config/Config-kernel.in

   1 # SPDX-License-Identifier: GPL-2.0-only
   2 #
   3 # Copyright (C) 2006-2014 OpenWrt.org
   4
   5 config KERNEL_BUILD_USER
   6         string "Custom Kernel Build User Name"
   7         default "builder" if BUILDBOT
   8         default ""
   9         help
  10           Sets the Kernel build user string, which for example will be returned
  11           by 'uname -a' on running systems.
  12           If not set, uses system user at build time.
  13
  14 config KERNEL_BUILD_DOMAIN
  15         string "Custom Kernel Build Domain Name"
  16         default "buildhost" if BUILDBOT
  17         default ""
  18         help
  19           Sets the Kernel build domain string, which for example will be
  20           returned by 'uname -a' on running systems.
  21           If not set, uses system hostname at build time.
  22
  23 config KERNEL_PRINTK
  24         bool "Enable support for printk"
  25         default y
  26
  27 config KERNEL_SWAP
  28         bool "Support for paging of anonymous memory (swap)"
  29         default y if !SMALL_FLASH
  30
  31 config KERNEL_PROC_STRIPPED
  32         bool "Strip non-essential /proc functionality to reduce code size"
  33         default y if SMALL_FLASH
  34
  35 config KERNEL_DEBUG_FS
  36         bool "Compile the kernel with debug filesystem enabled"
  37         default y
  38         help
  39           debugfs is a virtual file system that kernel developers use to put
  40           debugging files into. Enable this option to be able to read and
  41           write to these files. Many common debugging facilities, such as
  42           ftrace, require the existence of debugfs.
  43
  44 config KERNEL_MIPS_FP_SUPPORT
  45         bool
  46         default y if TARGET_pistachio
  47
  48 config KERNEL_ARM_PMU
  49         bool
  50         default y if TARGET_armsr_armv8
  51         depends on (arm || aarch64)
  52
  53 config KERNEL_ARM_PMUV3
  54         bool
  55         default y if TARGET_armsr_armv8
  56         depends on (arm_v7 || aarch64) && LINUX_6_6
  57
  58 config KERNEL_RISCV_PMU
  59         bool
  60         select KERNEL_RISCV_PMU_SBI
  61         depends on riscv64
  62
  63 config KERNEL_RISCV_PMU_SBI
  64         bool
  65         depends on riscv64
  66
  67 config KERNEL_X86_VSYSCALL_EMULATION
  68         bool "Enable vsyscall emulation"
  69         depends on x86_64
  70         help
  71           This enables emulation of the legacy vsyscall page.  Disabling
  72           it is roughly equivalent to booting with vsyscall=none, except
  73           that it will also disable the helpful warning if a program
  74           tries to use a vsyscall.  With this option set to N, offending
  75           programs will just segfault, citing addresses of the form
  76           0xffffffffff600?00.
  77
  78           This option is required by many programs built before 2013, and
  79           care should be used even with newer programs if set to N.
  80
  81           Disabling this option saves about 7K of kernel size and
  82           possibly 4K of additional runtime pagetable memory.
  83
  84 config KERNEL_PERF_EVENTS
  85         bool "Compile the kernel with performance events and counters"
  86         select KERNEL_ARM_PMU if (arm || aarch64)
  87         select KERNEL_ARM_PMUV3 if (arm_v7 || aarch64) && LINUX_6_6
  88         select KERNEL_RISCV_PMU if riscv64
  89
  90 config KERNEL_PROFILING
  91         bool "Compile the kernel with profiling enabled"
  92         select KERNEL_PERF_EVENTS
  93         help
  94           Enable the extended profiling support mechanisms used by profilers such
  95           as OProfile.
  96
  97 config KERNEL_RPI_AXIPERF
  98         bool "Compile the kernel with RaspberryPi AXI Performance monitors"
  99         default y
 100         depends on KERNEL_PERF_EVENTS && TARGET_bcm27xx
 101
 102 config KERNEL_UBSAN
 103         bool "Compile the kernel with undefined behaviour sanity checker"
 104         help
 105           This option enables undefined behaviour sanity checker
 106           Compile-time instrumentation is used to detect various undefined
 107           behaviours in runtime. Various types of checks may be enabled
 108           via boot parameter ubsan_handle
 109           (see: Documentation/dev-tools/ubsan.rst).
 110
 111 config KERNEL_UBSAN_SANITIZE_ALL
 112         bool "Enable instrumentation for the entire kernel"
 113         depends on KERNEL_UBSAN
 114         default y
 115         help
 116           This option activates instrumentation for the entire kernel.
 117           If you don't enable this option, you have to explicitly specify
 118           UBSAN_SANITIZE := y for the files/directories you want to check for UB.
 119           Enabling this option will get kernel image size increased
 120           significantly.
 121
 122 config KERNEL_UBSAN_ALIGNMENT
 123         bool "Enable checking of pointers alignment"
 124         depends on KERNEL_UBSAN
 125         help
 126           This option enables detection of unaligned memory accesses.
 127           Enabling this option on architectures that support unaligned
 128           accesses may produce a lot of false positives.
 129
 130 config KERNEL_UBSAN_BOUNDS
 131         bool "Perform array index bounds checking"
 132         depends on KERNEL_UBSAN
 133         help
 134           This option enables detection of directly indexed out of bounds array
 135           accesses, where the array size is known at compile time. Note that
 136           this does not protect array overflows via bad calls to the
 137           {str,mem}*cpy() family of functions (that is addressed by
 138           FORTIFY_SOURCE).
 139
 140 config KERNEL_UBSAN_NULL
 141         bool "Enable checking of null pointers"
 142         depends on KERNEL_UBSAN
 143         help
 144           This option enables detection of memory accesses via a
 145           null pointer.
 146
 147 config KERNEL_UBSAN_TRAP
 148         bool "On Sanitizer warnings, abort the running kernel code"
 149         depends on KERNEL_UBSAN
 150         help
 151           Building kernels with Sanitizer features enabled tends to grow the
 152           kernel size by around 5%, due to adding all the debugging text on
 153           failure paths. To avoid this, Sanitizer instrumentation can just
 154           issue a trap. This reduces the kernel size overhead but turns all
 155           warnings (including potentially harmless conditions) into full
 156           exceptions that abort the running kernel code (regardless of context,
 157           locks held, etc), which may destabilize the system. For some system
 158           builders this is an acceptable trade-off.
 159
 160 config KERNEL_KASAN
 161         bool "Compile the kernel with KASan: runtime memory debugger"
 162         select KERNEL_SLUB_DEBUG
 163         depends on (x86_64 || aarch64 || arm || powerpc || riscv64)
 164         help
 165           Enables kernel address sanitizer - runtime memory debugger,
 166           designed to find out-of-bounds accesses and use-after-free bugs.
 167           This is strictly a debugging feature and it requires a gcc version
 168           of 4.9.2 or later. Detection of out of bounds accesses to stack or
 169           global variables requires gcc 5.0 or later.
 170           This feature consumes about 1/8 of available memory and brings about
 171           ~x3 performance slowdown.
