DragonFly BSD


Configuring the DragonFly Kernel

Updated and restructured by Jim Mock. Originally contributed by Jake Hamby.


The kernel is the core of the DragonFly operating system. It is responsible for managing memory, enforcing security controls, networking, disk access, and much more. While more and more of DragonFly becomes dynamically configurable it is still occasionally necessary to reconfigure and recompile your kernel.

After reading this chapter, you will know:

Why Build a Custom Kernel?

Traditionally, DragonFly has had what is called a monolithic kernel. This means that the kernel was one large program, supported a fixed list of devices, and if you wanted to change the kernel's behavior then you had to compile a new kernel, and then reboot your computer with the new kernel.

Today, DragonFly is rapidly moving to a model where much of the kernel's functionality is contained in modules which can be dynamically loaded and unloaded from the kernel as necessary. This allows the kernel to adapt to new hardware suddenly becoming available (such as PCMCIA cards in a laptop), or for new functionality to be brought into the kernel that was not necessary when the kernel was originally compiled. This is known as a modular kernel. Colloquially these are called KLDs.

Despite this, it is still necessary to carry out some static kernel configuration. In some cases this is because the functionality is so tied to the kernel that it can not be made dynamically loadable. In others it may simply be because no one has yet taken the time to write a dynamic loadable kernel module for that functionality yet.

Building a custom kernel is one of the most important rites of passage nearly every UNIX® user must endure. This process, while time consuming, will provide many benefits to your DragonFly system. Unlike the generic kernel, which must support a wide range of hardware, a custom kernel only contains support for your PC's hardware. This has a number of benefits, such as:

Building and Installing a Custom Kernel

First, let us take a quick tour of the kernel build directory. All directories mentioned will be relative to the main /usr/src/sys directory, which is also accessible through /sys. There are a number of subdirectories here representing different parts of the kernel, but the most important, for our purposes, is config, where you will edit your custom kernel configuration, and compile, which is the staging area where your kernel will be built. Notice the logical organization of the directory structure, with each supported device, file system, and option in its own subdirectory.

Installing the Source

If there is no /usr/src/sys directory on your system, then the kernel source has not been installed. One method to do this is via git. An alternative is to install the kernel source tree from the archive distributed on the DragonFly CD named src-sys.tar.bz2. This is especially useful when you do not have ready access to the internet. Use the Makefile in /usr to fetch the source or to unpack the archive. When installing kernel source only, use the alternate build procedure below.

The preferred way of installing the sources is:

# cd /usr
# make src-create-shallow

This will download the last revision of the source tree via git into /usr/src. This method also allows for easy updating of the source tree by using:

# make src-update

You should edit the makefile located in /usr and change the GITHOST variable to one of the currently available git mirrors http://www.dragonflybsd.org/mirrors/. For example: GITHOST?=avalon.dragonflybsd.git

Your Custom Config File

Next, move to the config directory and copy the X86_64_GENERIC configuration file to the name you want to give your kernel. For example:

# cd /usr/src/sys/config

Traditionally, this name is in all capital letters and, if you are maintaining multiple DragonFly machines with different hardware, it is a good idea to name it after your machine's hostname. We will call it MYKERNEL for the purpose of this example.

Tip: Storing your kernel config file directly under /usr/src can be a bad idea. If you are experiencing problems it can be tempting to just delete /usr/src and start again. Five seconds after you do that you realize that you have deleted your custom kernel config file. Do not edit X86_64_GENERIC directly, as it may get overwritten the next time you update your source tree, and your kernel modifications will be lost. You might want to keep your kernel config file elsewhere, and then create a symbolic link to the file in the config directory.

For example:

# cd /usr/src/sys/config
# mkdir /root/kernels
# cp X86_64_GENERIC /root/kernels/MYKERNEL
# ln -s /root/kernels/MYKERNEL

Note: You must execute these and all of the following commands under the root account or you will get permission denied errors.

Now, edit MYKERNEL with your favorite text editor. If you are just starting out and are not familiar with vi, you can use an easier editor called ee, which is also part of the base system. Feel free to change the comment lines at the top to reflect your configuration or the changes you have made to differentiate it from X86_64_GENERIC.

If you have built a kernel under SunOS™ or some other BSD operating system, much of this file will be very familiar to you. If you are coming from some other operating system, on the other hand, the X86_64_GENERIC configuration file might seem overwhelming to you, so follow the descriptions in the Configuration File section slowly and carefully.

