# Kernel config for a Gentoo KVM guest

## micxer

Hi folks,

I'm in the process of setting up my new VServer that is hosted on a KVM host. After digging through a lot of KVM related posts in this forum, I already got some pointers about CFLAGS and such things but what I didn't found in the web and in the forums was a demo kernel config for a Gentoo x86_64 KVM guest.

I might be a bit too concernced about that but I'd like to have a kernel that's as slim as possible. My main problem are the drivers I need to access the virtualized devices of the host system. I found several references to Pappy's Kernel seeds. Are they also a good point to start with a KVM guest kernel config or is there another resource I'm not aware of for getting me started with configuring my kernel?

Thanks for any hints.

----------

## cach0rr0

pappy's seeds are definitely a great starting point for this - that's what I use for my KVM guests, and all gentoo kernels I use actually

I can give you an example config, however it will be for hardened-sources

The other thing to remember, the drivers you select in your kernel will vary based upon how you start up your KVM guest. For mine, I use VIRTIO stuff everywhere. If you use the same, the best thing to do is start with one of Pappy's seeds, enable the file system support you need, and then use menuconfig's search facility (hit the forward /slash), and search for 'VIRTIO' - you need to, at a minimum, enable these:

```

CONFIG_VIRTIO_BLK=y

CONFIG_VIRTIO_NET=m

CONFIG_VIRTIO_CONSOLE=y

CONFIG_HW_RANDOM_VIRTIO=y

CONFIG_VIRTIO=y

CONFIG_VIRTIO_RING=y

CONFIG_VIRTIO_PCI=y

CONFIG_VIRTIO_BALLOON=m

```

My full config for hardened-sources can be found here: http://whitehathouston.com/kvm.config.txt

(I included things like ppp and tun, because this is from my VPN server - you may not need that in your guest)

Hopefully that is enough to get you started. If you are planning on using this as a server, and you can find the same hardened sources build I use, then you can just use my config verbatim  :Smile: 

I guess the other thing to keep in mind, and watch out for, if you are going to have multiple KVM guests on the network, make sure you specify a mac address on the command-line, and the mac address needs to be different for each. Also make sure you've enabled ip_forward in sysctl, as well that no firewall rules will block communication. 

Beyond that, my kvm command-line that I use with the above kernel .config looks like so:

```

qemu-kvm -drive file=/kvm/vpn/vpn.img,if=virtio,boot=on -net nic,model=virtio,macaddr=52:54:00:12:34:59 -net tap,ifname=tap3,script=/etc/qemu-ifup -m 1024 -vnc 127.0.0.1:8 -balloon virtio

```

This is from an Arch host, so the /etc/qemu-ifup is not going to be correct, but everything else should be interchangeable.

----------

## micxer

Thanks for all the info. I will go with pappy's seeds then and the hardened sources. It will have to survive "the internet"   :Smile:   so I'm trying to be as thorough as possible in securing it. Also I've used Gentoo for a long time for my small home server and I didn't know about the search feature of menuconfig   :Confused: 

Since I'm new to KVM and I just use the VServer instance at a hosting company I have no access nor any information what exact KVM host configuration they use and how they start my guest system. But as for the VIRTIO stuff, my lspci reads as follows:

```
00:00.0 Host bridge: Intel Corporation 440FX - 82441FX PMC [Natoma] (rev 02)

00:01.0 ISA bridge: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II]

00:01.1 IDE interface: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II]

00:01.2 USB Controller: Intel Corporation 82371SB PIIX3 USB [Natoma/Triton II] (rev 01)

00:01.3 Bridge: Intel Corporation 82371AB/EB/MB PIIX4 ACPI (rev 03)

00:02.0 VGA compatible controller: Cirrus Logic GD 5446

00:03.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 20)

00:04.0 RAM memory: Qumranet, Inc. Device 1002
```

When I use lspci -n and post this at http://kmuto.jp/debian/hcl/ (found in your signature, really useful tool) then it outputs the following info:

```
PCI ID      Works?    Vendor                             Device                                  Driver               Kernel

80861237              Intel Corporation                  440FX - 82441FX PMC [Natoma]

80867000              Intel Corporation                  82371SB PIIX3 ISA [Natoma/Triton II]

80867010    Yes       Intel Corporation                  82371SB PIIX3 IDE [Natoma/Triton II]    ata_piixv            2.6.25-

80867020    Yes       Intel Corporation                  82371SB PIIX3 USB [Natoma/Triton II]    usb-uhci,uhci-hcd

80867113    Yes       Intel Corporation                  82371AB/EB/MB PIIX4 ACPI                i2c-piix4v           2.6.25-

101300b8    Yes       Cirrus Logic                       GD 5446                                 cirrusfbv            2.6.25-

10ec8139    Yes       Realtek Semiconductor Co., Ltd.    RTL-8139/8139C/8139C+                   8139too,8139cpv      2.6.25-

1af41002              Red Hat, Inc                       Virtio memory balloon

```

The only Virtio thing I see is the memory balloon (whatever this is). Is it assumable, that I need the other Virtio stuff as well or do I only need to include the drivers listed in the above table and I'm ready to go? Also I'm a bit confused about the lines not showing any support for the listed device.

----------

## cach0rr0

bah...ok, seems they're not doing virtio except for balloon. shame. 

On mine it's:

```

80861237      Intel Corporation   440FX - 82441FX PMC [Natoma]      

80867000      Intel Corporation   82371SB PIIX3 ISA [Natoma/Triton II]      

80867010   Yes   Intel Corporation   82371SB PIIX3 IDE [Natoma/Triton II]   ata_piix   v2.6.25-

80867113   Yes   Intel Corporation   82371AB/EB/MB PIIX4 ACPI   i2c-piix4   v2.6.25-

101300b8   Yes   Cirrus Logic   GD 5446   cirrusfb   v2.6.25-

1af41000      Red Hat, Inc   Virtio network device      

1af41002      Red Hat, Inc   Virtio memory balloon      

1af41001      Red Hat, Inc   Virtio block device

```

I don't suppose it will hurt if you include the other virtio things (e.g. the block device one, and the network driver). For sure include the balloon driver.

But don't assume virtio - go ahead and build in ATA_PIIX (as a built-in, not a module), and do those 8139 drivers as a module. Between those, the file system drivers, and the security/hardening stuff, that should pretty much be all you need. 

Note that I'm fairly new to KVM, so what I say is far from gospel, but this is all what "works for me"

----------

## micxer

Thanks for the advice so far and sorry for not getting back yet. I had quite a lot of work and wasn't that motivated to also sit in front of a screen in the evenings. Anyway I think I can give it a try this weekend and I'm looking forward to my first hardened Gentoo server  :Smile: 

----------

## Loggy

This is a really useful post as I am trying to do much the same, albeit using a patched kernel on Ubuntu 10.04 LTS rather than Gentoo - I didn't really want to compile everything    :Smile:   .

My problem is that I am piloting a service on an old PE1850 that is sitting noisily in my office but that doesn't have VT enabled chips!  I have stripped the kernel down and at 2MB it is almost monolithic [2.6.32.28 vanilla patched (of course) with grsecurity].  It will be monolithic once I have set a boot partition that is ext2 rather than ext3  :Embarassed:  .

My target is a cloud system that uses KVM so I wanted to know what drivers to include so I could just upload the kernel and header .debs and install.  I don't mind leaving the few PE1850 drivers etc in - that's no overhead - but I didn't want a module-fest with exposed handles and symbols all over the place.

I think your answers have helped a lot here - I will be trying to upload in the next week or so so I wll let you know...

So thanks 10^6   :Very Happy: 

----------

## micxer

I finally managed to complete all steps and the server is running. Thanks again for the advice and if anyone needs a little guidance to setup a server with Gentoo and KVM and doesn't want to go through the trouble of collecting all information needed to get started, have a look at http://micxer.de/blog/plugin/tag/kvm .

----------

## cloc3

 *cach0rr0 wrote:*   

> 
> 
> ```
> 
> CONFIG_VIRTIO_BLK=y
> ...

 

In with the same config, I have a lot of these errors:

```

BUG: kvm_dirty_pages_log_change: invalid parameters 00000000000a8000-00000000000affff

```

what does it mean?

edit: the problem disappears using -vga=std. But I don't know if it depends from something wrong in my guest kernel.

----------