 172           For better error detection enable CONFIG_STACKTRACE.
 173           Currently CONFIG_KASAN doesn't work with CONFIG_DEBUG_SLAB
 174           (the resulting kernel does not boot).
 175
 176 config KERNEL_KASAN_EXTRA
 177         bool "KAsan: extra checks"
 178         depends on KERNEL_KASAN && KERNEL_DEBUG_KERNEL
 179         help
 180           This enables further checks in the kernel address sanitizer, for now
 181           it only includes the address-use-after-scope check that can lead
 182           to excessive kernel stack usage, frame size warnings and longer
 183           compile time.
 184           https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 has more
 185
 186 config KERNEL_KASAN_VMALLOC
 187         bool "Back mappings in vmalloc space with real shadow memory"
 188         depends on KERNEL_KASAN
 189         help
 190           By default, the shadow region for vmalloc space is the read-only
 191           zero page. This means that KASAN cannot detect errors involving
 192           vmalloc space.
 193
 194           Enabling this option will hook in to vmap/vmalloc and back those
 195           mappings with real shadow memory allocated on demand. This allows
 196           for KASAN to detect more sorts of errors (and to support vmapped
 197           stacks), but at the cost of higher memory usage.
 198
 199           This option depends on HAVE_ARCH_KASAN_VMALLOC, but we can't
 200           depend on that in here, so it is possible that enabling this
 201           will have no effect.
 202
 203 if KERNEL_KASAN
 204 choice
 205         prompt "KASAN mode"
 206         depends on KERNEL_KASAN
 207         default KERNEL_KASAN_GENERIC
 208         help
 209           KASAN has three modes:
 210
 211           1. Generic KASAN (supported by many architectures, enabled with
 212              CONFIG_KASAN_GENERIC, similar to userspace ASan),
 213           2. Software Tag-Based KASAN (arm64 only, based on software memory
 214              tagging, enabled with CONFIG_KASAN_SW_TAGS, similar to userspace
 215              HWASan), and
 216           3. Hardware Tag-Based KASAN (arm64 only, based on hardware memory
 217              tagging, enabled with CONFIG_KASAN_HW_TAGS).
 218
 219 config KERNEL_KASAN_GENERIC
 220         bool "Generic KASAN"
 221         select KERNEL_SLUB_DEBUG
 222         help
 223           Enables Generic KASAN.
 224
 225           Consumes about 1/8th of available memory at kernel start and adds an
 226           overhead of ~50% for dynamic allocations.
 227           The performance slowdown is ~x3.
 228
 229 config KERNEL_KASAN_SW_TAGS
 230         bool "Software Tag-Based KASAN"
 231         depends on aarch64
 232         select KERNEL_SLUB_DEBUG
 233         help
 234           Enables Software Tag-Based KASAN.
 235
 236           Supported only on arm64 CPUs and relies on Top Byte Ignore.
 237
 238           Consumes about 1/16th of available memory at kernel start and
 239           add an overhead of ~20% for dynamic allocations.
 240
 241           May potentially introduce problems related to pointer casting and
 242           comparison, as it embeds a tag into the top byte of each pointer.
 243
 244 config KERNEL_KASAN_HW_TAGS
 245         bool "Hardware Tag-Based KASAN"
 246         depends on aarch64
 247         select KERNEL_SLUB_DEBUG
 248         select KERNEL_ARM64_MTE
 249         help
 250           Enables Hardware Tag-Based KASAN.
 251
 252           Supported only on arm64 CPUs starting from ARMv8.5 and relies on
 253           Memory Tagging Extension and Top Byte Ignore.
 254
 255           Consumes about 1/32nd of available memory.
 256
 257           May potentially introduce problems related to pointer casting and
 258           comparison, as it embeds a tag into the top byte of each pointer.
 259
 260 endchoice
 261
 262         config KERNEL_ARM64_MTE
 263                 def_bool n
 264
 265 endif
 266
 267 choice
 268         prompt "Instrumentation type"
 269         depends on KERNEL_KASAN
 270         depends on !KERNEL_KASAN_HW_TAGS
 271         default KERNEL_KASAN_OUTLINE
 272
 273 config KERNEL_KASAN_OUTLINE
 274         bool "Outline instrumentation"
 275         help
 276           Before every memory access compiler insert function call
 277           __asan_load*/__asan_store*. These functions performs check
 278           of shadow memory. This is slower than inline instrumentation,
 279           however it doesn't bloat size of kernel's .text section so
 280           much as inline does.
 281
 282 config KERNEL_KASAN_INLINE
 283         bool "Inline instrumentation"
 284         help
 285           Compiler directly inserts code checking shadow memory before
 286           memory accesses. This is faster than outline (in some workloads
 287           it gives about x2 boost over outline instrumentation), but
 288           make kernel's .text size much bigger.
 289           This requires a gcc version of 5.0 or later.
 290
 291 endchoice
 292
 293 config KERNEL_KCOV
 294         bool "Compile the kernel with code coverage for fuzzing"
 295         select KERNEL_DEBUG_FS
 296         help
 297           KCOV exposes kernel code coverage information in a form suitable
 298           for coverage-guided fuzzing (randomized testing).
 299
 300           If RANDOMIZE_BASE is enabled, PC values will not be stable across
 301           different machines and across reboots. If you need stable PC values,
 302           disable RANDOMIZE_BASE.
 303
 304           For more details, see Documentation/kcov.txt.
 305
 306 config KERNEL_KCOV_ENABLE_COMPARISONS
 307         bool "Enable comparison operands collection by KCOV"
 308         depends on KERNEL_KCOV
 309         help
 310           KCOV also exposes operands of every comparison in the instrumented
 311           code along with operand sizes and PCs of the comparison instructions.
 312           These operands can be used by fuzzing engines to improve the quality
 313           of fuzzing coverage.
 314
 315 config KERNEL_KCOV_INSTRUMENT_ALL
 316         bool "Instrument all code by default"
 317         depends on KERNEL_KCOV
 318         default y if KERNEL_KCOV
 319         help
 320           If you are doing generic system call fuzzing (like e.g. syzkaller),
 321           then you will want to instrument the whole kernel and you should
 322           say y here. If you are doing more targeted fuzzing (like e.g.
 323           filesystem fuzzing with AFL) then you will want to enable coverage
 324           for more specific subsets of files, and should say n here.
 325
 326 config KERNEL_TASKSTATS
 327         bool "Compile the kernel with task resource/io statistics and accounting"
 328         help
 329           Enable the collection and publishing of task/io statistics and
 330           accounting.  Enable this option to enable i/o monitoring in system
 331           monitors.