Building a Kernel - Full Source Tree

Note: Be sure to always check the file /usr/src/UPDATING, before you perform any update steps, in the case you sync your source tree with the latest sources of the DragonFly project. In this file all important issues with updating DragonFly are typed out. /usr/src/UPDATING always fits your version of the DragonFly source, and is therefore more accurate for new information than the handbook.

Note: Use -j N to parallelize the build targets. We don't recommend -j N (and there is no need for it either) for the install targets.

  1. Change to the /usr/src directory.

    # cd /usr/src
  2. Compile the kernel.

    # make -j 3 buildkernel KERNCONF=MYKERNEL
  3. Install the new kernel.

    # make installkernel KERNCONF=MYKERNEL

If you have not upgraded your source tree in any way since the last time you successfully completed a buildworld-installworld cycle (you have not run git pull ), then it is safe to use the quickworld and quickkernel, buildworld, buildkernel sequence.

Building a Kernel - Kernel Source Only

When only the kernel source is installed, you need to change step 2, above, to this:

# make nativekernel KERNCONF=MYKERNEL

The other steps are the same.

Running Your New Kernel

The installer copies the new kernel and modules to /boot/kernel/, the kernel being /boot/kernel/kernel and the modules being /boot/kernel/*.ko. The old kernel and modules are moved to /boot/kernel.old/. Now, shutdown the system and reboot to use your new kernel. In case something goes wrong, there are some troubleshooting instructions at the end of this chapter. Be sure to read the section which explains how to recover in case your new kernel does not boot.

Note: If you have added any new devices (such as sound cards), you may have to add some device nodes to your /dev directory before you can use them. For more information, take a look at device nodes section later on in this chapter.

The Configuration File

The general format of a configuration file is quite simple. Each line contains a keyword and one or more arguments. For simplicity, most lines only contain one argument. Anything following a # is considered a comment and ignored. The following sections describe the keywords of interest, generally in the order they are listed in X86_64_GENERIC, although some related keywords have been grouped together in a single section (such as Networking) even though they are actually scattered throughout the X86_64_GENERIC file. An exhaustive list of options and more detailed explanations of the device lines is present in the LINT64 configuration file, located in the same directory as X86_64_GENERIC. If you are in doubt as to the purpose or necessity of a line, check first in LINT64.

ident          X86_64_GENERIC

This is the identification of the kernel. You should change this to whatever you named your kernel, i.e. MYKERNEL if you have followed the instructions of the previous examples. The value you put in the ident string will print when you boot up the kernel, so it is useful to give the new kernel a different name if you want to keep it separate from your usual kernel (i.e. you want to build an experimental kernel).

maxusers          0

The maxusers option sets the size of a number of important system tables. This number is supposed to be roughly equal to the number of simultaneous users you expect to have on your machine.

The system will auto-tune this setting for you if you leave it to 0, which is recommended (the auto-tuning algorithm sets maxuser equal to the amount of memory in the system, with a minimum of 32, and a maximum of 384). If you want to manage it yourself you will want to set maxusers to at least 4, especially if you are using the X Window System or compiling software. The reason is that the most important table set by maxusers is the maximum number of processes, which is set to 20 + 16 * maxusers, so if you set maxusers to 1, then you can only have 36 simultaneous processes, including the 18 or so that the system starts up at boot time, and the 15 or so you will probably create when you start the X Window System. Even a simple task like reading a manual page will start up nine processes to filter, decompress, and view it. Setting maxusers to 64 will allow you to have up to 1044 simultaneous processes, which should be enough for nearly all uses. If, however, you see the dreaded proc table full error when trying to start another program, or are running a server with a large number of simultaneous users, you can always increase the number and rebuild.

Note: maxusers does not limit the number of users which can log into your machine. It simply sets various table sizes to reasonable values considering the maximum number of users you will likely have on your system and how many processes each of them will be running. One keyword which does limit the number of simultaneous remote logins and X terminal windows is pseudo-device pty 16 (see below).

# Pseudo devices - the number indicates how many units to allocate.
pseudo-device   loop          # Network loopback

This is the generic loopback device for TCP/IP. If you telnet or FTP to localhost (a.k.a., it will come back at you through this device. This is mandatory.

