTD kernel compression: fastest decompression at boot
# Benchmark: ~40% faster than GZIP on NVMe (Phoronix)
CONFIG_HAVE_KERNEL_GZIP=y
CONFIG_HAVE_KERNEL_BZIP2=y
CONFIG_HAVE_KERNEL_LZMA=y
CONFIG_HAVE_KERNEL_XZ=y
CONFIG_HAVE_KERNEL_LZO=y
CONFIG_HAVE_KERNEL_LZ4=y
CONFIG_HAVE_KERNEL_ZSTD=y
# CONFIG_KERNEL_GZIP is not set
# CONFIG_KERNEL_BZIP2 is not set
# CONFIG_KERNEL_LZMA is not set
# CONFIG_KERNEL_XZ is not set
# CONFIG_KERNEL_LZO is not set
# CONFIG_KERNEL_LZ4 is not set
CONFIG_KERNEL_ZSTD=y
# ==============================================================
# GENERAL SETUP
# ==============================================================
CONFIG_INIT_ENV_ARG_LIMIT=32
CONFIG_SWAP=y
CONFIG_SYSVIPC=y
CONFIG_SYSVIPC_SYSCTL=y
CONFIG_POSIX_MQUEUE=y
CONFIG_POSIX_MQUEUE_SYSCTL=y
CONFIG_WATCH_QUEUE=y
CONFIG_CROSS_MEMORY_ATTACH=y
CONFIG_USELIB=n
CONFIG_AUDIT=y
CONFIG_AUDITSYSCALL=y
CONFIG_AUDIT_WATCH=y
CONFIG_AUDIT_TREE=y
CONFIG_MULTIUSER=y
CONFIG_SGETMASK_SYSCALL=y
CONFIG_SYSFS_SYSCALL=y
CONFIG_FHANDLE=y
CONFIG_POSIX_TIMERS=y
CONFIG_PRINTK=y
CONFIG_PRINTK_NMI=y
CONFIG_BUG=y
CONFIG_ELF_CORE=y
CONFIG_BASE_FULL=y
CONFIG_FUTEX=y
CONFIG_FUTEX_PI=y
CONFIG_EPOLL=y
CONFIG_SIGNALFD=y
CONFIG_TIMERFD=y
CONFIG_EVENTFD=y
CONFIG_SHMEM=y
CONFIG_AIO=y
# IO_URING: Critical for Proton/Wine, databases, async IO
# Every modern high-performance storage app uses this
CONFIG_IO_URING=y
CONFIG_ADVISE_SYSCALLS=y
CONFIG_MEMBARRIER=y
# KALLSYMS: Required for BPF, perf, crash analysis, DKMS symbol lookups
CONFIG_KALLSYMS=y
# KALLSYMS_ALL: With everything built-in we can afford full symbol table
# Required for sched_ext BPF schedulers and advanced BPF introspection
CONFIG_KALLSYMS_ALL=y
# RSEQ: Restartable sequences -- huge perf win for glibc 2.35+ and jemalloc
# Reference: https://www.efficios.com/blog/2019/02/08/linux-restartable-sequences/
CONFIG_RSEQ=y
CONFIG_EMBEDDED=n
CONFIG_PERF_EVENTS=y
# KPROBES: Dynamic kernel probe points for BPF, perf probe, SystemTap.
# Required for BPF kprobe programs (bcc tools: execsnoop, opensnoop,
# biolatency, etc.) and perf-probe based developer profiling.
# Also required by KRETPROBES for function return tracing.
# Zero overhead when no probes are active -- probed sites are NOPs.
# Source: kernel.org/doc/html/latest/trace/kprobes.html
CONFIG_KPROBES=y
CONFIG_KRETPROBES=y
CONFIG_KPROBE_EVENTS=y
# UPROBE_EVENTS: Userspace probe points for BPF + perf.
# Enables tracing of user-space function entry/exit -- used by
# bpftrace, bcc, and perf probe for application profiling without
# source instrumentation (Java, Go, Rust, C++).
CONFIG_UPROBE_EVENTS=y
# Task accounting: enables PSI, latency tracking -- no more mystery slowdowns
CONFIG_TASKSTATS=y
CONFIG_TASK_DELAY_ACCT=y
CONFIG_TASK_IO_ACCOUNTING=y
CONFIG_VM_EVENT_COUNTERS=y
CONFIG_PROC_FS=y
CONFIG_PROC_KCORE=y
CONFIG_PROC_VMCORE=y
CONFIG_PROC_PAGE_MONITOR=y
CONFIG_PROC_CHILDREN=y
CONFIG_SYSFS=y
CONFIG_TMPFS=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_TMPFS_XATTR=y
CONFIG_MEMFD_CREATE=y
CONFIG_CONFIGFS_FS=y
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
# DEVTMPFS explanation: automatically creates /dev entries when drivers probe
# Without this, device nodes are missing after module loads -- silent failure
CONFIG_UNIX98_PTYS=y
CONFIG_INOTIFY_USER=y
CONFIG_FANOTIFY=y
CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
# IKCONFIG: /proc/config.gz always available -- essential for debugging DKMS failures
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
# IKHEADERS: /sys/kernel/kheaders.tar.xz -- headers available at runtime
# This is the DKMS fallback when /usr/src headers are somehow missing
# Source: DKMS best practices, kernel.org documentation
CONFIG_IKHEADERS=y
# ==============================================================
# MODULE SUPPORT -- kept for DKMS external modules ONLY
# All in-tree drivers/features are built-in (=y). Loadable module
# infrastructure is retained so DKMS (NVIDIA, v4l2loopback, etc.)
# can still insert external .ko files. Every in-kernel feature has
# been compiled directly into the bzImage -- no initramfs module loads
# needed for hardware support.
# ==============================================================
CONFIG_MODULES=y
# Allow forcing load of tainted modules (needed for some vendor modules)
CONFIG_MODULE_FORCE_LOAD=n
# Allow modules to be unloaded -- required for DKMS module reinstall
CONFIG_MODULE_UNLOAD=y
CONFIG_MODULE_FORCE_UNLOAD=n
# MODVERSIONS: Every exported kernel symbol gets a CRC checksum
# ABI mismatch -> clean rejection at insmod, not a kernel panic
# This is THE most important setting for DKMS stability
CONFIG_MODVERSIONS=y
# MODULE_SRCVERSION_ALL: Embeds srcversion hash in every module
# Enables exact module tracing -- know which source built which .ko
CONFIG_MODULE_SRCVERSION_ALL=y
# Module signing: OFF by default -- enables DKMS to sign its own modules
# Enable CONFIG_MODULE_SIG=y only on Secure Boot systems with:
# scripts/sign-modules.sh
# CONFIG_MODULE_SIG is not set
CONFIG_MODULE_COMPRESS_NONE=y
CONFIG_MODULE_COMPRESS_GZIP=n
CONFIG_MODULE_COMPRESS_XZ=n
CONFIG_MODULE_COMPRESS_ZSTD=n
CONFIG_MODPROBE_PATH="/sbin/modprobe"
CONFIG_TRIM_UNUSED_KSYMS=n
# ==============================================================
# BLOCK LAYER
# ==============================================================
CONFIG_BLOCK=y
# BLK_DEV_INITRD: CRITICAL -- without this, rdinit=/init and initramfs both fail.
# This is what makes the kernel unpack the initramfs and find /init.
# Root cause of: "check access for rdinit=/init failed: -2"
CONFIG_BLK_DEV_INITRD=y
CONFIG_INITRAMFS_SOURCE=""