 332
 333 if KERNEL_TASKSTATS
 334
 335         config KERNEL_TASK_DELAY_ACCT
 336                 def_bool y
 337
 338         config KERNEL_TASK_IO_ACCOUNTING
 339                 def_bool y
 340
 341         config KERNEL_TASK_XACCT
 342                 def_bool y
 343
 344 endif
 345
 346 config KERNEL_KALLSYMS
 347         bool "Compile the kernel with symbol table information"
 348         default y if !SMALL_FLASH
 349         help
 350           This will give you more information in stack traces from kernel oopses.
 351
 352 config KERNEL_FTRACE
 353         bool "Compile the kernel with tracing support"
 354         depends on !TARGET_uml
 355
 356 config KERNEL_FTRACE_SYSCALLS
 357         bool "Trace system calls"
 358         depends on KERNEL_FTRACE
 359
 360 config KERNEL_ENABLE_DEFAULT_TRACERS
 361         bool "Trace process context switches and events"
 362         depends on KERNEL_FTRACE
 363
 364 config KERNEL_FUNCTION_TRACER
 365         bool "Function tracer"
 366         depends on KERNEL_FTRACE
 367
 368 config KERNEL_FUNCTION_GRAPH_TRACER
 369         bool "Function graph tracer"
 370         depends on KERNEL_FUNCTION_TRACER
 371
 372 config KERNEL_DYNAMIC_FTRACE
 373         bool "Enable/disable function tracing dynamically"
 374         depends on KERNEL_FUNCTION_TRACER
 375
 376 config KERNEL_FUNCTION_PROFILER
 377         bool "Function profiler"
 378         depends on KERNEL_FUNCTION_TRACER
 379
 380 config KERNEL_IRQSOFF_TRACER
 381         bool "Interrupts-off Latency Tracer"
 382         depends on KERNEL_FTRACE
 383         help
 384           This option measures the time spent in irqs-off critical
 385           sections, with microsecond accuracy.
 386
 387           The default measurement method is a maximum search, which is
 388           disabled by default and can be runtime (re-)started
 389           via:
 390
 391               echo 0 > /sys/kernel/debug/tracing/tracing_max_latency
 392
 393           (Note that kernel size and overhead increase with this option
 394           enabled. This option and the preempt-off timing option can be
 395           used together or separately.)
 396
 397 config KERNEL_PREEMPT_TRACER
 398         bool "Preemption-off Latency Tracer"
 399         depends on KERNEL_FTRACE
 400         help
 401           This option measures the time spent in preemption-off critical
 402           sections, with microsecond accuracy.
 403
 404           The default measurement method is a maximum search, which is
 405           disabled by default and can be runtime (re-)started
 406           via:
 407
 408               echo 0 > /sys/kernel/debug/tracing/tracing_max_latency
 409
 410           (Note that kernel size and overhead increase with this option
 411           enabled. This option and the irqs-off timing option can be
 412           used together or separately.)
 413
 414 config KERNEL_HIST_TRIGGERS
 415         bool "Histogram triggers"
 416         depends on KERNEL_FTRACE
 417         help
 418           Hist triggers allow one or more arbitrary trace event fields to be
 419           aggregated into hash tables and dumped to stdout by reading a
 420           debugfs/tracefs file. They're useful for gathering quick and dirty
 421           (though precise) summaries of event activity as an initial guide for
 422           further investigation using more advanced tools.
 423
 424           Inter-event tracing of quantities such as latencies is also
 425           supported using hist triggers under this option.
 426
 427 config KERNEL_DEBUG_KERNEL
 428         bool
 429
 430 config KERNEL_DEBUG_INFO
 431         bool "Compile the kernel with debug information"
 432         default y if !SMALL_FLASH
 433         select KERNEL_DEBUG_KERNEL
 434         help
 435           This will compile your kernel and modules with debug information.
 436
 437 config KERNEL_DEBUG_INFO_BTF
 438
 439         bool "Enable additional BTF type information"
 440         depends on !HOST_OS_MACOS
 441         depends on KERNEL_DEBUG_INFO && !KERNEL_DEBUG_INFO_REDUCED
 442         select DWARVES
 443         help
 444           Generate BPF Type Format (BTF) information from DWARF debug info.
 445           Turning this on expects presence of pahole tool, which will convert
 446           DWARF type info into equivalent deduplicated BTF type info.
 447
 448           Required to run BPF CO-RE applications.
 449
 450 config KERNEL_MODULE_ALLOW_BTF_MISMATCH
 451         bool "Allow loading modules with non-matching BTF type info"
 452         depends on KERNEL_DEBUG_INFO_BTF
 453         help
 454           For modules whose split BTF does not match vmlinux, load without
 455           BTF rather than refusing to load. The default behavior with
 456           module BTF enabled is to reject modules with such mismatches;
 457           this option will still load module BTF where possible but ignore
 458           it when a mismatch is found.
 459
 460 config KERNEL_DEBUG_INFO_REDUCED
 461         bool "Reduce debugging information"
 462         default y
 463         depends on KERNEL_DEBUG_INFO
 464         help
 465           If you say Y here gcc is instructed to generate less debugging
 466           information for structure types. This means that tools that
 467           need full debugging information (like kgdb or systemtap) won't
 468           be happy. But if you merely need debugging information to
 469           resolve line numbers there is no loss. Advantage is that
 470           build directory object sizes shrink dramatically over a full
 471           DEBUG_INFO build and compile times are reduced too.
 472           Only works with newer gcc versions.
 473
 474 config KERNEL_FRAME_WARN
 475         int
 476         range 0 8192
 477         default 1280 if KERNEL_KASAN && !ARCH_64BIT
 478         default 1024 if !ARCH_64BIT
 479         default 2048 if ARCH_64BIT
 480         help
 481           Tell the compiler to warn at build time for stack frames larger than this.
 482           Setting this too low will cause a lot of warnings.
 483           Setting it to 0 disables the warning.
 484
 485 # KERNEL_DEBUG_LL symbols must have the default value set as otherwise
 486 # KConfig wont evaluate them unless KERNEL_EARLY_PRINTK is selected
 487 # which means that buildroot wont override the DEBUG_LL symbols in target
 488 # kernel configurations and lead to devices that dont have working console
 489 config KERNEL_DEBUG_LL_UART_NONE
 490         bool
 491         default n
 492         depends on arm
 493
 494 config KERNEL_DEBUG_LL
 495         bool
 496         default n
 497         depends on arm
 498         select KERNEL_DEBUG_LL_UART_NONE
 499         help
 500           ARM low level debugging.
 501
 502 config KERNEL_DEBUG_VIRTUAL
 503         bool "Compile the kernel with VM translations debugging"
 504         select KERNEL_DEBUG_KERNEL
 505         help
 506           Enable checks sanity checks to catch invalid uses of
 507           virt_to_phys()/phys_to_virt() against the non-linear address space.
 508
 509 config KERNEL_DYNAMIC_DEBUG
 510         bool "Compile the kernel with dynamic printk"
 511         select KERNEL_DEBUG_FS
 512         help
 513           Compiles debug level messages into the kernel, which would not
 514           otherwise be available at runtime. These messages can then be
 515           enabled/disabled based on various levels of scope - per source file,
 516           function, module, format string, and line number. This mechanism
 517           implicitly compiles in all pr_debug() and dev_dbg() calls, which
 518           enlarges the kernel text size by about 2%.
 519
 520 config KERNEL_EARLY_PRINTK
 521         bool "Compile the kernel with early printk"
 522         default y if TARGET_bcm53xx
 523         depends on arm
 524         select KERNEL_DEBUG_KERNEL
 525         select KERNEL_DEBUG_LL if arm
 526         help
 527           Compile the kernel with early printk support.  This is only useful for
 528           debugging purposes to send messages over the serial console in early boot.
 529           Enable this to debug early boot problems.
 530
 531 config KERNEL_KPROBES
 532         bool "Compile the kernel with kprobes support"
 533         select KERNEL_FTRACE
 534         select KERNEL_PERF_EVENTS
 535         help
 536           Compiles the kernel with KPROBES support, which allows you to trap
 537           at almost any kernel address and execute a callback function.
 538           register_kprobe() establishes a probepoint and specifies the
 539           callback. Kprobes is useful for kernel debugging, non-intrusive
 540           instrumentation and testing.
 541           If in doubt, say "N".
 542
 543 config KERNEL_KPROBE_EVENTS
 544         bool
 545         default y if KERNEL_KPROBES
 546
 547 config KERNEL_BPF_EVENTS
 548         bool "Compile the kernel with BPF event support"
 549         select KERNEL_KPROBES
 550         help
 551           Allows to attach BPF programs to kprobe, uprobe and tracepoint events.
 552           This is required to use BPF maps of type BPF_MAP_TYPE_PERF_EVENT_ARRAY
 553           for sending data from BPF programs to user-space for post-processing
 554           or logging.
 555
 556 config KERNEL_BPF_KPROBE_OVERRIDE
 557         bool
 558         depends on KERNEL_KPROBES
 559         default n
 560
 561 config KERNEL_AIO
 562         bool "Compile the kernel with asynchronous IO support"
 563         default y if !SMALL_FLASH
 564
 565 config KERNEL_IO_URING
 566         bool "Compile the kernel with io_uring support"
 567         depends on !SMALL_FLASH
 568         default y if (x86_64 || aarch64)
 569
 570 config KERNEL_FHANDLE
 571         bool "Compile the kernel with support for fhandle syscalls"
 572         default y if !SMALL_FLASH
 573
 574 config KERNEL_FANOTIFY
 575         bool "Compile the kernel with modern file notification support"
 576         default y if !SMALL_FLASH
 577
 578 config KERNEL_BLK_DEV_BSG
 579         bool "Compile the kernel with SCSI generic v4 support for any block device"
 580
 581 config KERNEL_TRANSPARENT_HUGEPAGE
 582         bool
 583
 584 choice
 585         prompt "Transparent Hugepage Support sysfs defaults"
 586         depends on KERNEL_TRANSPARENT_HUGEPAGE
 587         default KERNEL_TRANSPARENT_HUGEPAGE_ALWAYS
 588
 589         config KERNEL_TRANSPARENT_HUGEPAGE_ALWAYS
 590                 bool "always"
 591
 592         config KERNEL_TRANSPARENT_HUGEPAGE_MADVISE
 593                 bool "madvise"
 594 endchoice
 595
 596 config KERNEL_HUGETLBFS
 597         bool
 598
 599 config KERNEL_HUGETLB_PAGE
 600         bool "Compile the kernel with HugeTLB support"
 601         select KERNEL_TRANSPARENT_HUGEPAGE
 602         select KERNEL_HUGETLBFS
 603
 604 config KERNEL_MAGIC_SYSRQ
 605         bool "Compile the kernel with SysRq support"
 606         default y
 607
 608 config KERNEL_DEBUG_PINCTRL
 609         bool "Compile the kernel with pinctrl debugging"
 610         select KERNEL_DEBUG_KERNEL
 611
 612 config KERNEL_DEBUG_GPIO
 613         bool "Compile the kernel with gpio debugging"
 614         select KERNEL_DEBUG_KERNEL
 615
 616 config KERNEL_COREDUMP
 617         bool
 618
 619 config KERNEL_ELF_CORE
 620         bool "Enable process core dump support"
 621         select KERNEL_COREDUMP
 622         default y if !SMALL_FLASH
 623
 624 config KERNEL_PROVE_LOCKING
 625         bool "Enable kernel lock checking"
 626         select KERNEL_DEBUG_KERNEL
 627
 628 config KERNEL_SOFTLOCKUP_DETECTOR
 629         bool "Compile the kernel with detect Soft Lockups"
 630         depends on KERNEL_DEBUG_KERNEL
 631         help
 632           Say Y here to enable the kernel to act as a watchdog to detect
 633           soft lockups.
 634
 635           Softlockups are bugs that cause the kernel to loop in kernel
 636           mode for more than 20 seconds, without giving other tasks a
 637           chance to run.  The current stack trace is displayed upon
 638           detection and the system will stay locked up.
 639
 640 config KERNEL_HARDLOCKUP_DETECTOR
 641         bool "Compile the kernel with detect Hard Lockups"
 642         depends on KERNEL_DEBUG_KERNEL
 643         help
 644           Say Y here to enable the kernel to act as a watchdog to detect
 645           hard lockups.
 646
 647           Hardlockups are bugs that cause the CPU to loop in kernel mode
 648           for more than 10 seconds, without letting other interrupts have a
 649           chance to run.  The current stack trace is displayed upon detection
 650           and the system will stay locked up.
 651
 652 config KERNEL_DETECT_HUNG_TASK
 653         bool "Compile the kernel with detect Hung Tasks"
 654         depends on KERNEL_DEBUG_KERNEL
 655         default KERNEL_SOFTLOCKUP_DETECTOR
 656         help
 657           Say Y here to enable the kernel to detect "hung tasks",
 658           which are bugs that cause the task to be stuck in
 659           uninterruptible "D" state indefinitely.
 660
 661           When a hung task is detected, the kernel will print the
 662           current stack trace (which you should report), but the
 663           task will stay in uninterruptible state. If lockdep is
 664           enabled then all held locks will also be reported. This
 665           feature has negligible overhead.
 666
 667 config KERNEL_WQ_WATCHDOG
 668         bool "Compile the kernel with detect Workqueue Stalls"
 669         depends on KERNEL_DEBUG_KERNEL
 670         help
 671           Say Y here to enable stall detection on workqueues.  If a
 672           worker pool doesn't make forward progress on a pending work
 673           item for over a given amount of time, 30s by default, a
 674           warning message is printed along with dump of workqueue
 675           state.  This can be configured through kernel parameter
 676           "workqueue.watchdog_thresh" and its sysfs counterpart.
 677
 678 config KERNEL_DEBUG_ATOMIC_SLEEP
 679         bool "Compile the kernel with sleep inside atomic section checking"
 680         depends on KERNEL_DEBUG_KERNEL
 681         help
 682           If you say Y here, various routines which may sleep will become very
 683           noisy if they are called inside atomic sections: when a spinlock is
 684           held, inside an rcu read side critical section, inside preempt disabled
 685           sections, inside an interrupt, etc...
 686
 687 config KERNEL_DEBUG_VM
 688         bool "Compile the kernel with debug VM"
 689         depends on KERNEL_DEBUG_KERNEL
 690         help
 691           Enable this to turn on extended checks in the virtual-memory system
 692           that may impact performance.
 693
 694           If unsure, say N.
 695
 696 config KERNEL_PRINTK_TIME
 697         bool "Enable printk timestamps"
 698         default y
 699
 700 config KERNEL_SLUB_DEBUG
 701         bool "Enable SLUB debugging support"
 702         help
 703           This enables various debugging features:
 704             - Accepts "slub_debug" kernel parameter
 705             - Provides caches debugging options (e.g. tracing, validating)
 706             - Adds /sys/kernel/slab/ attrs for reading amounts of *objects*
 707             - Enables /proc/slabinfo support
 708             - Prints info when running out of memory
 709
 710           Enabling this can result in a significant increase of code size.
 711
 712 config KERNEL_SLUB_DEBUG_ON
 713         depends on KERNEL_SLUB_DEBUG
 714         bool "Boot kernel with basic caches debugging enabled"
 715         help
 716           This enables by default sanity_checks, red_zone, poison and store_user
 717           debugging options for all caches.
 718
 719 config KERNEL_SLABINFO
 720         select KERNEL_SLUB_DEBUG
 721         select KERNEL_SLUB_DEBUG_ON
 722         bool "Enable /proc slab debug info"
 723
 724 config KERNEL_PROC_PAGE_MONITOR
 725         bool "Enable /proc page monitoring"
 726
 727 config KERNEL_RELAY
 728         bool
 729
 730 config KERNEL_KEXEC
 731         bool "Enable kexec support"
 732
 733 config KERNEL_PROC_VMCORE
 734         bool
 735
 736 config KERNEL_PROC_KCORE
 737         bool
 738
 739 config KERNEL_CRASH_DUMP
 740         depends on i386 || x86_64 || arm || armeb
 741         select KERNEL_KEXEC
 742         select KERNEL_PROC_VMCORE
 743         select KERNEL_PROC_KCORE
 744         bool "Enable support for kexec crashdump"
 745         default y
 746
 747 config USE_RFKILL
 748         bool "Enable rfkill support"
 749         default RFKILL_SUPPORT
 750
 751 config USE_SPARSE
 752         bool "Enable sparse check during kernel build"
 753
 754 config KERNEL_DEVTMPFS
 755         bool "Compile the kernel with device tmpfs enabled"
 756         help
 757           devtmpfs is a simple, kernel-managed /dev filesystem. The kernel creates
 758           devices nodes for all registered devices to simplify boot, but leaves more
 759           complex tasks to userspace (e.g. udev).
 760
 761 if KERNEL_DEVTMPFS
 762
 763         config KERNEL_DEVTMPFS_MOUNT
 764                 bool "Automatically mount devtmpfs after root filesystem is mounted"
 765
 766 endif
 767
 768 config KERNEL_KEYS
 769         bool "Enable kernel access key retention support"
 770         default !SMALL_FLASH
 771
 772 config KERNEL_PERSISTENT_KEYRINGS
 773         bool "Enable kernel persistent keyrings"
 774         depends on KERNEL_KEYS
 775
 776 config KERNEL_KEYS_REQUEST_CACHE
 777         bool "Enable temporary caching of the last request_key() result"
 778         depends on KERNEL_KEYS
 779
 780 config KERNEL_BIG_KEYS
 781         bool "Enable large payload keys on kernel keyrings"
 782         depends on KERNEL_KEYS
 783
 784 #
 785 # CGROUP support symbols
 786 #
 787
 788 config KERNEL_CGROUPS
 789         bool "Enable kernel cgroups"
 790         default y if !SMALL_FLASH
 791
 792 if KERNEL_CGROUPS
 793
 794         config KERNEL_CGROUP_DEBUG
 795                 bool "Example debug cgroup subsystem"
 796                 help
 797                   This option enables a simple cgroup subsystem that
 798                   exports useful debugging information about the cgroups
 799                   framework.
 800
 801         config KERNEL_FREEZER
 802                 bool
 803
 804         config KERNEL_CGROUP_FREEZER
 805                 bool "legacy Freezer cgroup subsystem"
 806                 select KERNEL_FREEZER
 807                 help
 808                   Provides a way to freeze and unfreeze all tasks in a
 809                   cgroup.
 810                   (legacy cgroup1-only controller, in cgroup2 freezer
 811                   is integrated in the Memory controller)
 812
 813         config KERNEL_CGROUP_DEVICE
 814                 bool "legacy Device controller for cgroups"
 815                 help
 816                   Provides a cgroup implementing whitelists for devices which
 817                   a process in the cgroup can mknod or open.
 818                   (legacy cgroup1-only controller)
 819
 820         config KERNEL_CGROUP_HUGETLB
 821                 bool "HugeTLB controller"
 822                 select KERNEL_HUGETLB_PAGE
 823
 824         config KERNEL_CGROUP_PIDS
 825                 bool "PIDs cgroup subsystem"
 826                 default y
 827                 help
 828                   Provides enforcement of process number limits in the scope of a
 829                   cgroup.
 830
 831         config KERNEL_CGROUP_RDMA
 832                 bool "RDMA controller for cgroups"
 833                 default y
 834
 835         config KERNEL_CGROUP_BPF
 836                 bool "Support for eBPF programs attached to cgroups"
 837                 default y
 838
 839         config KERNEL_CPUSETS
 840                 bool "Cpuset support"
 841                 default y
 842                 help
 843                   This option will let you create and manage CPUSETs which
 844                   allow dynamically partitioning a system into sets of CPUs and
 845                   Memory Nodes and assigning tasks to run only within those sets.
 846                   This is primarily useful on large SMP or NUMA systems.
 847
 848         config KERNEL_PROC_PID_CPUSET
 849                 bool "Include legacy /proc/<pid>/cpuset file"
 850                 depends on KERNEL_CPUSETS
 851
 852         config KERNEL_CGROUP_CPUACCT
 853                 bool "Simple CPU accounting cgroup subsystem"
 854                 default y
 855                 help
 856                   Provides a simple Resource Controller for monitoring the
 857                   total CPU consumed by the tasks in a cgroup.
 858
 859         config KERNEL_RESOURCE_COUNTERS
 860                 bool "Resource counters"
 861                 default y
 862                 help
 863                   This option enables controller independent resource accounting
 864                   infrastructure that works with cgroups.
 865
 866         config KERNEL_MM_OWNER
 867                 bool
 868                 default y if KERNEL_MEMCG
 869
 870         config KERNEL_MEMCG
 871                 bool "Memory Resource Controller for Control Groups"
 872                 default y
 873                 select KERNEL_FREEZER
 874                 depends on KERNEL_RESOURCE_COUNTERS
 875                 help
 876                   Provides a memory resource controller that manages both anonymous
 877                   memory and page cache. (See Documentation/cgroups/memory.txt)
 878
 879                   Note that setting this option increases fixed memory overhead
 880                   associated with each page of memory in the system. By this,
 881                   20(40)bytes/PAGE_SIZE on 32(64)bit system will be occupied by memory
 882                   usage tracking struct at boot. Total amount of this is printed out
 883                   at boot.
 884
 885                   Only enable when you're ok with these tradeoffs and really
 886                   sure you need the memory resource controller. Even when you enable
 887                   this, you can set "cgroup_disable=memory" at your boot option to
 888                   disable memory resource controller and you can avoid overheads
 889                   (but lose benefits of memory resource controller).
 890
 891                   This config option also selects MM_OWNER config option, which
 892                   could in turn add some fork/exit overhead.
 893
 894         config KERNEL_MEMCG_SWAP
 895                 bool "Memory Resource Controller Swap Extension"
 896                 default y
 897                 depends on KERNEL_MEMCG
 898                 help
 899                   Add swap management feature to memory resource controller. When you
 900                   enable this, you can limit mem+swap usage per cgroup. In other words,
 901                   when you disable this, memory resource controller has no cares to
 902                   usage of swap...a process can exhaust all of the swap. This extension
 903                   is useful when you want to avoid exhaustion swap but this itself
 904                   adds more overheads and consumes memory for remembering information.
 905                   Especially if you use 32bit system or small memory system, please
 906                   be careful about enabling this. When memory resource controller
 907                   is disabled by boot option, this will be automatically disabled and
 908                   there will be no overhead from this. Even when you set this config=y,
 909                   if boot option "swapaccount=0" is set, swap will not be accounted.
 910                   Now, memory usage of swap_cgroup is 2 bytes per entry. If swap page
 911                   size is 4096bytes, 512k per 1Gbytes of swap.
 912
 913         config KERNEL_MEMCG_SWAP_ENABLED
 914                 bool "Memory Resource Controller Swap Extension enabled by default"
 915                 depends on KERNEL_MEMCG_SWAP
 916                 help
 917                   Memory Resource Controller Swap Extension comes with its price in
 918                   a bigger memory consumption. General purpose distribution kernels
 919                   which want to enable the feature but keep it disabled by default
 920                   and let the user enable it by swapaccount boot command line
 921                   parameter should have this option unselected.
 922
 923                   Those who want to have the feature enabled by default should
 924                   select this option (if, for some reason, they need to disable it,
 925                   then swapaccount=0 does the trick).
 926
 927
 928         config KERNEL_MEMCG_KMEM
 929                 bool "Memory Resource Controller Kernel Memory accounting (EXPERIMENTAL)"
 930                 default y
 931                 depends on KERNEL_MEMCG
 932                 help
 933                   The Kernel Memory extension for Memory Resource Controller can limit
 934                   the amount of memory used by kernel objects in the system. Those are
 935                   fundamentally different from the entities handled by the standard
 936                   Memory Controller, which are page-based, and can be swapped. Users of
 937                   the kmem extension can use it to guarantee that no group of processes
 938                   will ever exhaust kernel resources alone.
 939
 940         config KERNEL_CGROUP_PERF
 941                 bool "Enable perf_event per-cpu per-container group (cgroup) monitoring"
 942                 select KERNEL_PERF_EVENTS
 943                 help
 944                   This option extends the per-cpu mode to restrict monitoring to
 945                   threads which belong to the cgroup specified and run on the
 946                   designated cpu.
 947
 948         menuconfig KERNEL_CGROUP_SCHED
 949                 bool "Group CPU scheduler"
 950                 default y
 951                 help
 952                   This feature lets CPU scheduler recognize task groups and control CPU
 953                   bandwidth allocation to such task groups. It uses cgroups to group
 954                   tasks.
 955
 956         if KERNEL_CGROUP_SCHED
 957
 958                 config KERNEL_FAIR_GROUP_SCHED
 959                         bool "Group scheduling for SCHED_OTHER"
 960                         default y
 961
 962                 config KERNEL_CFS_BANDWIDTH
 963                         bool "CPU bandwidth provisioning for FAIR_GROUP_SCHED"
 964                         default y
 965                         depends on KERNEL_FAIR_GROUP_SCHED
 966                         help
 967                           This option allows users to define CPU bandwidth rates (limits) for
 968                           tasks running within the fair group scheduler.  Groups with no limit
 969                           set are considered to be unconstrained and will run with no
 970                           restriction.
 971                           See tip/Documentation/scheduler/sched-bwc.txt for more information.
 972
 973                 config KERNEL_RT_GROUP_SCHED
 974                         bool "Group scheduling for SCHED_RR/FIFO"
 975                         default y
 976                         help
 977                           This feature lets you explicitly allocate real CPU bandwidth
 978                           to task groups. If enabled, it will also make it impossible to
 979                           schedule realtime tasks for non-root users until you allocate
 980                           realtime bandwidth for them.
 981
 982         endif
 983
 984         config KERNEL_BLK_CGROUP
 985                 bool "Block IO controller"
 986                 default y
 987                 help
 988                   Generic block IO controller cgroup interface. This is the common
 989                   cgroup interface which should be used by various IO controlling
 990                   policies.
 991
 992                   Currently, CFQ IO scheduler uses it to recognize task groups and
 993                   control disk bandwidth allocation (proportional time slice allocation)
 994                   to such task groups. It is also used by bio throttling logic in
 995                   block layer to implement upper limit in IO rates on a device.
 996
 997                   This option only enables generic Block IO controller infrastructure.
 998                   One needs to also enable actual IO controlling logic/policy. For
 999                   enabling proportional weight division of disk bandwidth in CFQ, set
1000                   CONFIG_CFQ_GROUP_IOSCHED=y; for enabling throttling policy, set
1001                   CONFIG_BLK_DEV_THROTTLING=y.
1002
1003         if KERNEL_BLK_CGROUP
1004
1005                 config KERNEL_CFQ_GROUP_IOSCHED
1006                         bool "Proportional weight of disk bandwidth in CFQ"
1007
1008                 config KERNEL_BLK_DEV_THROTTLING
1009                         bool "Enable throttling policy"
1010                         default y
1011
1012                 config KERNEL_BLK_DEV_THROTTLING_LOW
1013                         bool "Block throttling .low limit interface support (EXPERIMENTAL)"
1014                         depends on KERNEL_BLK_DEV_THROTTLING
1015         endif
1016
1017         config KERNEL_DEBUG_BLK_CGROUP
1018                 bool "Enable Block IO controller debugging"
1019                 depends on KERNEL_BLK_CGROUP
1020                 help
1021                   Enable some debugging help. Currently it exports additional stat
1022                   files in a cgroup which can be useful for debugging.
1023
1024         config KERNEL_NET_CLS_CGROUP
1025                 bool "legacy Control Group Classifier"
1026
1027         config KERNEL_CGROUP_NET_CLASSID
1028                 bool "legacy Network classid cgroup"
1029
1030         config KERNEL_CGROUP_NET_PRIO
1031                 bool "legacy Network priority cgroup"
1032
1033 endif
1034
1035 #
1036 # Namespace support symbols
1037 #
1038
1039 config KERNEL_NAMESPACES
1040         bool "Enable kernel namespaces"
1041         default y if !SMALL_FLASH
1042
1043 if KERNEL_NAMESPACES
1044
1045         config KERNEL_UTS_NS
1046                 bool "UTS namespace"
1047                 default y
1048                 help
1049                   In this namespace, tasks see different info provided
1050                   with the uname() system call.
1051
1052         config KERNEL_IPC_NS
1053                 bool "IPC namespace"
1054                 default y
1055                 help
1056                   In this namespace, tasks work with IPC ids which correspond to
1057                   different IPC objects in different namespaces.
1058
1059         config KERNEL_USER_NS
1060                 bool "User namespace (EXPERIMENTAL)"
1061                 default y
1062                 help
1063                   This allows containers, i.e. vservers, to use user namespaces
1064                   to provide different user info for different servers.
1065
1066         config KERNEL_PID_NS
1067                 bool "PID Namespaces"
1068                 default y
1069                 help
1070                   Support process id namespaces. This allows having multiple
1071                   processes with the same pid as long as they are in different
1072                   pid namespaces. This is a building block of containers.
1073
1074         config KERNEL_NET_NS
1075                 bool "Network namespace"
1076                 default y
1077                 help
1078                   Allow user space to create what appear to be multiple instances
1079                   of the network stack.
1080
1081 endif
1082
1083 config KERNEL_DEVPTS_MULTIPLE_INSTANCES
1084         bool "Support multiple instances of devpts"
1085         default y if !SMALL_FLASH
1086         help
1087           Enable support for multiple instances of devpts filesystem.
1088           If you want to have isolated PTY namespaces (eg: in containers),
1089           say Y here. Otherwise, say N. If enabled, each mount of devpts
1090           filesystem with the '-o newinstance' option will create an
1091           independent PTY namespace.
1092
1093 config KERNEL_POSIX_MQUEUE
1094         bool "POSIX Message Queues"
1095         default y if !SMALL_FLASH
1096         help
1097           POSIX variant of message queues is a part of IPC. In POSIX message
1098           queues every message has a priority which decides about succession
1099           of receiving it by a process. If you want to compile and run
1100           programs written e.g. for Solaris with use of its POSIX message
1101           queues (functions mq_*) say Y here.
1102
1103           POSIX message queues are visible as a filesystem called 'mqueue'
1104           and can be mounted somewhere if you want to do filesystem
1105           operations on message queues.
1106
1107
1108 config KERNEL_SECCOMP_FILTER
1109         bool
1110         default y if !SMALL_FLASH
1111
1112 config KERNEL_SECCOMP
1113         bool "Enable seccomp support"
1114                 depends on !(TARGET_uml)
1115                 select KERNEL_SECCOMP_FILTER
1116                 default y if !SMALL_FLASH
1117                 help
1118                   Build kernel with support for seccomp.
1119
1120 #
1121 # IPv4 configuration
1122 #
1123
1124 config KERNEL_IP_MROUTE
1125         bool "Enable IPv4 multicast routing"
1126         default y
1127         help
1128           Multicast routing requires a multicast routing daemon in
1129           addition to kernel support.
1130
1131 if KERNEL_IP_MROUTE
1132
1133         config KERNEL_IP_MROUTE_MULTIPLE_TABLES
1134                 def_bool y
1135
1136         config KERNEL_IP_PIMSM_V1
1137                 def_bool y
1138
1139         config KERNEL_IP_PIMSM_V2
1140                 def_bool y
1141
1142 endif
1143
1144 #
1145 # IPv6 configuration
1146 #
1147
1148 config KERNEL_IPV6
1149         def_bool IPV6
1150
1151 if KERNEL_IPV6
1152
1153         config KERNEL_IPV6_MULTIPLE_TABLES
1154                 def_bool y
1155
1156         config KERNEL_IPV6_SUBTREES
1157                 def_bool y
1158
1159         config KERNEL_IPV6_MROUTE
1160                 bool "Enable IPv6 multicast routing"
1161                 default y
1162                 help
1163                   Multicast routing requires a multicast routing daemon in
1164                   addition to kernel support.
1165
1166         if KERNEL_IPV6_MROUTE
1167
1168                 config KERNEL_IPV6_MROUTE_MULTIPLE_TABLES
1169                         def_bool y
1170
1171                 config KERNEL_IPV6_PIMSM_V2
1172                         def_bool y
1173
1174         endif
1175
1176         config KERNEL_IPV6_SEG6_LWTUNNEL
1177                 bool "Enable support for lightweight tunnels"
1178                 default y if !SMALL_FLASH
1179                 help
1180                   Using lwtunnel (needed for IPv6 segment routing) requires ip-full package.
1181
1182         config KERNEL_LWTUNNEL_BPF
1183                 def_bool n
1184
1185 endif
1186
1187 #
1188 # Miscellaneous network configuration
1189 #
1190
1191 config KERNEL_NET_L3_MASTER_DEV
1192         bool "L3 Master device support"
1193         help
1194           This module provides glue between core networking code and device
1195           drivers to support L3 master devices like VRF.
1196
1197 config KERNEL_XDP_SOCKETS
1198         bool "XDP sockets support"
1199         help
1200           XDP sockets allows a channel between XDP programs and
1201           userspace applications.
1202
1203 config KERNEL_PAGE_POOL
1204         def_bool n
1205
1206 config KERNEL_PAGE_POOL_STATS
1207         bool "Page pool stats support"
1208         depends on KERNEL_PAGE_POOL
1209
1210 #
1211 # NFS related symbols
1212 #
1213 config KERNEL_IP_PNP
1214         bool "Compile the kernel with rootfs on NFS"
1215         help
1216            If you want to make your kernel boot off a NFS server as root
1217            filesystem, select Y here.
1218
1219 if KERNEL_IP_PNP
1220
1221         config KERNEL_IP_PNP_DHCP
1222                 def_bool y
1223
1224         config KERNEL_IP_PNP_BOOTP
1225                 def_bool n
1226
1227         config KERNEL_IP_PNP_RARP
1228                 def_bool n
1229
1230         config KERNEL_NFS_FS
1231                 def_bool y
1232
1233         config KERNEL_NFS_V2
1234                 def_bool y
1235
1236         config KERNEL_NFS_V3
1237                 def_bool y
1238
1239         config KERNEL_ROOT_NFS
1240                 def_bool y
1241
1242 endif
1243
1244 menu "Filesystem ACL and attr support options"
1245         config USE_FS_ACL_ATTR
1246                 bool "Use filesystem ACL and attr support by default"
1247                 help
1248                   Make using ACLs (e.g. POSIX ACL, NFSv4 ACL) the default
1249                   for kernel and packages, except tmpfs, flash filesystems,
1250                   and old NFS.  Also enable userspace extended attribute support
1251                   by default.  (OpenWrt already has an expection it will be
1252                   present in the kernel).
1253
1254         config KERNEL_FS_POSIX_ACL
1255                 bool "Enable POSIX ACL support"
1256                 default y if USE_FS_ACL_ATTR
1257
1258         config KERNEL_BTRFS_FS_POSIX_ACL
1259                 bool "Enable POSIX ACL for BtrFS Filesystems"
1260                 select KERNEL_FS_POSIX_ACL
1261                 default y if USE_FS_ACL_ATTR
1262
1263         config KERNEL_EXT4_FS_POSIX_ACL
1264                 bool "Enable POSIX ACL for Ext4 Filesystems"
1265                 select KERNEL_FS_POSIX_ACL
1266                 default y if USE_FS_ACL_ATTR
1267
1268         config KERNEL_F2FS_FS_POSIX_ACL
1269                 bool "Enable POSIX ACL for F2FS Filesystems"
1270                 select KERNEL_FS_POSIX_ACL
1271
1272         config KERNEL_JFFS2_FS_POSIX_ACL
1273                 bool "Enable POSIX ACL for JFFS2 Filesystems"
1274                 select KERNEL_FS_POSIX_ACL
1275
1276         config KERNEL_TMPFS_POSIX_ACL
1277                 bool "Enable POSIX ACL for TMPFS Filesystems"
1278                 select KERNEL_FS_POSIX_ACL
1279
1280         config KERNEL_CIFS_ACL
1281                 bool "Enable CIFS ACLs"
1282                 select KERNEL_FS_POSIX_ACL
1283                 default y if USE_FS_ACL_ATTR
1284
1285         config KERNEL_HFS_FS_POSIX_ACL
1286                 bool "Enable POSIX ACL for HFS Filesystems"
1287                 select KERNEL_FS_POSIX_ACL
1288                 default y if USE_FS_ACL_ATTR
1289
1290         config KERNEL_HFSPLUS_FS_POSIX_ACL
1291                 bool "Enable POSIX ACL for HFS+ Filesystems"
1292                 select KERNEL_FS_POSIX_ACL
1293                 default y if USE_FS_ACL_ATTR
1294
1295         config KERNEL_NFS_ACL_SUPPORT
1296                 bool "Enable ACLs for NFS"
1297                 default y if USE_FS_ACL_ATTR
1298
1299         config KERNEL_NFS_V3_ACL_SUPPORT
1300                 bool "Enable ACLs for NFSv3"
1301
1302         config KERNEL_NFSD_V2_ACL_SUPPORT
1303                 bool "Enable ACLs for NFSDv2"
1304
1305         config KERNEL_NFSD_V3_ACL_SUPPORT
1306                 bool "Enable ACLs for NFSDv3"
1307
1308         config KERNEL_REISER_FS_POSIX_ACL
1309                 bool "Enable POSIX ACLs for ReiserFS"
1310                 select KERNEL_FS_POSIX_ACL
1311                 default y if USE_FS_ACL_ATTR
1312
1313         config KERNEL_XFS_POSIX_ACL
1314                 bool "Enable POSIX ACLs for XFS"
1315                 select KERNEL_FS_POSIX_ACL
1316                 default y if USE_FS_ACL_ATTR
1317
1318         config KERNEL_JFS_POSIX_ACL
1319                 bool "Enable POSIX ACLs for JFS"
1320                 select KERNEL_FS_POSIX_ACL
1321                 default y if USE_FS_ACL_ATTR
1322
1323 endmenu
1324
1325 config KERNEL_DEVMEM
1326         bool "/dev/mem virtual device support"
1327         help
1328           Say Y here if you want to support the /dev/mem device.
1329           The /dev/mem device is used to access areas of physical
1330           memory.
1331
1332 config KERNEL_DEVKMEM
1333         bool "/dev/kmem virtual device support"
1334         help
1335           Say Y here if you want to support the /dev/kmem device. The
1336           /dev/kmem device is rarely used, but can be used for certain
1337           kind of kernel debugging operations.
1338
1339 config KERNEL_SQUASHFS_FRAGMENT_CACHE_SIZE
1340         int "Number of squashfs fragments cached"
1341         default 2 if (SMALL_FLASH && !LOW_MEMORY_FOOTPRINT)
1342         default 3
1343
1344 config KERNEL_SQUASHFS_XATTR
1345         bool "Squashfs XATTR support"
1346
1347 #
1348 # compile optimization setting
1349 #
1350 choice
1351         prompt "Compiler optimization level"
1352         default KERNEL_CC_OPTIMIZE_FOR_SIZE if SMALL_FLASH
1353
1354 config KERNEL_CC_OPTIMIZE_FOR_PERFORMANCE
1355         bool "Optimize for performance"
1356         help
1357           This is the default optimization level for the kernel, building
1358           with the "-O2" compiler flag for best performance and most
1359           helpful compile-time warnings.
1360
1361 config KERNEL_CC_OPTIMIZE_FOR_SIZE
1362         bool "Optimize for size"
1363         help
1364           Enabling this option will pass "-Os" instead of "-O2" to
1365           your compiler resulting in a smaller kernel.
1366
1367 endchoice
1368
1369 config KERNEL_AUDIT
1370         bool "Auditing support"
1371
1372 config KERNEL_SECURITY
1373         bool "Enable different security models"
1374
1375 config KERNEL_SECURITY_NETWORK
1376         bool "Socket and Networking Security Hooks"
1377         select KERNEL_SECURITY
1378
1379 config KERNEL_SECURITY_SELINUX
1380         bool "NSA SELinux Support"
1381         select KERNEL_SECURITY_NETWORK
1382         select KERNEL_AUDIT
1383
1384 config KERNEL_SECURITY_SELINUX_BOOTPARAM
1385         bool "NSA SELinux boot parameter"
1386         depends on KERNEL_SECURITY_SELINUX
1387         default y
1388
1389 config KERNEL_SECURITY_SELINUX_DISABLE
1390         bool "NSA SELinux runtime disable"
1391         depends on KERNEL_SECURITY_SELINUX
1392
1393 config KERNEL_SECURITY_SELINUX_DEVELOP
1394         bool "NSA SELinux Development Support"
1395         depends on KERNEL_SECURITY_SELINUX
1396         default y
1397
1398 config KERNEL_SECURITY_SELINUX_SIDTAB_HASH_BITS
1399         int
1400         depends on KERNEL_SECURITY_SELINUX
1401         default 9
1402
1403 config KERNEL_SECURITY_SELINUX_SID2STR_CACHE_SIZE
1404         int
1405         depends on KERNEL_SECURITY_SELINUX
1406         default 256
1407
1408 config KERNEL_LSM
1409         string
1410         default "lockdown,yama,loadpin,safesetid,integrity,selinux"
1411         depends on KERNEL_SECURITY_SELINUX
1412
1413 config KERNEL_EXT4_FS_SECURITY
1414         bool "Ext4 Security Labels"
1415
1416 config KERNEL_F2FS_FS_SECURITY
1417         bool "F2FS Security Labels"
1418
1419 config KERNEL_UBIFS_FS_SECURITY
1420         bool "UBIFS Security Labels"
1421
1422 config KERNEL_JFFS2_FS_SECURITY
1423         bool "JFFS2 Security Labels"
1424
1425 config KERNEL_WERROR
1426         bool "Compile the kernel with warnings as errors"
1427         help
1428           A kernel build should not cause any compiler warnings, and this
1429           enables the '-Werror' (for C) and '-Dwarnings' (for Rust) flags
1430           to enforce that rule by default. Certain warnings from other tools
1431           such as the linker may be upgraded to errors with this option as
1432           well.
1433
1434           However, if you have a new (or very old) compiler or linker with odd
1435           and unusual warnings, or you have some architecture with problems,
1436           you may need to disable this config option in order to
1437           successfully build the kernel.