Everything that follows is more or less optional. See the notes underneath or next to each option for more information.

makeoptions     DEBUG=-g          #Build kernel with gdb(1) debug symbols

The normal build process of the DragonFly does not include debugging information when building the kernel and strips most symbols after the resulting kernel is linked, to save some space at the install location. If you are going to do tests of kernels in the DEVELOPMENT branch or develop changes of your own for the DragonFly kernel, you might want to leave this line uncommented; it will enable the use of the -g option which enables debugging information when passed to gcc(1).

options          INET          #InterNETworking

Networking support. Leave this in, even if you do not plan to be connected to a network. Most programs require at least loopback networking (i.e., making network connections within your PC), so this is essentially mandatory.

options          INET6          #IPv6 communications protocols

This enables the IPv6 communication protocols.

options          HAMMER       #Hammer Filesystem

This option enables the HAMMER file system; you can comment it out if your system uses only UFS/FFS as a file system.

options          FFS          #Berkeley Fast Filesystem
options          FFS_ROOT     #FFS usable as root device [keep this!]

This is the basic hard drive Filesystem. Leave it in if you boot from the hard disk.

options          UFS_DIRHASH  #Improve performance on big directories

This option includes functionality to speed up disk operations on large directories, at the expense of using additional memory. You would normally keep this for a large server, or interactive workstation, and remove it if you are using DragonFly on a smaller system where memory is at a premium and disk access speed is less important, such as a firewall.

options          SOFTUPDATES  #Enable FFS Soft Updates support

This option enables Soft Updates in the kernel, this will help speed up write access on UFS file systems. Even when this functionality is provided by the kernel, it must be turned on for specific disks. Review the output from mount(8) to see if Soft Updates is enabled for your system disks. If you do not see the soft-updates option then you will need to activate it using the tunefs(8) (for existing filesystems) or newfs(8) (for new filesystems) commands.

options          MFS          #Memory Filesystem
options          MD_ROOT      #MD is a potential root device

This is the memory-mapped filesystem. This is basically a RAM disk for fast storage of temporary files, useful if you have a lot of swap space that you want to take advantage of. A perfect place to mount an MFS partition is on the /tmp directory, since many programs store temporary data here. To mount an MFS RAM disk on /tmp, add the following line to /etc/fstab:

/dev/ad1s2b     /tmp mfs rw 0 0

Now you simply need to either reboot, or run the command mount /tmp.

options          NFS          #Network Filesystem
options          NFS_ROOT     #NFS usable as root device, NFS required

The network Filesystem. Unless you plan to mount partitions from a UNIX® file server over TCP/IP, you can comment these out.

options          MSDOSFS      #MSDOS Filesystem

The MS-DOS® FAT filesystem. Unless you plan to mount a DOS-formatted hard drive partition at boot time, you can safely comment this out. It will be automatically loaded the first time you mount a DOS partition, as described above. Also, the excellent mtools software (in DPorts) allows you to access DOS floppies without having to mount and unmount them (and does not require MSDOSFS at all).

options          CD9660       #ISO 9660 Filesystem

The ISO 9660 Filesystem for CDROMs. Comment it out if you do not have a CDROM drive or only mount data CDs occasionally (since it will be dynamically loaded the first time you mount a data CD). Audio CDs do not need this Filesystem.

options          PROCFS       #Process filesystem

The process filesystem. This is a pretend filesystem mounted on /proc which allows programs like ps(1) to give you more information on what processes are running.

#options    COMPAT_43       #Compatible with BSD 4.3

Compatibility with 4.3BSD. This should not be needed nowadays, but might be required for some old programs.

options          SCSI_DELAY=5000    #Delay (in ms) before probing SCSI

This causes the kernel to pause for 5 seconds before probing each SCSI device in your system. You may try to lower this number to speed up booting; of course, if you do this and DragonFly has trouble recognizing your SCSI devices, you will have to raise it back up.

options          UCONSOLE            #Allow users to grab the console

This is useful for X users. For example, you can create a console xterm by typing xterm -C, which will display any write(1), talk(1), and any other messages you receive, as well as any console messages sent by the kernel.

options          KTRACE              #ktrace(1) support

This enables kernel process tracing, which is useful in debugging.

options          SYSVSHM             #SYSV-style shared memory

This option provides for System V shared memory. The most common use of this is the XSHM extension in X, which many graphics-intensive programs will automatically take advantage of for extra speed. If you use X, you will definitely want to include this.

options          SYSVSEM             #SYSV-style semaphores

Support for System V semaphores. Less commonly used but only adds a few hundred bytes to the kernel.

options          SYSVMSG             #SYSV-style message queues

Support for System V messages. Again, only adds a few hundred bytes to the kernel.