CONFIG_RD_GZIP=y
CONFIG_RD_BZIP2=y
CONFIG_RD_LZMA=y
CONFIG_RD_XZ=y
CONFIG_RD_LZO=y
CONFIG_RD_LZ4=y
CONFIG_RD_ZSTD=y
CONFIG_BLK_DEV_BSG=y
CONFIG_BLK_DEV_INTEGRITY=y
# BLK_DEV_LOOP: Loop block device driver.
# BOOT-CRITICAL for Arch ISO: archiso mounts airootfs.sfs through a loop
# device. Without this the ISO boot chain fails at:
# losetup: failed to set up loop device
# Boot chain: ISO -> loop device -> squashfs root -> overlay tmpfs -> systemd
# Must be =y (built-in), not =m. If it is a module it may not be available
# early enough in the initramfs before the squashfs root is mounted.
CONFIG_BLK_DEV_LOOP=y
# Minimum number of pre-allocated loop devices at boot.
# archiso uses at least 1 (airootfs.sfs). 8 leaves headroom for additional
# loop mounts in the live session (AppImage, additional squashfs layers).
CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
CONFIG_BLK_DEV_ZONED=y
CONFIG_BLK_WBT=y
# IO throttling: prevents one process from starving others under disk load
CONFIG_BLK_DEV_THROTTLING=y
CONFIG_BLK_DEV_THROTTLING_LOW=y
CONFIG_BLK_CGROUP_IOLATENCY=y
CONFIG_BLK_CGROUP_IOCOST=y
CONFIG_BLK_CGROUP_IOPRIO=y
CONFIG_BLK_DEBUG_FS=y
CONFIG_BLK_SED_OPAL=y
CONFIG_BLK_INLINE_ENCRYPTION=y
CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y
CONFIG_PARTITION_ADVANCED=y
CONFIG_MSDOS_PARTITION=y
CONFIG_EFI_PARTITION=y
# ==============================================================
# EFI / UEFI RUNTIME -- Real hardware boot (was entirely absent)
# Without CONFIG_EFI=y the kernel silently drops all UEFI runtime
# services. efibootmgr, systemd-boot, and GRUB EFI all break silently.
#
# CONFIG_EFI_STUB=y: Makes bzImage a valid .efi executable.
# Every modern distro (Arch, Fedora, Ubuntu, Debian) enables this.
# UEFI firmware can then boot the kernel directly without GRUB.
# Source: kernel.org EFI boot stub docs, ArchWiki EFI boot stub
#
# CONFIG_EFIVAR_FS=m: /sys/firmware/efi/efivars -- exposes UEFI NVRAM
# to userspace. Required by efibootmgr, systemd, fwupd (LVFS).
# Source: ArchWiki UEFI, kernel.org efivarfs docs
# ==============================================================
CONFIG_EFI=y
CONFIG_EFI_STUB=y
CONFIG_EFIVAR_FS=y
# ==============================================================
# IO SCHEDULERS
# BFQ: Best for desktop + gaming -- per-process fairness, low latency
# Default on Fedora, Ubuntu, Linux Mint, openSUSE
# Source: Paolo Valente (Universita di Modena), Phoronix benchmarks
# Kyber: Best for NVMe -- simple, low-overhead, targets latency targets
# Deadline: Reliable fallback for mixed/server workloads
# ==============================================================
CONFIG_MQ_IOSCHED_DEADLINE=y
CONFIG_MQ_IOSCHED_KYBER=y
CONFIG_IOSCHED_BFQ=y
CONFIG_BFQ_GROUP_IOSCHED=y
# ADIOS: Adaptive Deadline I/O Scheduler (CachyOS 2025).
# Predicts I/O request latency using per-queue historical data and
# dynamically adjusts deadlines to prevent starvation while keeping
# interactive I/O fast. Combines the best of deadline and BFQ:
# - Deadline's simplicity and determinism for NVMe
# - BFQ's per-process fairness for desktop mixed workloads
# Measurably beats Kyber and BFQ on game-loading + background
# compile mixed workloads (CachyOS internal benchmarks, 2025).
# Source: github.com/CachyOS/linux-cachyos, ADIOS patchset
# Default: set ADIOS as the default scheduler for NVMe devices.
CONFIG_IOSCHED_ADIOS=y
CONFIG_DEFAULT_IOSCHED="adios"
# ==============================================================
# PROCESSOR FEATURES
# ==============================================================
CONFIG_SMP=y
CONFIG_X86_64=y
CONFIG_64BIT=y
CONFIG_X86=y
CONFIG_X86_X2APIC=y
CONFIG_X86_MPPARSE=y
CONFIG_X86_CPU_RESCTRL=y
CONFIG_X86_EXTENDED_PLATFORM=y
CONFIG_X86_INTEL_LPSS=y
CONFIG_X86_AMD_PLATFORM_DEVICE=y
CONFIG_IOSF_MBI=y
CONFIG_SCHED_OMIT_FRAME_POINTER=y
CONFIG_HYPERVISOR_GUEST=y
CONFIG_PARAVIRT=y
CONFIG_PARAVIRT_XXL=y
CONFIG_PARAVIRT_SPINLOCKS=y
CONFIG_KVM_GUEST=y
CONFIG_PVH=y
CONFIG_GENERIC_CPU=y
CONFIG_X86_TSC=y
CONFIG_X86_CMOV=y
CONFIG_X86_MINIMUM_CPU_FAMILY=64
CONFIG_IA32_FEAT_CTL=y
CONFIG_CPU_SUP_INTEL=y
CONFIG_CPU_SUP_AMD=y
CONFIG_CPU_SUP_HYGON=y
CONFIG_CPU_SUP_CENTAUR=y
CONFIG_CPU_SUP_ZHAOXIN=y
CONFIG_HPET_TIMER=y
CONFIG_HPET_EMULATE_RTC=y
CONFIG_DMI=y
CONFIG_NR_CPUS=512
CONFIG_SCHED_SMT=y
CONFIG_SCHED_MC=y
CONFIG_SCHED_MC_PRIO=y
CONFIG_SCHED_CLUSTER=y
# SCHED_CORE: Prevents SMT sibling starvation -- measurable win on HyperThreaded CPUs
CONFIG_SCHED_CORE=y
# SCHED_AUTOGROUP: Groups interactive tasks by session
# Shell/GUI feel much more responsive under compilation load
# Source: Con Kolivas, merged mainline, default in Ubuntu/Fedora
CONFIG_SCHED_AUTOGROUP=y
# SCHED_HRTICK: High-resolution scheduler ticks via hrtimers.
# Allows the scheduler to preempt at sub-millisecond boundaries --
# critical for PipeWire quantum timing (64-frame @ 48 kHz = 1.3 ms)
# and game frame pacing at >120 FPS. Without this, CFS only fires at
# the coarse HZ=1000 tick even with HIGH_RES_TIMERS=y.
# Source: Ingo Molnar, CachyOS, Nobara (enabled by default in both)
CONFIG_SCHED_HRTICK=y
# HIGH_RES_TIMERS: Sub-millisecond timer precision
# Required for: audio at low latency, smooth game frame pacing, HPET
CONFIG_HIGH_RES_TIMERS=y
# IRQ_TIME_ACCOUNTING: More accurate CPU time stats in /proc
CONFIG_IRQ_TIME_ACCOUNTING=y
CONFIG_BSD_PROCESS_ACCT=y
CONFIG_BSD_PROCESS_ACCT_V3=y
CONFIG_X86_LOCAL_APIC=y
CONFIG_X86_IO_APIC=y
CONFIG_X86_MCE=y
CONFIG_X86_MCE_INTEL=y
CONFIG_X86_MCE_AMD=y
CONFIG_X86_MCE_THRESHOLD=y
CONFIG_X86_THERMAL_VECTOR=y
CONFIG_MICROCODE=y
CONFIG_MICROCODE_INTEL=y
CONFIG_MICROCODE_AMD=y
CONFIG_MICROCODE_INITRD_EARLY=y
CONFIG_X86_MSR=y
CONFIG_X86_CPUID=y
# ==============================================================
# TICKLESS / HZ
# NO_HZ_FULL: Fully adaptive ticks -- CPUs running single threads
# get NO timer interrupts (huge win for ML, video encode)
# HZ_1000: 1ms scheduler tick granularity
# Liquorix/CachyOS/Nobara all use HZ=1000
# Source: https://www.kernel.org/doc/html/latest/timers/no_hz.html
# ==============================================================
CONFIG_NO_HZ_FULL=y
CONFIG_NO_HZ=y
CONFIG_HZ_1000=y
CONFIG_HZ=1000
CONFIG_KEXEC=y
CONFIG_KEXEC_FILE=y
CONFIG_PHYSICAL_START=0x1000000
CONFIG_RELOCATABLE=y
CONFIG_RANDOMIZE_BASE=y
CONFIG_PHYSICAL_ALIGN=0x200000
CONFIG_DYNAMIC_MEMORY_LAYOUT=y
CONFIG_RANDOMIZE_MEMORY=y
CONFIG_HOTPLUG_CPU=y
CONFIG_MODIFY_LDT_SYSCALL=y
CONFIG_NUMA=y
CONFIG_AMD_NUMA=y
CONFIG_X86_64_ACPI_NUMA=y
# CONFIG_NUMA_EMU is not set
CONFIG_NODES_SHIFT=6
CONFIG_SPARSEMEM=y
CONFIG_SPARSEMEM_EXTREME=y
CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
CONFIG_SPARSEMEM_VMEMMAP=y
CONFIG_MEMORY_ISOLATION=y
CONFIG_MEMORY_HOTPLUG=y
CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y
CONFIG_MEMORY_HOTREMOVE=y
CONFIG_COMPACTION=y
CONFIG_MIGRATION=y
CONFIG_ZONE_DMA=y
CONFIG_ZONE_DMA32=y
CONFIG_BOUNCE=y
CONFIG_MMU_NOTIFIER=y
# KSM: Kernel Same-page Merging -- saves RAM for VMs running same OS
CONFIG_KSM=y
CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
CONFIG_MEMORY_FAILURE=y
# THP MADVISE: Apps/games that know they benefit can opt in
# ALWAYS wastes memory on small allocations -- MADVISE is the correct choice
CONFIG_TRANSPARENT_HUGEPAGE=y
# CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set
CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
CONFIG_THP_SWAP=y
CONFIG_READ_ONLY_THP_FOR_FS=y
CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y
# Stronger ASLR entropy -- 32-bit randomisation space
CONFIG_ARCH_MMAP_RND_BITS=32
CONFIG_ARCH_MMAP_RND_COMPAT_BITS=16
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y
CONFIG_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR_STRONG=y
CONFIG_STRICT_KERNEL_RWX=y
CONFIG_STRICT_MODULE_RWX=y
# CONFIG_PAGE_TABLE_CHECK is not set
# Spectre/Meltdown -- keep mitigations ON
# Gaming perf loss is <3% on modern hardware (Phoronix 2023)
CONFIG_PAGE_TABLE_ISOLATION=y
CONFIG_RETPOLINE=y
# ==============================================================
# IOMMU
# ==============================================================
CONFIG_IOMMU_SUPPORT=y
CONFIG_INTEL_IOMMU=y
# Leave IOMMU default OFF -- enable via boot param intel_iommu=on
# Forced ON breaks some hardware; opt-in is safer
CONFIG_INTEL_IOMMU_DEFAULT_ON=n
CONFIG_INTEL_IOMMU_SVM=y
CONFIG_IRQ_REMAP=y
CONFIG_AMD_IOMMU=y
CONFIG_AMD_IOMMU_V2=y
# IOMMU_SVA: Shared Virtual Addressing -- allows VFIO devices and
# GPU compute contexts to share address space with the CPU process.
# Required for: heterogeneous compute (OpenCL, SYCL), RDMA over VFIO,
# DMA-BUF sharing between GPU and NVMe (P2PDMA + IOMMU SVA).
# Source: Jacob Pan (Intel), merged Linux 5.14
CONFIG_IOMMU_SVA=y
# INTEL_IOMMU_PERF_EVENTS: VT-d IOMMU performance counters.
# Exposes IOMMU cache hit rates, fault counts, and queue depths
# to perf. Zero overhead when not sampling; critical for VFIO profiling.
CONFIG_INTEL_IOMMU_PERF_EVENTS=y
# X86_MEM_ENCRYPT: Umbrella Kconfig for all x86 transparent memory
# encryption (AMD SME/SEV, Intel TME/TDX). Required for KVM_AMD_SEV
# to actually encrypt guest pages; without this the SEV ioctl returns ENODEV.
# Source: AMD APM Vol 2, Intel TME spec, kernel.org/doc/html/latest/x86/
CONFIG_X86_MEM_ENCRYPT=y
# AMD_MEM_ENCRYPT: AMD Secure Memory Encryption driver.
# SME -- transparently encrypts all DRAM with one ephemeral key.
# Enable at boot with: mem_encrypt=on
# SEV -- per-VM encryption; hypervisor cannot read guest RAM.
# SEV-ES -- also encrypts guest CPU register state on every VM exit.
# Active-by-default=n keeps opt-in via cmdline (avoids breaking non-EPYC hw).
# Source: Brijesh Singh / Tom Lendacky (AMD), linux-kernel.org/doc/virt/kvm
CONFIG_AMD_MEM_ENCRYPT=y
CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n
# INTEL_TDX_GUEST: Enable this kernel to boot as a TDX (Trust Domain
# Extensions) guest inside an Intel TDX-capable hypervisor/VMM.
# Zero overhead on non-TDX platforms -- early detection via CPUID.
# Source: Intel TDX Architecture Spec 1.5, merged Linux 6.7
CONFIG_INTEL_TDX_GUEST=y
# ==============================================================
# PREEMPTION
# CONFIG_PREEMPT: Full preemption -- lowest scheduling latency
# CONFIG_PREEMPT_DYNAMIC: Switch model at boot via preempt= param
# preempt=none -> server/throughput
# preempt=voluntary -> balanced
# preempt=full -> gaming/desktop (default for Hyperion)
# Source: Liquorix (full preempt), CachyOS (dynamic preempt)
# ==============================================================
CONFIG_PREEMPT=y
CONFIG_PREEMPT_BUILD=y
CONFIG_PREEMPT_COUNT=y
CONFIG_PREEMPTION=y
CONFIG_PREEMPT_RCU=y
CONFIG_PREEMPT_DYNAMIC=y
# PREEMPT_LAZY: Linux 6.12+ "lazy preemption" mode -- between voluntary
# and full preemption. Defers preemption to natural reschedule points
# for throughput tasks while still preempting in IRQ/softirq context.
# With PREEMPT_DYNAMIC=y you can switch at boot:
# preempt=none -> server throughput
# preempt=voluntary -> balanced
# preempt=lazy -> dev/compile workloads (lazy mode)
# preempt=full -> gaming/audio (maximum responsiveness)
# Source: Peter Zijlstra, Thomas Gleixner -- merged Linux 6.12
CONFIG_PREEMPT_LAZY=y
# ==============================================================
# CPU IDLE
# TEO governor: best accuracy for sleep state selection
# Reduces wakeup latency vs MENU governor by ~15% (Intel measurements)
# ==============================================================
CONFIG_CPU_IDLE=y
CONFIG_CPU_IDLE_GOV_LADDER=y
CONFIG_CPU_IDLE_GOV_MENU=y
CONFIG_CPU_IDLE_GOV_TEO=y
CONFIG_CPU_IDLE_GOV_HALTPOLL=y
CONFIG_HALTPOLL_CPUIDLE=y
# INTEL_IDLE: Native Intel C-state driver -- required for C6/C8/C10 states
# Without this Intel CPUs fall back to ACPI idle, missing deep sleep states
CONFIG_INTEL_IDLE=y
# ==============================================================
# CPU FREQUENCY SCALING
# Performance governor default: all cores always at max boost
# AMD P-State mode 3 (Active EPP): Hardware-managed perf states
# -- best Zen3/4 single-core boost behaviour
# -- Phoronix 2023: 5-15% better gaming fps vs passive mode
# schedutil available for battery/power-saving profiles
# ==============================================================
CONFIG_CPU_FREQ=y
CONFIG_CPU_FREQ_STAT=y
CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
CONFIG_CPU_FREQ_GOV_POWERSAVE=y
CONFIG_CPU_FREQ_GOV_USERSPACE=y
CONFIG_CPU_FREQ_GOV_ONDEMAND=y
CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
CONFIG_X86_INTEL_PSTATE=y
CONFIG_X86_AMD_PSTATE=y
CONFIG_X86_AMD_PSTATE_DEFAULT_MODE=3
CONFIG_X86_ACPI_CPUFREQ=y
CONFIG_X86_ACPI_CPUFREQ_CPB=y
# ==============================================================
# ACPI / POWER MANAGEMENT
# ==============================================================
CONFIG_ACPI=y
CONFIG_ACPI_SLEEP=y
CONFIG_ACPI_AC=y
CONFIG_ACPI_BATTERY=y
CONFIG_ACPI_BUTTON=y
CONFIG_ACPI_FAN=y
CONFIG_ACPI_DOCK=y
CONFIG_ACPI_CPU_FREQ_PSS=y
CONFIG_ACPI_PROCESSOR_CSTATE=y
CONFIG_ACPI_PROCESSOR_IDLE=y
CONFIG_ACPI_THERMAL=y
CONFIG_ACPI_TABLE_UPGRADE=y
CONFIG_ACPI_PCI_SLOT=y
CONFIG_ACPI_CONTAINER=y
CONFIG_ACPI_HOTPLUG_IOAPIC=y
CONFIG_ACPI_HED=y
CONFIG_ACPI_BGRT=y
CONFIG_ACPI_NFIT=y
CONFIG_ACPI_NUMA=y
CONFIG_ACPI_HMAT=y
CONFIG_ACPI_APEI=y
CONFIG_ACPI_APEI_GHES=y
CONFIG_ACPI_APEI_PCIEAER=y
CONFIG_ACPI_APEI_MEMORY_FAILURE=y
CONFIG_ACPI_APEI_EINJ=y
CONFIG_ACPI_CPPC_LIB=y
CONFIG_ACPI_CPPC_CPUFREQ=y
# ACPI_CPPC_CPUFREQ_FAST_SWITCH: Enables the cpufreq fast-switch
# path for CPPC (AMD P-State passive). Allows frequency transitions
# from IRQ/scheduler context without locking -- eliminates the per-
# transition context-switch overhead in gaming and audio workloads.
# Source: Viresh Kumar, merged Linux 5.17
CONFIG_ACPI_CPPC_CPUFREQ_FAST_SWITCH=y
# ACPI_PLATFORM_PROFILE: exposes /sys/firmware/acpi/platform_profile
# (balanced / performance / low-power). Used by power-profiles-daemon
# which is the default power management backend on GNOME/KDE/Fedora.
CONFIG_ACPI_PLATFORM_PROFILE=y
# ACPI video: backlight control, brightness keys on all laptops
CONFIG_ACPI_VIDEO=y
# AMD HSMP: AMD Host System Management Port -- per-CCX power limits,
# boost override, and fabric bandwidth telemetry on EPYC/Threadripper.
CONFIG_AMD_HSMP=y
# AMD PMC: Power Management Controller -- enables s2idle (modern standby)
# on AMD Ryzen laptops. Without it, suspend-to-idle burns battery.
CONFIG_AMD_PMC=y
# AMD PMF: AMD Platform Management Framework -- dynamic power/performance
# profiles on Rembrandt (7xxx), Phoenix (7040), Hawk Point (8040)+.
# Enables "Smart Shift" eco/performance modes and AMD advantage features.
# Source: AMD, merged Linux 6.5+
CONFIG_AMD_PMF=y
# INTEL_HWP: Hardware-managed P-state -- Intel CPUs pick boost levels
# autonomously within EPP/EPB hints. Lower software overhead than sw governors.
CONFIG_X86_HWP=y
# CPU_FREQ_TIMES already present; add thermal pressure feedback
CONFIG_THERMAL_PRESSURE=y
CONFIG_PM=y
CONFIG_PM_SLEEP=y
CONFIG_SUSPEND=y
CONFIG_SUSPEND_FREEZER=y
CONFIG_HIBERNATION=y
# ==============================================================
# RUNTIME POWER MANAGEMENT -- Desktop-stable configuration
# ==============================================================
#
# WHY PM_RUNTIME IS KEPT ENABLED:
# CONFIG_PM_RUNTIME=y is mandatory infrastructure -- disabling it
# would break PCI, GPU, SATA, and NVMe power states entirely.
# The Linux USB autosuspend problem is NOT caused by PM_RUNTIME
# itself, but by the usbcore module's default autosuspend delay
# (2 seconds) and device-level power/control="auto" policy.
# The correct fix is surgical: set CONFIG_USB_AUTOSUSPEND_DELAY=-1
# at the kernel config level and enforce power/control="on" via
# udev rules for HID, audio, and input class devices.
# Disabling PM_RUNTIME globally would prevent GPU D3cold, NVMe
# APST, and PCIe link state management -- unacceptable regressions.
#
CONFIG_PM_RUNTIME=y
CONFIG_PM_CLK=y
CONFIG_PM_GENERIC_DOMAINS=y
CONFIG_ENERGY_MODEL=y
# ==============================================================
# USB AUTOSUSPEND -- PERMANENTLY DISABLED AT KERNEL DEFAULT LEVEL
# ==============================================================
#
# ROOT CAUSE OF USB INPUT/AUDIO DEVICE SLEEP:
# The Linux USB subsystem has an "autosuspend" mechanism that
# automatically suspends USB devices after an idle period. The
# kernel default is 2 seconds (USB_AUTOSUSPEND_DELAY=2). This
# causes keyboards to freeze mid-session, mice to stutter after
# brief pauses, and USB audio DACs to drop their connection --
# producing the classic "USB device reconnected" pop or silence.
#
# This is especially acute with xHCI (USB3 controllers) due to
# a known firmware/spec ambiguity that causes some controllers
# to drop power from ports more aggressively than EHCI did.
# References: kernel.org/doc/Documentation/usb/power-management.txt
# Sarah Sharp (Intel xHCI maintainer, 2013 analysis)
#
# CONFIG_USB_AUTOSUSPEND_DELAY=-1:
# Sets the KERNEL DEFAULT idle-delay for all USB devices to -1,
# meaning "never autosuspend". Every new USB device attached
# boots with autosuspend disabled -- no userspace daemon or udev
# rule required to catch it first.
#
# Without this, the 2-second default means that a USB keyboard
# pausing for 2+ seconds (e.g., while you read, while a cutscene
# plays, while the system is under GPU load with no mouse movement)
# will be suspended. The NEXT keypress wakes it, but the resume
# latency (5-50 ms depending on hub and device) causes a dropped
# first keystroke or a stuck modifier key.
#
# Setting -1 here is equivalent to adding usbcore.autosuspend=-1
# to the kernel cmdline -- but is now baked into the binary itself,
# making it the safe default even if the bootloader cmdline is lost.
# Source: drivers/usb/core/Kconfig, patchwork.kernel.org/2019/patch
# Mans Rullgard, Greg Kroah-Hartman review (2019)
#
CONFIG_USB_AUTOSUSPEND_DELAY=-1
# ==============================================================
# PCI
# ==============================================================
CONFIG_PCI=y
CONFIG_PCI_DIRECT=y
CONFIG_PCI_MMCONFIG=y
CONFIG_PCI_DOMAINS=y
CONFIG_PCIEPORTBUS=y
CONFIG_HOTPLUG_PCI_PCIE=y
CONFIG_PCIEAER=y
CONFIG_PCIEASPM=y
CONFIG_PCIEASPM_DEFAULT=y
CONFIG_PCIE_PME=y
CONFIG_PCIE_DPC=y
CONFIG_PCIE_PTM=y
CONFIG_PCIE_BW=y
CONFIG_PCIE_EDR=y
CONFIG_PCI_MSI=y
CONFIG_PCI_QUIRKS=y
CONFIG_PCI_REALLOC_ENABLE_AUTO=y
CONFIG_PCI_STUB=y
CONFIG_PCI_ATS=y
CONFIG_PCI_IOV=y
CONFIG_PCI_PASID=y
# P2PDMA: GPU/NVMe peer-to-peer DMA -- streaming game assets GPU<->NVMe
CONFIG_PCI_P2PDMA=y
CONFIG_PCIE_BUS_DEFAULT=y
CONFIG_HOTPLUG_PCI=y
CONFIG_HOTPLUG_PCI_ACPI=y
# ==============================================================
# EXECUTABLE FILE FORMATS
# ==============================================================
CONFIG_BINFMT_ELF=y
CONFIG_COMPAT_BINFMT_ELF=y
CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
CONFIG_BINFMT_SCRIPT=y
CONFIG_BINFMT_MISC=y
# ==============================================================
# MEMORY MANAGEMENT
# Key goal: defeat OOM before it happens; reclaim intelligently
# ==============================================================
CONFIG_ZPOOL=y
CONFIG_ZBUD=y
CONFIG_Z3FOLD=y
CONFIG_ZSMALLOC=y
# CONFIG_ZSMALLOC_STAT is not set
# ZSWAP: Compressed swap cache in RAM -- transparent swap that's 5-10x
# faster than disk swap. ZSTD: better ratio than LZ4, still fast.
# Source: Phoronix ZSTD vs LZ4 benchmarks, CachyOS config
CONFIG_ZSWAP=y
CONFIG_ZSWAP_DEFAULT_ON=y
CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC=y
# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4 is not set
CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD=y
# ZSWAP_SHRINKER: Evicts cold zswap entries back to disk before pool saturates
# Without this zswap silently fills up and stops accepting pages -- causes stalls
CONFIG_ZSWAP_SHRINKER_DEFAULT_ON=y
# ZRAM: Compressed block device in RAM for swap
CONFIG_ZRAM=y
CONFIG_ZRAM_WRITEBACK=y
# CONFIG_ZRAM_MEMORY_TRACKING is not set
CONFIG_ZRAM_DEF_COMP_ZSTD=y
CONFIG_MEM_SOFT_DIRTY=y
CONFIG_USERFAULTFD=y
# PER_VMA_LOCK: Per-VMA mmap locking -- reduces contention on multi-threaded workloads
# Significant win for games, browsers, JVMs. Merged 6.7, well-tested.
CONFIG_PER_VMA_LOCK=y
# MGLRU: Multi-Generational LRU -- Google's page reclaim algorithm
# Merged in Linux 6.1; default in Android, ChromeOS, CachyOS
# Reduces memory stutter by 16-30% under pressure (Google internal data)
# Reference: https://lore.kernel.org/lkml/20220407031525.2368067-1-yuzhao@google.com/
CONFIG_LRU_GEN=y
CONFIG_LRU_GEN_ENABLED=y
# CONFIG_LRU_GEN_STATS is not set
# PSI: Pressure Stall Information -- shows memory/CPU/IO pressure
# before processes are killed. Essential for no-silent-OOM goal.
CONFIG_PSI=y
CONFIG_PSI_DEFAULT_DISABLED=n
CONFIG_NUMA_BALANCING=y
CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y
# CONFIG_COMPACTION already set above -- duplicate suppressed
CONFIG_HUGETLBFS=y
CONFIG_HUGETLB_PAGE=y
# HUGETLB_PAGE_OPTIMIZE_VMEMMAP: Frees the struct page array used
# to describe each 4 KB sub-page inside a 2 MB huge page.
# Saves 7 struct page entries (448 bytes) per 2 MB THP -- meaningful
# on systems running games or JVMs with hundreds of thousands of THPs.
# Source: Muchun Song (ByteDance), merged Linux 5.14
CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
CONFIG_CMA=y
CONFIG_CMA_SIZE_SEL_MBYTES=y
CONFIG_CMA_SIZE_MBYTES=0
# DAMON: Data Access MONitor -- intelligent memory reclaim
# Developed by SeongJae Park (Amazon/kernel.org)
# DAMON_RECLAIM: automatically reclines cold pages before OOM
CONFIG_DAMON=y
CONFIG_DAMON_VADDR=y
CONFIG_DAMON_PADDR=y
CONFIG_DAMON_SYSFS=y
CONFIG_DAMON_RECLAIM=y
CONFIG_DAMON_LRU_SORT=y
# Skip zero-fill on alloc/free -- measurable perf gain, acceptable risk on desktop
# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
# SLUB: Best production allocator -- no debug overhead
# CONFIG_SLUB_DEBUG is not set
CONFIG_SLUB=y
CONFIG_SLUB_CPU_PARTIAL=y
# ==============================================================
# LATENCY MONITORING
# ==============================================================
CONFIG_LATENCYTOP=y
CONFIG_SCHEDSTATS=y
# ==============================================================
# NETWORKING
# ==============================================================
CONFIG_NET=y
CONFIG_PACKET=y
CONFIG_UNIX=y
CONFIG_UNIX_SCM=y
CONFIG_TLS=y
CONFIG_TLS_DEVICE=y
CONFIG_XFRM=y
CONFIG_XFRM_OFFLOAD=y
CONFIG_XFRM_STATISTICS=y
CONFIG_XFRM_ALGO=y
CONFIG_XFRM_USER=y
CONFIG_XFRM_INTERFACE=y
CONFIG_NET_KEY=y
CONFIG_INET=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IP_ROUTE_VERBOSE=y
CONFIG_NET_IPIP=y
CONFIG_NET_IPGRE_DEMUX=y
CONFIG_NET_IP_TUNNEL=y
CONFIG_NET_IPGRE=y
CONFIG_NET_IPGRE_BROADCAST=y
# L2TP: Layer 2 Tunneling Protocol -- used by many enterprise VPNs,
# ISP PPPoE/PPPoL2TP links, and some gaming VPN services.
# L2TP_V3: L2TPv3 Ethernet/VLAN/PPP pseudowires over IP.
CONFIG_L2TP=y
CONFIG_L2TP_DEBUGFS=n
CONFIG_L2TP_V3=y
CONFIG_L2TP_IP=y
CONFIG_L2TP_ETH=y
CONFIG_IP_MROUTE_COMMON=y
CONFIG_IP_MROUTE=y
CONFIG_IP_PIMSM_V1=y
CONFIG_IP_PIMSM_V2=y
CONFIG_SYN_COOKIES=y
CONFIG_NET_IPVTI=y
CONFIG_NET_UDP_TUNNEL=y
CONFIG_NET_FOU=y
CONFIG_INET_AH=y
CONFIG_INET_ESP=y
CONFIG_INET_IPCOMP=y
CONFIG_INET_TUNNEL=y
# Built-in (not module) -- ss, nethogs, systemd-networkd call this constantly
CONFIG_INET_DIAG=y
CONFIG_INET_TCP_DIAG=y
CONFIG_TCP_CONG_ADVANCED=y
CONFIG_TCP_CONG_BIC=y
CONFIG_TCP_CONG_CUBIC=y
CONFIG_TCP_CONG_WESTWOOD=y
CONFIG_TCP_CONG_HTCP=y
# BBR: Google's congestion control -- best gaming/streaming latency
# Avoids Reno/CUBIC's bufferbloat -- crucial on home ISP connections
# Source: https://github.com/google/bbr
CONFIG_TCP_CONG_BBR=y
CONFIG_DEFAULT_BBR=y
CONFIG_DEFAULT_TCP_CONG="bbr"
CONFIG_TCP_MD5SIG=y
CONFIG_IPV6=y
CONFIG_IPV6_ROUTER_PREF=y
CONFIG_IPV6_OPTIMISTIC_DAD=y
CONFIG_INET6_AH=y
CONFIG_INET6_ESP=y
CONFIG_INET6_IPCOMP=y
CONFIG_IPV6_MIP6=y
CONFIG_IPV6_VTI=y
CONFIG_IPV6_SIT=y
CONFIG_IPV6_TUNNEL=y
CONFIG_IPV6_GRE=y
CONFIG_IPV6_MULTIPLE_TABLES=y
CONFIG_IPV6_SUBTREES=y
CONFIG_IPV6_MROUTE=y
CONFIG_MPTCP=y
CONFIG_NETWORK_SECMARK=y
CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
CONFIG_BRIDGE_NETFILTER=y
CONFIG_NETFILTER_NETLINK=y
CONFIG_NETFILTER_FAMILY_BRIDGE=y
CONFIG_NETFILTER_FAMILY_ARP=y
CONFIG_NETFILTER_NETLINK_ACCT=y
CONFIG_NETFILTER_NETLINK_QUEUE=y
CONFIG_NETFILTER_NETLINK_LOG=y
CONFIG_NF_CONNTRACK=y
CONFIG_NF_LOG_SYSLOG=y
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_SECMARK=y
CONFIG_NF_CONNTRACK_ZONES=y
CONFIG_NF_CONNTRACK_PROCFS=y
CONFIG_NF_CONNTRACK_EVENTS=y
CONFIG_NF_CONNTRACK_TIMEOUT=y
CONFIG_NF_CONNTRACK_TIMESTAMP=y
CONFIG_NF_CONNTRACK_FTP=y
CONFIG_NF_CONNTRACK_IRC=y
CONFIG_NF_CONNTRACK_SIP=y
CONFIG_NF_CT_NETLINK=y
CONFIG_NF_NAT=y
CONFIG_NF_NAT_MASQUERADE=y
CONFIG_NETFILTER_SYNPROXY=y
CONFIG_NF_TABLES=y
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NFT_NUMGEN=y
CONFIG_NFT_CT=y
CONFIG_NFT_CONNLIMIT=y
CONFIG_NFT_LOG=y
CONFIG_NFT_LIMIT=y
CONFIG_NFT_MASQ=y
CONFIG_NFT_REDIR=y
CONFIG_NFT_NAT=y
CONFIG_NFT_QUOTA=y
CONFIG_NFT_REJECT=y
CONFIG_NFT_REJECT_INET=y
CONFIG_NFT_COMPAT=y
CONFIG_NFT_HASH=y
CONFIG_NFT_FIB=y
CONFIG_NFT_FIB_INET=y
CONFIG_NFT_XFRM=y
CONFIG_NFT_SOCKET=y
CONFIG_NFT_OSF=y
CONFIG_NFT_TPROXY=y
CONFIG_NFT_SYNPROXY=y
CONFIG_NF_FLOW_TABLE_INET=y
CONFIG_NF_FLOW_TABLE=y
CONFIG_NETFILTER_XTABLES=y
CONFIG_NETFILTER_XT_MARK=y
CONFIG_NETFILTER_XT_CONNMARK=y
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
CONFIG_NETFILTER_XT_TARGET_CT=y
CONFIG_NETFILTER_XT_TARGET_DSCP=y
CONFIG_NETFILTER_XT_TARGET_LOG=y
CONFIG_NETFILTER_XT_TARGET_MARK=y
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
CONFIG_NETFILTER_XT_TARGET_NETMAP=y
CONFIG_NETFILTER_XT_TARGET_NFLOG=y
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
CONFIG_NETFILTER_XT_TARGET_TEE=y
CONFIG_NETFILTER_XT_TARGET_TPROXY=y
# NETFILTER_XT_TARGET_CHECKSUM: Fix IP/TCP/UDP checksums on mangled packets.
# Critical for VM/container DHCP and DNS to work correctly -- without this
# guests behind NAT receive packets with bad checksums that are silently dropped.
# Source: Waydroid GitHub #network, Docker iptables rules
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
CONFIG_NETFILTER_XT_MATCH_DSCP=y
CONFIG_NETFILTER_XT_MATCH_ECN=y
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
CONFIG_NETFILTER_XT_MATCH_HELPER=y