Note: The ipcs(1) command will list any processes using each of these System V facilities.

options         P1003_1B                #Posix P1003_1B real-time extensions

Real-time extensions added in the 1993 POSIX®. Certain applications use these.

options         ICMP_BANDLIM            #Rate limit bad replies

This option enables ICMP error response bandwidth limiting. You typically want this option as it will help protect the machine from denial of service packet attacks.

device          isa

All PCs supported by DragonFly have one of these. Do not remove, even if you have no ISA slots. If you have an IBM PS/2 (Micro Channel Architecture), DragonFly provides some limited support at this time. For more information about the MCA support, see the LINT64 file.

device          pci

Include this if you have a PCI motherboard. This enables auto-detection of PCI cards and gatewaying from the PCI to ISA bus.

device          agp

Include this if you have an AGP card in the system. This will enable support for AGP, and AGP GART for boards which have these features.

device          nata

This driver supports all ATA and ATAPI devices.

device          atadisk                 # ATA disk drives

This is needed along with device nata for ATA disk drives.

device          atapicd                 # ATAPI CDROM drives

This is needed along with device nata for ATAPI CDROM drives.

device          atapifd                 # ATAPI floppy drives

This is needed along with device nata for ATAPI floppy drives.

device          atapist                 # ATAPI tape drives

This is needed along with device nata for ATAPI tape drives.

options         ATA_STATIC_ID           #Static device numbering

This makes the controller number static (like the old driver) or else the device numbers are dynamically allocated.

# SCSI Controllers
device          ahc        # AHA2940 and onboard AIC7xxx devices

SCSI controllers. Comment out any you do not have in your system. If you have an IDE only system, you can remove these altogether.

# SCSI peripherals
device          scbus      # SCSI bus (required)
device          da         # Direct Access (disks)
device          sa         # Sequential Access (tape etc)
device          cd         # CD
device          pass       # Passthrough device (direct SCSI access)
device          sg         # Passthrough device (linux scsi generic)

SCSI peripherals. Again, comment out any you do not have, or if you have only IDE hardware, you can remove them completely.

Note: The USB umass(4) driver (and a few other drivers) use the SCSI subsystem even though they are not real SCSI devices. Therefore make sure not to remove SCSI support, if any such drivers are included in the kernel configuration.

# RAID controllers interfaced to the SCSI subsystem
# RAID controllers

Supported RAID controllers. If you do not have any of these, you can comment them out or remove them.

# atkbdc0 controls both the keyboard and the PS/2 mouse
device          atkbdc0    at isa? port IO_KBD

The keyboard controller (atkbdc) provides I/O services for the AT keyboard and PS/2 style pointing devices. This controller is required by the keyboard driver (atkbd) and the PS/2 pointing device driver (psm).

device          atkbd0     at atkbdc? irq 1

The atkbd driver, together with atkbdc controller, provides access to the AT 84 keyboard or the AT enhanced keyboard which is connected to the AT keyboard controller.

device          psm0       at atkbdc? irq 12

Use this device if your mouse plugs into the PS/2 mouse port.

device          vga0        at isa?

The video card driver.

# splash screen/screen saver
pseudo-device          splash

Splash screen at start up! Screen savers require this too.

# syscons is the default console driver, resembling an SCO console
device          sc0          at isa?

sc0 is the default console driver, which resembles a SCO console. Since most full-screen programs access the console through a terminal database library like termcap, it should not matter whether you use this or vt0, the VT220 compatible console driver. When you log in, set your TERM variable to scoansi if full-screen programs have trouble running under this console.

# PCCARD (PCMCIA) support
device          pccard
device          cardbus
device          caa

PCMCIA support. You want this if you are using a laptop.

# Serial (COM) ports
device          sio0     at isa? port IO_COM1 flags 0x10 irq 4
device          sio1     at isa? port IO_COM2 irq 3
device          sio2     at isa? disable port IO_COM3 irq 5
device          sio3     at isa? disable port IO_COM4 irq 9

These are the four serial ports referred to as COM1 through COM4 in the MS-DOS/Windows® world.

Note: If you have an internal modem on COM4 and a serial port at COM2, you will have to change the IRQ of the modem to 2 (for obscure technical reasons, IRQ2 # IRQ 9) in order to access it from DragonFly. If you have a multiport serial card, check the manual page for sio(4) for more information on the proper values for these lines. Some video cards (notably those based on S3 chips) use IO addresses in the form of 0x*2e8, and since many cheap serial cards do not fully decode the 16-bit IO address space, they clash with these cards making the COM4 port practically unavailable.

Each serial port is required to have a unique IRQ (unless you are using one of the multiport cards where shared interrupts are supported), so the default IRQs for COM3 and COM4 cannot be used.

# Parallel port
device          ppc0    at isa? irq 7

This is the ISA-bus parallel port interface.

device          ppbus      # Parallel port bus (required)

Provides support for the parallel port bus.

device          lpt        # Printer

Support for parallel port printers.

Note: All three of the above are required to enable parallel printer support.

device          plip       # TCP/IP over parallel

This is the driver for the parallel network interface.

device          ppi        # Parallel port interface device

The general-purpose I/O (*geek port) + IEEE1284 I/O.

#device         vpo        # Requires scbus and da

This is for an Iomega Zip drive. It requires scbus and da support. Best performance is achieved with ports in EPP 1.9 mode.

# PCI Ethernet NICs.

Various PCI network card drivers. Comment out or remove any of these not present in your system.

# PCI Ethernet NICs that use the common MII bus controller code.
device          miibus     # MII bus support

MII bus support is required for some PCI 10/100 Ethernet NICs, namely those which use MII-compliant transceivers or implement transceiver control interfaces that operate like an MII. Adding device miibus to the kernel config pulls in support for the generic miibus API and all of the PHY drivers, including a generic one for PHYs that are not specifically handled by an individual driver.

Follows a list of drivers that use the MII bus controller code; like above, you can disable those that are not present in your system. Do the same for the list of ISA network card drivers (see LINT64 for which cards are supported by which driver), as well as for the wireless network cards.

pseudo-device   ether         # Ethernet support

ether is only needed if you have an Ethernet card. It includes generic Ethernet protocol code.

pseudo-device   sl      1     # Kernel SLIP

sl is for SLIP support. This has been almost entirely supplanted by PPP, which is easier to set up, better suited for modem-to-modem connection, and more powerful. The number after sl specifies how many simultaneous SLIP sessions to support.

pseudo-device   ppp     1     # Kernel PPP

This is for kernel PPP support for dial-up connections. There is also a version of PPP implemented as a userland application that uses tun and offers more flexibility and features such as demand dialing. The number after ppp specifies how many simultaneous PPP connections to support.

device   tun           # Packet tunnel.

This is used by the userland PPP software. A number after tun specifies the number of simultaneous PPP sessions to support.

pseudo-device   pty    # Pseudo-ttys (telnet etc)

This is a pseudo-terminal or simulated login port. It is used by incoming telnet and rlogin sessions, xterm, and some other applications such as Emacs. The number after pty indicates the number of ptys to create. If you need more than the default of 16 simultaneous xterm windows and/or remote logins, be sure to increase this number accordingly, up to a maximum of 256.

pseudo-device   md     # Memory "disks"

Memory disk pseudo-devices.

pseudo-device   gif     # IPv6 and IPv4 tunneling

This implements IPv6 over IPv4 tunneling, IPv4 over IPv6 tunneling, IPv4 over IPv4 tunneling, and IPv6 over IPv6 tunneling.

pseudo-device   faith  # IPv6-to-IPv4 relaying (translation)

This pseudo-device captures packets that are sent to it and diverts them to the IPv4/IPv6 translation daemon.

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
pseudo-device   bpf           # Berkeley packet filter

This is the Berkeley Packet Filter. This pseudo-device allows network interfaces to be placed in promiscuous mode, capturing every packet on a broadcast network (e.g., an Ethernet). These packets can be captured to disk and or examined with the tcpdump(1) program.

Note: The bpf(4) device is also used by dhclient(8) to obtain the IP address of the default router (gateway) and so on. If you use DHCP, leave this uncommented.

For more information and additional devices supported by DragonFly, see LINT64.

Device Nodes

Almost every device in the kernel has a corresponding node entry in the /dev directory. These nodes look like regular files, but are actually special entries into the kernel which programs use to access the device.

These nodes are created automatically once devfs is mounted, which happens manually for the root /dev during boot, just after the root mount.

If Something Goes Wrong

Note: If you are having trouble building a kernel, make sure to keep a GENERIC, or some other kernel that is known to work on hand as a different name that will not get erased on the next build. You cannot rely on kernel.old because when installing a new kernel, kernel.old is overwritten with the last installed kernel which may be non-functional. Also, as soon as possible, move the working kernel to the proper kernel location or commands such as ps(1) will not work properly. The proper command to “unlock” the kernel file that make installs (in order to move another kernel back permanently) is:

 % chflags noschg /boot/kernel

If you find you cannot do this, you are probably running at a securelevel(8) greater than zero. Edit kern_securelevel in /etc/rc.conf and set it to -1, then reboot. You can change it back to its previous setting when you are happy with your new kernel.

And, if you want to lock your new kernel into place, or any file for that matter, so that it cannot be moved or tampered with:

% chflags schg /boot/kernel

There are five categories of trouble that can occur when building a custom kernel. They are: