config/Config-kernel.in

   1 # SPDX-License-Identifier: GPL-2.0-only
   2 #
   3 # Copyright (C) 2006-2014 OpenWrt.org
   4
   5 config KERNEL_BUILD_USER
   6         string "Custom Kernel Build User Name"
   7         default "builder" if BUILDBOT
   8         default ""
   9         help
  10           Sets the Kernel build user string, which for example will be returned
  11           by 'uname -a' on running systems.
  12           If not set, uses system user at build time.
  13
  14 config KERNEL_BUILD_DOMAIN
  15         string "Custom Kernel Build Domain Name"
  16         default "buildhost" if BUILDBOT
  17         default ""
  18         help
  19           Sets the Kernel build domain string, which for example will be
  20           returned by 'uname -a' on running systems.
  21           If not set, uses system hostname at build time.
  22
  23 config KERNEL_PRINTK
  24         bool "Enable support for printk"
  25         default y
  26
  27 config KERNEL_SWAP
  28         bool "Support for paging of anonymous memory (swap)"
  29         default y if !SMALL_FLASH
  30
  31 config KERNEL_PROC_STRIPPED
  32         bool "Strip non-essential /proc functionality to reduce code size"
  33         default y if SMALL_FLASH
  34
  35 config KERNEL_DEBUG_FS
  36         bool "Compile the kernel with debug filesystem enabled"
  37         default y
  38         help
  39           debugfs is a virtual file system that kernel developers use to put
  40           debugging files into. Enable this option to be able to read and
  41           write to these files. Many common debugging facilities, such as
  42           ftrace, require the existence of debugfs.
  43
  44 config KERNEL_MIPS_FP_SUPPORT
  45         bool
  46         default y if TARGET_pistachio
  47
  48 config KERNEL_ARM_PMU
  49         bool
  50         default n
  51         depends on (arm || aarch64)
  52
  53 config KERNEL_X86_VSYSCALL_EMULATION
  54         bool "Enable vsyscall emulation"
  55         default n
  56         depends on x86_64
  57         help
  58           This enables emulation of the legacy vsyscall page.  Disabling
  59           it is roughly equivalent to booting with vsyscall=none, except
  60           that it will also disable the helpful warning if a program
  61           tries to use a vsyscall.  With this option set to N, offending
  62           programs will just segfault, citing addresses of the form
  63           0xffffffffff600?00.
  64
  65           This option is required by many programs built before 2013, and
  66           care should be used even with newer programs if set to N.
  67
  68           Disabling this option saves about 7K of kernel size and
  69           possibly 4K of additional runtime pagetable memory.
  70
  71 config KERNEL_PERF_EVENTS
  72         bool "Compile the kernel with performance events and counters"
  73         default n
  74         select KERNEL_ARM_PMU if (arm || aarch64)
  75
  76 config KERNEL_PROFILING
  77         bool "Compile the kernel with profiling enabled"
  78         default n
  79         select KERNEL_PERF_EVENTS
  80         help
  81           Enable the extended profiling support mechanisms used by profilers such
  82           as OProfile.
  83
  84 config KERNEL_RPI_AXIPERF
  85         bool "Compile the kernel with RaspberryPi AXI Performance monitors"
  86         default y
  87         depends on KERNEL_PERF_EVENTS && TARGET_bcm27xx
  88
  89 config KERNEL_UBSAN
  90         bool "Compile the kernel with undefined behaviour sanity checker"
  91         help
  92           This option enables undefined behaviour sanity checker
  93           Compile-time instrumentation is used to detect various undefined
  94           behaviours in runtime. Various types of checks may be enabled
  95           via boot parameter ubsan_handle
  96           (see: Documentation/dev-tools/ubsan.rst).
  97
  98 config KERNEL_UBSAN_SANITIZE_ALL
  99         bool "Enable instrumentation for the entire kernel"
 100         depends on KERNEL_UBSAN
 101         default y
 102         help
 103           This option activates instrumentation for the entire kernel.
 104           If you don't enable this option, you have to explicitly specify
 105           UBSAN_SANITIZE := y for the files/directories you want to check for UB.
 106           Enabling this option will get kernel image size increased
 107           significantly.
 108
 109 config KERNEL_UBSAN_ALIGNMENT
 110         bool "Enable checking of pointers alignment"
 111         depends on KERNEL_UBSAN
 112         help
 113           This option enables detection of unaligned memory accesses.
 114           Enabling this option on architectures that support unaligned
 115           accesses may produce a lot of false positives.
 116
 117 config KERNEL_UBSAN_BOUNDS
 118         bool "Perform array index bounds checking"
 119         depends on KERNEL_UBSAN
 120         help
 121           This option enables detection of directly indexed out of bounds array
 122           accesses, where the array size is known at compile time. Note that
 123           this does not protect array overflows via bad calls to the
 124           {str,mem}*cpy() family of functions (that is addressed by
 125           FORTIFY_SOURCE).
 126
 127 config KERNEL_UBSAN_NULL
 128         bool "Enable checking of null pointers"
 129         depends on KERNEL_UBSAN
 130         help
 131           This option enables detection of memory accesses via a
 132           null pointer.
 133
 134 config KERNEL_UBSAN_TRAP
 135         bool "On Sanitizer warnings, abort the running kernel code"
 136         depends on KERNEL_UBSAN
 137         help
 138           Building kernels with Sanitizer features enabled tends to grow the
 139           kernel size by around 5%, due to adding all the debugging text on
 140           failure paths. To avoid this, Sanitizer instrumentation can just
 141           issue a trap. This reduces the kernel size overhead but turns all
 142           warnings (including potentially harmless conditions) into full
 143           exceptions that abort the running kernel code (regardless of context,
 144           locks held, etc), which may destabilize the system. For some system
 145           builders this is an acceptable trade-off.
 146
 147 config KERNEL_KASAN
 148         bool "Compile the kernel with KASan: runtime memory debugger"
 149         select KERNEL_SLUB_DEBUG
 150         depends on (x86_64 || aarch64)
 151         help
 152           Enables kernel address sanitizer - runtime memory debugger,
 153           designed to find out-of-bounds accesses and use-after-free bugs.
 154           This is strictly a debugging feature and it requires a gcc version
 155           of 4.9.2 or later. Detection of out of bounds accesses to stack or
 156           global variables requires gcc 5.0 or later.
 157           This feature consumes about 1/8 of available memory and brings about
 158           ~x3 performance slowdown.
 159           For better error detection enable CONFIG_STACKTRACE.
 160           Currently CONFIG_KASAN doesn't work with CONFIG_DEBUG_SLAB
 161           (the resulting kernel does not boot).
 162
 163 config KERNEL_KASAN_EXTRA
 164         bool "KAsan: extra checks"
 165         depends on KERNEL_KASAN && KERNEL_DEBUG_KERNEL
 166         help
 167           This enables further checks in the kernel address sanitizer, for now
 168           it only includes the address-use-after-scope check that can lead
 169           to excessive kernel stack usage, frame size warnings and longer
 170           compile time.
 171           https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 has more
 172
 173 config KERNEL_KASAN_VMALLOC
 174         bool "Back mappings in vmalloc space with real shadow memory"
 175         depends on KERNEL_KASAN
 176         help
 177           By default, the shadow region for vmalloc space is the read-only
 178           zero page. This means that KASAN cannot detect errors involving
 179           vmalloc space.
 180
 181           Enabling this option will hook in to vmap/vmalloc and back those
 182           mappings with real shadow memory allocated on demand. This allows
 183           for KASAN to detect more sorts of errors (and to support vmapped
 184           stacks), but at the cost of higher memory usage.
 185
 186           This option depends on HAVE_ARCH_KASAN_VMALLOC, but we can't
 187           depend on that in here, so it is possible that enabling this
 188           will have no effect.
 189
 190 if KERNEL_KASAN
 191         config KERNEL_KASAN_GENERIC
 192         def_bool y
 193
 194         config KERNEL_KASAN_SW_TAGS
 195         def_bool n
 196 endif
 197
 198 choice
 199         prompt "Instrumentation type"
 200         depends on KERNEL_KASAN
 201         default KERNEL_KASAN_OUTLINE
 202
 203 config KERNEL_KASAN_OUTLINE
 204         bool "Outline instrumentation"
 205         help
 206           Before every memory access compiler insert function call
 207           __asan_load*/__asan_store*. These functions performs check
 208           of shadow memory. This is slower than inline instrumentation,
 209           however it doesn't bloat size of kernel's .text section so
 210           much as inline does.
 211
 212 config KERNEL_KASAN_INLINE
 213         bool "Inline instrumentation"
 214         help
 215           Compiler directly inserts code checking shadow memory before
 216           memory accesses. This is faster than outline (in some workloads
 217           it gives about x2 boost over outline instrumentation), but
 218           make kernel's .text size much bigger.
 219           This requires a gcc version of 5.0 or later.
 220
 221 endchoice
 222
 223 config KERNEL_KCOV
 224         bool "Compile the kernel with code coverage for fuzzing"
 225         select KERNEL_DEBUG_FS
 226         help
 227           KCOV exposes kernel code coverage information in a form suitable
 228           for coverage-guided fuzzing (randomized testing).
 229
 230           If RANDOMIZE_BASE is enabled, PC values will not be stable across
 231           different machines and across reboots. If you need stable PC values,
 232           disable RANDOMIZE_BASE.
 233
 234           For more details, see Documentation/kcov.txt.
 235
 236 config KERNEL_KCOV_ENABLE_COMPARISONS
 237         bool "Enable comparison operands collection by KCOV"
 238         depends on KERNEL_KCOV
 239         help
 240           KCOV also exposes operands of every comparison in the instrumented
 241           code along with operand sizes and PCs of the comparison instructions.
 242           These operands can be used by fuzzing engines to improve the quality
 243           of fuzzing coverage.
 244
 245 config KERNEL_KCOV_INSTRUMENT_ALL
 246         bool "Instrument all code by default"
 247         depends on KERNEL_KCOV
 248         default y if KERNEL_KCOV
 249         help
 250           If you are doing generic system call fuzzing (like e.g. syzkaller),
 251           then you will want to instrument the whole kernel and you should
 252           say y here. If you are doing more targeted fuzzing (like e.g.
 253           filesystem fuzzing with AFL) then you will want to enable coverage
 254           for more specific subsets of files, and should say n here.
 255
 256 config KERNEL_TASKSTATS
 257         bool "Compile the kernel with task resource/io statistics and accounting"
 258         default n
 259         help
 260           Enable the collection and publishing of task/io statistics and
 261           accounting.  Enable this option to enable i/o monitoring in system
 262           monitors.
 263
 264 if KERNEL_TASKSTATS
 265
 266         config KERNEL_TASK_DELAY_ACCT
 267                 def_bool y
 268
 269         config KERNEL_TASK_IO_ACCOUNTING
 270                 def_bool y
 271
 272         config KERNEL_TASK_XACCT
 273                 def_bool y
 274
 275 endif
 276
 277 config KERNEL_KALLSYMS
 278         bool "Compile the kernel with symbol table information"
 279         default y if !SMALL_FLASH
 280         help
 281           This will give you more information in stack traces from kernel oopses.
 282
 283 config KERNEL_FTRACE
 284         bool "Compile the kernel with tracing support"
 285         depends on !TARGET_uml
 286         default n
 287
 288 config KERNEL_FTRACE_SYSCALLS
 289         bool "Trace system calls"
 290         depends on KERNEL_FTRACE
 291         default n
 292
 293 config KERNEL_ENABLE_DEFAULT_TRACERS
 294         bool "Trace process context switches and events"
 295         depends on KERNEL_FTRACE
 296         default n
 297
 298 config KERNEL_FUNCTION_TRACER
 299         bool "Function tracer"
 300         depends on KERNEL_FTRACE
 301         default n
 302
 303 config KERNEL_FUNCTION_GRAPH_TRACER
 304         bool "Function graph tracer"
 305         depends on KERNEL_FUNCTION_TRACER
 306         default n
 307
 308 config KERNEL_DYNAMIC_FTRACE
 309         bool "Enable/disable function tracing dynamically"
 310         depends on KERNEL_FUNCTION_TRACER
 311         default n
 312
 313 config KERNEL_FUNCTION_PROFILER
 314         bool "Function profiler"
 315         depends on KERNEL_FUNCTION_TRACER
 316         default n
 317
 318 config KERNEL_IRQSOFF_TRACER
 319         bool "Interrupts-off Latency Tracer"
 320         depends on KERNEL_FTRACE
 321         help
 322           This option measures the time spent in irqs-off critical
 323           sections, with microsecond accuracy.
 324
 325           The default measurement method is a maximum search, which is
 326           disabled by default and can be runtime (re-)started
 327           via:
 328
 329               echo 0 > /sys/kernel/debug/tracing/tracing_max_latency
 330
 331           (Note that kernel size and overhead increase with this option
 332           enabled. This option and the preempt-off timing option can be
 333           used together or separately.)
 334
 335 config KERNEL_PREEMPT_TRACER
 336         bool "Preemption-off Latency Tracer"
 337         depends on KERNEL_FTRACE
 338         help
 339           This option measures the time spent in preemption-off critical
 340           sections, with microsecond accuracy.
 341
 342           The default measurement method is a maximum search, which is
 343           disabled by default and can be runtime (re-)started
 344           via:
 345
 346               echo 0 > /sys/kernel/debug/tracing/tracing_max_latency
 347
 348           (Note that kernel size and overhead increase with this option
 349           enabled. This option and the irqs-off timing option can be
 350           used together or separately.)
 351
 352 config KERNEL_HIST_TRIGGERS
 353         bool "Histogram triggers"
 354         depends on KERNEL_FTRACE
 355         help
 356           Hist triggers allow one or more arbitrary trace event fields to be
 357           aggregated into hash tables and dumped to stdout by reading a
 358           debugfs/tracefs file. They're useful for gathering quick and dirty
 359           (though precise) summaries of event activity as an initial guide for
 360           further investigation using more advanced tools.
 361
 362           Inter-event tracing of quantities such as latencies is also
 363           supported using hist triggers under this option.
 364
 365 config KERNEL_DEBUG_KERNEL
 366         bool
 367         default n
 368
 369 config KERNEL_DEBUG_INFO
 370         bool "Compile the kernel with debug information"
 371         default y if !SMALL_FLASH
 372         select KERNEL_DEBUG_KERNEL
 373         help
 374           This will compile your kernel and modules with debug information.
 375
 376 config KERNEL_DEBUG_INFO_BTF
 377
 378         bool "Enable additional BTF type information"
 379         default n
 380         depends on !HOST_OS_MACOS
 381         depends on KERNEL_DEBUG_INFO && !KERNEL_DEBUG_INFO_REDUCED
 382         select DWARVES
 383         help
 384           Generate BPF Type Format (BTF) information from DWARF debug info.
 385           Turning this on expects presence of pahole tool, which will convert
 386           DWARF type info into equivalent deduplicated BTF type info.
 387
 388           Required to run BPF CO-RE applications.
 389
 390 config KERNEL_DEBUG_INFO_REDUCED
 391         bool "Reduce debugging information"
 392         default y
 393         depends on KERNEL_DEBUG_INFO
 394         help
 395           If you say Y here gcc is instructed to generate less debugging
 396           information for structure types. This means that tools that
 397           need full debugging information (like kgdb or systemtap) won't
 398           be happy. But if you merely need debugging information to
 399           resolve line numbers there is no loss. Advantage is that
 400           build directory object sizes shrink dramatically over a full
 401           DEBUG_INFO build and compile times are reduced too.
 402           Only works with newer gcc versions.
 403
 404 config KERNEL_DEBUG_LL_UART_NONE
 405         bool
 406         default n
 407         depends on arm
 408
 409 config KERNEL_DEBUG_LL
 410         bool
 411         default n
 412         depends on arm
 413         select KERNEL_DEBUG_LL_UART_NONE
 414         help
 415           ARM low level debugging.
 416
 417 config KERNEL_DEBUG_VIRTUAL
 418         bool "Compile the kernel with VM translations debugging"
 419         select KERNEL_DEBUG_KERNEL
 420         default n
 421         help
 422           Enable checks sanity checks to catch invalid uses of
 423           virt_to_phys()/phys_to_virt() against the non-linear address space.
 424
 425 config KERNEL_DYNAMIC_DEBUG
 426         bool "Compile the kernel with dynamic printk"
 427         select KERNEL_DEBUG_FS
 428         default n
 429         help
 430           Compiles debug level messages into the kernel, which would not
 431           otherwise be available at runtime. These messages can then be
 432           enabled/disabled based on various levels of scope - per source file,
 433           function, module, format string, and line number. This mechanism
 434           implicitly compiles in all pr_debug() and dev_dbg() calls, which
 435           enlarges the kernel text size by about 2%.
 436
 437 config KERNEL_EARLY_PRINTK
 438         bool "Compile the kernel with early printk"
 439         default y if TARGET_bcm53xx
 440         default n
 441         depends on arm
 442         select KERNEL_DEBUG_KERNEL
 443         select KERNEL_DEBUG_LL if arm
 444         help
 445           Compile the kernel with early printk support.  This is only useful for
 446           debugging purposes to send messages over the serial console in early boot.
 447           Enable this to debug early boot problems.
 448
 449 config KERNEL_KPROBES
 450         bool "Compile the kernel with kprobes support"
 451         default n
 452         select KERNEL_FTRACE
 453         select KERNEL_PERF_EVENTS
 454         help
 455           Compiles the kernel with KPROBES support, which allows you to trap
 456           at almost any kernel address and execute a callback function.
 457           register_kprobe() establishes a probepoint and specifies the
 458           callback. Kprobes is useful for kernel debugging, non-intrusive
 459           instrumentation and testing.
 460           If in doubt, say "N".
 461
 462 config KERNEL_KPROBE_EVENTS
 463         bool
 464         default y if KERNEL_KPROBES
 465
 466 config KERNEL_BPF_EVENTS
 467         bool "Compile the kernel with BPF event support"
 468         default n
 469         select KERNEL_KPROBES
 470         help
 471           Allows to attach BPF programs to kprobe, uprobe and tracepoint events.
 472           This is required to use BPF maps of type BPF_MAP_TYPE_PERF_EVENT_ARRAY
 473           for sending data from BPF programs to user-space for post-processing
 474           or logging.
 475
 476 config KERNEL_BPF_KPROBE_OVERRIDE
 477         bool
 478         default n
 479         depends on KERNEL_KPROBES
 480
 481 config KERNEL_AIO
 482         bool "Compile the kernel with asynchronous IO support"
 483         default y if !SMALL_FLASH
 484
 485 config KERNEL_IO_URING
 486         bool "Compile the kernel with io_uring support"
 487         default y if !SMALL_FLASH
 488
 489 config KERNEL_FHANDLE
 490         bool "Compile the kernel with support for fhandle syscalls"
 491         default y if !SMALL_FLASH
 492
 493 config KERNEL_FANOTIFY
 494         bool "Compile the kernel with modern file notification support"
 495         default y if !SMALL_FLASH
 496
 497 config KERNEL_BLK_DEV_BSG
 498         bool "Compile the kernel with SCSI generic v4 support for any block device"
 499         default n
 500
 501 config KERNEL_TRANSPARENT_HUGEPAGE
 502         bool
 503
 504 choice
 505         prompt "Transparent Hugepage Support sysfs defaults"
 506         depends on KERNEL_TRANSPARENT_HUGEPAGE
 507         default KERNEL_TRANSPARENT_HUGEPAGE_ALWAYS
 508
 509         config KERNEL_TRANSPARENT_HUGEPAGE_ALWAYS
 510                 bool "always"
 511
 512         config KERNEL_TRANSPARENT_HUGEPAGE_MADVISE
 513                 bool "madvise"
 514 endchoice
 515
 516 config KERNEL_HUGETLBFS
 517         bool
 518
 519 config KERNEL_HUGETLB_PAGE
 520         bool "Compile the kernel with HugeTLB support"
 521         select KERNEL_TRANSPARENT_HUGEPAGE
 522         select KERNEL_HUGETLBFS
 523         default n
 524
 525 config KERNEL_MAGIC_SYSRQ
 526         bool "Compile the kernel with SysRq support"
 527         default y
 528
 529 config KERNEL_DEBUG_PINCTRL
 530         bool "Compile the kernel with pinctrl debugging"
 531         select KERNEL_DEBUG_KERNEL
 532
 533 config KERNEL_DEBUG_GPIO
 534         bool "Compile the kernel with gpio debugging"
 535         select KERNEL_DEBUG_KERNEL
 536
 537 config KERNEL_COREDUMP
 538         bool
 539
 540 config KERNEL_ELF_CORE
 541         bool "Enable process core dump support"
 542         select KERNEL_COREDUMP
 543         default y if !SMALL_FLASH
 544
 545 config KERNEL_PROVE_LOCKING
 546         bool "Enable kernel lock checking"
 547         select KERNEL_DEBUG_KERNEL
 548         default n
 549
 550 config KERNEL_SOFTLOCKUP_DETECTOR
 551         bool "Compile the kernel with detect Soft Lockups"
 552         depends on KERNEL_DEBUG_KERNEL
 553         help
 554           Say Y here to enable the kernel to act as a watchdog to detect
 555           soft lockups.
 556
 557           Softlockups are bugs that cause the kernel to loop in kernel
 558           mode for more than 20 seconds, without giving other tasks a
 559           chance to run.  The current stack trace is displayed upon
 560           detection and the system will stay locked up.
 561
 562 config KERNEL_DETECT_HUNG_TASK
 563         bool "Compile the kernel with detect Hung Tasks"
 564         depends on KERNEL_DEBUG_KERNEL
 565         default KERNEL_SOFTLOCKUP_DETECTOR
 566         help
 567           Say Y here to enable the kernel to detect "hung tasks",
 568           which are bugs that cause the task to be stuck in
 569           uninterruptible "D" state indefinitely.
 570
 571           When a hung task is detected, the kernel will print the
 572           current stack trace (which you should report), but the
 573           task will stay in uninterruptible state. If lockdep is
 574           enabled then all held locks will also be reported. This
 575           feature has negligible overhead.
 576
 577 config KERNEL_WQ_WATCHDOG
 578         bool "Compile the kernel with detect Workqueue Stalls"
 579         depends on KERNEL_DEBUG_KERNEL
 580         help
 581           Say Y here to enable stall detection on workqueues.  If a
 582           worker pool doesn't make forward progress on a pending work
 583           item for over a given amount of time, 30s by default, a
 584           warning message is printed along with dump of workqueue
 585           state.  This can be configured through kernel parameter
 586           "workqueue.watchdog_thresh" and its sysfs counterpart.
 587
 588 config KERNEL_DEBUG_ATOMIC_SLEEP
 589         bool "Compile the kernel with sleep inside atomic section checking"
 590         depends on KERNEL_DEBUG_KERNEL
 591         help
 592           If you say Y here, various routines which may sleep will become very
 593           noisy if they are called inside atomic sections: when a spinlock is
 594           held, inside an rcu read side critical section, inside preempt disabled
 595           sections, inside an interrupt, etc...
 596
 597 config KERNEL_DEBUG_VM
 598         bool "Compile the kernel with debug VM"
 599         depends on KERNEL_DEBUG_KERNEL
 600         help
 601           Enable this to turn on extended checks in the virtual-memory system
 602           that may impact performance.
 603
 604           If unsure, say N.
 605
 606 config KERNEL_PRINTK_TIME
 607         bool "Enable printk timestamps"
 608         default y
 609
 610 config KERNEL_SLUB_DEBUG
 611         bool
 612
 613 config KERNEL_SLUB_DEBUG_ON
 614         bool
 615
 616 config KERNEL_SLABINFO
 617         select KERNEL_SLUB_DEBUG
 618         select KERNEL_SLUB_DEBUG_ON
 619         bool "Enable /proc slab debug info"
 620
 621 config KERNEL_PROC_PAGE_MONITOR
 622         bool "Enable /proc page monitoring"
 623
 624 config KERNEL_RELAY
 625         bool
 626
 627 config KERNEL_KEXEC
 628         bool "Enable kexec support"
 629
 630 config KERNEL_PROC_VMCORE
 631         bool
 632
 633 config KERNEL_PROC_KCORE
 634         bool
 635
 636 config KERNEL_CRASH_DUMP
 637         depends on i386 || x86_64 || arm || armeb
 638         select KERNEL_KEXEC
 639         select KERNEL_PROC_VMCORE
 640         select KERNEL_PROC_KCORE
 641         bool "Enable support for kexec crashdump"
 642         default y
 643
 644 config USE_RFKILL
 645         bool "Enable rfkill support"
 646         default RFKILL_SUPPORT
 647
 648 config USE_SPARSE
 649         bool "Enable sparse check during kernel build"
 650         default n
 651
 652 config KERNEL_DEVTMPFS
 653         bool "Compile the kernel with device tmpfs enabled"
 654         default n
 655         help
 656           devtmpfs is a simple, kernel-managed /dev filesystem. The kernel creates
 657           devices nodes for all registered devices to simplify boot, but leaves more
 658           complex tasks to userspace (e.g. udev).
 659
 660 if KERNEL_DEVTMPFS
 661
 662         config KERNEL_DEVTMPFS_MOUNT
 663                 bool "Automatically mount devtmpfs after root filesystem is mounted"
 664                 default n
 665
 666 endif
 667
 668 config KERNEL_KEYS
 669         bool "Enable kernel access key retention support"
 670         default !SMALL_FLASH
 671
 672 config KERNEL_PERSISTENT_KEYRINGS
 673         bool "Enable kernel persistent keyrings"
 674         depends on KERNEL_KEYS
 675         default n
 676
 677 config KERNEL_KEYS_REQUEST_CACHE
 678         bool "Enable temporary caching of the last request_key() result"
 679         depends on KERNEL_KEYS
 680         default n
 681
 682 config KERNEL_BIG_KEYS
 683         bool "Enable large payload keys on kernel keyrings"
 684         depends on KERNEL_KEYS
 685         default n
 686
 687 #
 688 # CGROUP support symbols
 689 #
 690
 691 config KERNEL_CGROUPS
 692         bool "Enable kernel cgroups"
 693         default y if !SMALL_FLASH
 694
 695 if KERNEL_CGROUPS
 696
 697         config KERNEL_CGROUP_DEBUG
 698                 bool "Example debug cgroup subsystem"
 699                 default n
 700                 help
 701                   This option enables a simple cgroup subsystem that
 702                   exports useful debugging information about the cgroups
 703                   framework.
 704
 705         config KERNEL_FREEZER
 706                 bool
 707
 708         config KERNEL_CGROUP_FREEZER
 709                 bool "legacy Freezer cgroup subsystem"
 710                 default n
 711                 select KERNEL_FREEZER
 712                 help
 713                   Provides a way to freeze and unfreeze all tasks in a
 714                   cgroup.
 715                   (legacy cgroup1-only controller, in cgroup2 freezer
 716                   is integrated in the Memory controller)
 717
 718         config KERNEL_CGROUP_DEVICE
 719                 bool "legacy Device controller for cgroups"
 720                 default n
 721                 help
 722                   Provides a cgroup implementing whitelists for devices which
 723                   a process in the cgroup can mknod or open.
 724                   (legacy cgroup1-only controller)
 725
 726         config KERNEL_CGROUP_HUGETLB
 727                 bool "HugeTLB controller"
 728                 default n
 729                 select KERNEL_HUGETLB_PAGE
 730
 731         config KERNEL_CGROUP_PIDS
 732                 bool "PIDs cgroup subsystem"
 733                 default y
 734                 help
 735                   Provides enforcement of process number limits in the scope of a
 736                   cgroup.
 737
 738         config KERNEL_CGROUP_RDMA
 739                 bool "RDMA controller for cgroups"
 740                 default y
 741
 742         config KERNEL_CGROUP_BPF
 743                 bool "Support for eBPF programs attached to cgroups"
 744                 default y
 745
 746         config KERNEL_CPUSETS
 747                 bool "Cpuset support"
 748                 default y
 749                 help
 750                   This option will let you create and manage CPUSETs which
 751                   allow dynamically partitioning a system into sets of CPUs and
 752                   Memory Nodes and assigning tasks to run only within those sets.
 753                   This is primarily useful on large SMP or NUMA systems.
 754
 755         config KERNEL_PROC_PID_CPUSET
 756                 bool "Include legacy /proc/<pid>/cpuset file"
 757                 default n
 758                 depends on KERNEL_CPUSETS
 759
 760         config KERNEL_CGROUP_CPUACCT
 761                 bool "Simple CPU accounting cgroup subsystem"
 762                 default y
 763                 help
 764                   Provides a simple Resource Controller for monitoring the
 765                   total CPU consumed by the tasks in a cgroup.
 766
 767         config KERNEL_RESOURCE_COUNTERS
 768                 bool "Resource counters"
 769                 default y
 770                 help
 771                   This option enables controller independent resource accounting
 772                   infrastructure that works with cgroups.
 773
 774         config KERNEL_MM_OWNER
 775                 bool
 776                 default y if KERNEL_MEMCG
 777
 778         config KERNEL_MEMCG
 779                 bool "Memory Resource Controller for Control Groups"
 780                 default y
 781                 select KERNEL_FREEZER
 782                 depends on KERNEL_RESOURCE_COUNTERS || !LINUX_3_18
 783                 help
 784                   Provides a memory resource controller that manages both anonymous
 785                   memory and page cache. (See Documentation/cgroups/memory.txt)
 786
 787                   Note that setting this option increases fixed memory overhead
 788                   associated with each page of memory in the system. By this,
 789                   20(40)bytes/PAGE_SIZE on 32(64)bit system will be occupied by memory
 790                   usage tracking struct at boot. Total amount of this is printed out
 791                   at boot.
 792
 793                   Only enable when you're ok with these tradeoffs and really
 794                   sure you need the memory resource controller. Even when you enable
 795                   this, you can set "cgroup_disable=memory" at your boot option to
 796                   disable memory resource controller and you can avoid overheads
 797                   (but lose benefits of memory resource controller).
 798
 799                   This config option also selects MM_OWNER config option, which
 800                   could in turn add some fork/exit overhead.
 801
 802         config KERNEL_MEMCG_SWAP
 803                 bool "Memory Resource Controller Swap Extension"
 804                 default y
 805                 depends on KERNEL_MEMCG
 806                 help
 807                   Add swap management feature to memory resource controller. When you
 808                   enable this, you can limit mem+swap usage per cgroup. In other words,
 809                   when you disable this, memory resource controller has no cares to
 810                   usage of swap...a process can exhaust all of the swap. This extension
 811                   is useful when you want to avoid exhaustion swap but this itself
 812                   adds more overheads and consumes memory for remembering information.
 813                   Especially if you use 32bit system or small memory system, please
 814                   be careful about enabling this. When memory resource controller
 815                   is disabled by boot option, this will be automatically disabled and
 816                   there will be no overhead from this. Even when you set this config=y,
 817                   if boot option "swapaccount=0" is set, swap will not be accounted.
 818                   Now, memory usage of swap_cgroup is 2 bytes per entry. If swap page
 819                   size is 4096bytes, 512k per 1Gbytes of swap.
 820
 821         config KERNEL_MEMCG_SWAP_ENABLED
 822                 bool "Memory Resource Controller Swap Extension enabled by default"
 823                 default n
 824                 depends on KERNEL_MEMCG_SWAP
 825                 help
 826                   Memory Resource Controller Swap Extension comes with its price in
 827                   a bigger memory consumption. General purpose distribution kernels
 828                   which want to enable the feature but keep it disabled by default
 829                   and let the user enable it by swapaccount boot command line
 830                   parameter should have this option unselected.
 831
 832                   Those who want to have the feature enabled by default should
 833                   select this option (if, for some reason, they need to disable it,
 834                   then swapaccount=0 does the trick).
 835
 836
 837         config KERNEL_MEMCG_KMEM
 838                 bool "Memory Resource Controller Kernel Memory accounting (EXPERIMENTAL)"
 839                 default y
 840                 depends on KERNEL_MEMCG
 841                 help
 842                   The Kernel Memory extension for Memory Resource Controller can limit
 843                   the amount of memory used by kernel objects in the system. Those are
 844                   fundamentally different from the entities handled by the standard
 845                   Memory Controller, which are page-based, and can be swapped. Users of
 846                   the kmem extension can use it to guarantee that no group of processes
 847                   will ever exhaust kernel resources alone.
 848
 849         config KERNEL_CGROUP_PERF
 850                 bool "Enable perf_event per-cpu per-container group (cgroup) monitoring"
 851                 select KERNEL_PERF_EVENTS
 852                 default n
 853                 help
 854                   This option extends the per-cpu mode to restrict monitoring to
 855                   threads which belong to the cgroup specified and run on the
 856                   designated cpu.
 857
 858         menuconfig KERNEL_CGROUP_SCHED
 859                 bool "Group CPU scheduler"
 860                 default y
 861                 help
 862                   This feature lets CPU scheduler recognize task groups and control CPU
 863                   bandwidth allocation to such task groups. It uses cgroups to group
 864                   tasks.
 865
 866         if KERNEL_CGROUP_SCHED
 867
 868                 config KERNEL_FAIR_GROUP_SCHED
 869                         bool "Group scheduling for SCHED_OTHER"
 870                         default y
 871
 872                 config KERNEL_CFS_BANDWIDTH
 873                         bool "CPU bandwidth provisioning for FAIR_GROUP_SCHED"
 874                         default y
 875                         depends on KERNEL_FAIR_GROUP_SCHED
 876                         help
 877                           This option allows users to define CPU bandwidth rates (limits) for
 878                           tasks running within the fair group scheduler.  Groups with no limit
 879                           set are considered to be unconstrained and will run with no
 880                           restriction.
 881                           See tip/Documentation/scheduler/sched-bwc.txt for more information.
 882
 883                 config KERNEL_RT_GROUP_SCHED
 884                         bool "Group scheduling for SCHED_RR/FIFO"
 885                         default y
 886                         help
 887                           This feature lets you explicitly allocate real CPU bandwidth
 888                           to task groups. If enabled, it will also make it impossible to
 889                           schedule realtime tasks for non-root users until you allocate
 890                           realtime bandwidth for them.
 891
 892         endif
 893
 894         config KERNEL_BLK_CGROUP
 895                 bool "Block IO controller"
 896                 default y
 897                 help
 898                   Generic block IO controller cgroup interface. This is the common
 899                   cgroup interface which should be used by various IO controlling
 900                   policies.
 901
 902                   Currently, CFQ IO scheduler uses it to recognize task groups and
 903                   control disk bandwidth allocation (proportional time slice allocation)
 904                   to such task groups. It is also used by bio throttling logic in
 905                   block layer to implement upper limit in IO rates on a device.
 906
 907                   This option only enables generic Block IO controller infrastructure.
 908                   One needs to also enable actual IO controlling logic/policy. For
 909                   enabling proportional weight division of disk bandwidth in CFQ, set
 910                   CONFIG_CFQ_GROUP_IOSCHED=y; for enabling throttling policy, set
 911                   CONFIG_BLK_DEV_THROTTLING=y.
 912
 913         if KERNEL_BLK_CGROUP
 914
 915                 config KERNEL_CFQ_GROUP_IOSCHED
 916                         bool "Proportional weight of disk bandwidth in CFQ"
 917
 918                 config KERNEL_BLK_DEV_THROTTLING
 919                         bool "Enable throttling policy"
 920                         default y
 921
 922                 config KERNEL_BLK_DEV_THROTTLING_LOW
 923                         bool "Block throttling .low limit interface support (EXPERIMENTAL)"
 924                         depends on KERNEL_BLK_DEV_THROTTLING
 925         endif
 926
 927         config KERNEL_DEBUG_BLK_CGROUP
 928                 bool "Enable Block IO controller debugging"
 929                 default n
 930                 depends on KERNEL_BLK_CGROUP
 931                 help
 932                   Enable some debugging help. Currently it exports additional stat
 933                   files in a cgroup which can be useful for debugging.
 934
 935         config KERNEL_NET_CLS_CGROUP
 936                 bool "legacy Control Group Classifier"
 937                 default n
 938
 939         config KERNEL_CGROUP_NET_CLASSID
 940                 bool "legacy Network classid cgroup"
 941                 default n
 942
 943         config KERNEL_CGROUP_NET_PRIO
 944                 bool "legacy Network priority cgroup"
 945                 default n
 946
 947 endif
 948
 949 #
 950 # Namespace support symbols
 951 #
 952
 953 config KERNEL_NAMESPACES
 954         bool "Enable kernel namespaces"
 955         default y if !SMALL_FLASH
 956
 957 if KERNEL_NAMESPACES
 958
 959         config KERNEL_UTS_NS
 960                 bool "UTS namespace"
 961                 default y
 962                 help
 963                   In this namespace, tasks see different info provided
 964                   with the uname() system call.
 965
 966         config KERNEL_IPC_NS
 967                 bool "IPC namespace"
 968                 default y
 969                 help
 970                   In this namespace, tasks work with IPC ids which correspond to
 971                   different IPC objects in different namespaces.
 972
 973         config KERNEL_USER_NS
 974                 bool "User namespace (EXPERIMENTAL)"
 975                 default y
 976                 help
 977                   This allows containers, i.e. vservers, to use user namespaces
 978                   to provide different user info for different servers.
 979
 980         config KERNEL_PID_NS
 981                 bool "PID Namespaces"
 982                 default y
 983                 help
 984                   Support process id namespaces. This allows having multiple
 985                   processes with the same pid as long as they are in different
 986                   pid namespaces. This is a building block of containers.
 987
 988         config KERNEL_NET_NS
 989                 bool "Network namespace"
 990                 default y
 991                 help
 992                   Allow user space to create what appear to be multiple instances
 993                   of the network stack.
 994
 995 endif
 996
 997 config KERNEL_DEVPTS_MULTIPLE_INSTANCES
 998         bool "Support multiple instances of devpts"
 999         default y if !SMALL_FLASH
1000         help
1001           Enable support for multiple instances of devpts filesystem.
1002           If you want to have isolated PTY namespaces (eg: in containers),
1003           say Y here. Otherwise, say N. If enabled, each mount of devpts
1004           filesystem with the '-o newinstance' option will create an
1005           independent PTY namespace.
1006
1007 config KERNEL_POSIX_MQUEUE
1008         bool "POSIX Message Queues"
1009         default y if !SMALL_FLASH
1010         help
1011           POSIX variant of message queues is a part of IPC. In POSIX message
1012           queues every message has a priority which decides about succession
1013           of receiving it by a process. If you want to compile and run
1014           programs written e.g. for Solaris with use of its POSIX message
1015           queues (functions mq_*) say Y here.
1016
1017           POSIX message queues are visible as a filesystem called 'mqueue'
1018           and can be mounted somewhere if you want to do filesystem
1019           operations on message queues.
1020
1021
1022 config KERNEL_SECCOMP_FILTER
1023         bool
1024         default y if !SMALL_FLASH
1025
1026 config KERNEL_SECCOMP
1027         bool "Enable seccomp support"
1028                 depends on !(TARGET_uml)
1029                 select KERNEL_SECCOMP_FILTER
1030                 default y if !SMALL_FLASH
1031                 help
1032                   Build kernel with support for seccomp.
1033
1034 #
1035 # IPv4 configuration
1036 #
1037
1038 config KERNEL_IP_MROUTE
1039         bool "Enable IPv4 multicast routing"
1040         default y
1041         help
1042           Multicast routing requires a multicast routing daemon in
1043           addition to kernel support.
1044
1045 if KERNEL_IP_MROUTE
1046
1047         config KERNEL_IP_MROUTE_MULTIPLE_TABLES
1048                 def_bool y
1049
1050         config KERNEL_IP_PIMSM_V1
1051                 def_bool y
1052
1053         config KERNEL_IP_PIMSM_V2
1054                 def_bool y
1055
1056 endif
1057
1058 #
1059 # IPv6 configuration
1060 #
1061
1062 config KERNEL_IPV6
1063         def_bool IPV6
1064
1065 if KERNEL_IPV6
1066
1067         config KERNEL_IPV6_MULTIPLE_TABLES
1068                 def_bool y
1069
1070         config KERNEL_IPV6_SUBTREES
1071                 def_bool y
1072
1073         config KERNEL_IPV6_MROUTE
1074                 bool "Enable IPv6 multicast routing"
1075                 default y
1076                 help
1077                   Multicast routing requires a multicast routing daemon in
1078                   addition to kernel support.
1079
1080         if KERNEL_IPV6_MROUTE
1081
1082                 config KERNEL_IPV6_MROUTE_MULTIPLE_TABLES
1083                         def_bool y
1084
1085                 config KERNEL_IPV6_PIMSM_V2
1086                         def_bool y
1087
1088         endif
1089
1090         config KERNEL_IPV6_SEG6_LWTUNNEL
1091                 bool "Enable support for lightweight tunnels"
1092                 default y if !SMALL_FLASH
1093                 help
1094                   Using lwtunnel (needed for IPv6 segment routing) requires ip-full package.
1095
1096         config KERNEL_LWTUNNEL_BPF
1097                 def_bool n
1098
1099 endif
1100
1101 #
1102 # Miscellaneous network configuration
1103 #
1104
1105 config KERNEL_NET_L3_MASTER_DEV
1106         bool "L3 Master device support"
1107         help
1108           This module provides glue between core networking code and device
1109           drivers to support L3 master devices like VRF.
1110
1111 config KERNEL_WIRELESS_EXT
1112         def_bool n
1113
1114 config KERNEL_WEXT_CORE
1115         def_bool KERNEL_WIRELESS_EXT
1116
1117 config KERNEL_WEXT_PRIV
1118         def_bool KERNEL_WIRELESS_EXT
1119
1120 config KERNEL_WEXT_PROC
1121         def_bool KERNEL_WIRELESS_EXT
1122
1123 config KERNEL_WEXT_SPY
1124         def_bool KERNEL_WIRELESS_EXT
1125
1126
1127 #
1128 # NFS related symbols
1129 #
1130 config KERNEL_IP_PNP
1131         bool "Compile the kernel with rootfs on NFS"
1132         help
1133            If you want to make your kernel boot off a NFS server as root
1134            filesystem, select Y here.
1135
1136 if KERNEL_IP_PNP
1137
1138         config KERNEL_IP_PNP_DHCP
1139                 def_bool y
1140
1141         config KERNEL_IP_PNP_BOOTP
1142                 def_bool n
1143
1144         config KERNEL_IP_PNP_RARP
1145                 def_bool n
1146
1147         config KERNEL_NFS_FS
1148                 def_bool y
1149
1150         config KERNEL_NFS_V2
1151                 def_bool y
1152
1153         config KERNEL_NFS_V3
1154                 def_bool y
1155
1156         config KERNEL_ROOT_NFS
1157                 def_bool y
1158
1159 endif
1160
1161 menu "Filesystem ACL and attr support options"
1162         config USE_FS_ACL_ATTR
1163                 bool "Use filesystem ACL and attr support by default"
1164                 default n
1165                 help
1166                   Make using ACLs (e.g. POSIX ACL, NFSv4 ACL) the default
1167                   for kernel and packages, except tmpfs, flash filesystems,
1168                   and old NFS.  Also enable userspace extended attribute support
1169                   by default.  (OpenWrt already has an expection it will be
1170                   present in the kernel).
1171
1172         config KERNEL_FS_POSIX_ACL
1173                 bool "Enable POSIX ACL support"
1174                 default y if USE_FS_ACL_ATTR
1175
1176         config KERNEL_BTRFS_FS_POSIX_ACL
1177                 bool "Enable POSIX ACL for BtrFS Filesystems"
1178                 select KERNEL_FS_POSIX_ACL
1179                 default y if USE_FS_ACL_ATTR
1180
1181         config KERNEL_EXT4_FS_POSIX_ACL
1182                 bool "Enable POSIX ACL for Ext4 Filesystems"
1183                 select KERNEL_FS_POSIX_ACL
1184                 default y if USE_FS_ACL_ATTR
1185
1186         config KERNEL_F2FS_FS_POSIX_ACL
1187                 bool "Enable POSIX ACL for F2FS Filesystems"
1188                 select KERNEL_FS_POSIX_ACL
1189                 default n
1190
1191         config KERNEL_JFFS2_FS_POSIX_ACL
1192                 bool "Enable POSIX ACL for JFFS2 Filesystems"
1193                 select KERNEL_FS_POSIX_ACL
1194                 default n
1195
1196         config KERNEL_TMPFS_POSIX_ACL
1197                 bool "Enable POSIX ACL for TMPFS Filesystems"
1198                 select KERNEL_FS_POSIX_ACL
1199                 default n
1200
1201         config KERNEL_CIFS_ACL
1202                 bool "Enable CIFS ACLs"
1203                 select KERNEL_FS_POSIX_ACL
1204                 default y if USE_FS_ACL_ATTR
1205
1206         config KERNEL_HFS_FS_POSIX_ACL
1207                 bool "Enable POSIX ACL for HFS Filesystems"
1208                 select KERNEL_FS_POSIX_ACL
1209                 default y if USE_FS_ACL_ATTR
1210
1211         config KERNEL_HFSPLUS_FS_POSIX_ACL
1212                 bool "Enable POSIX ACL for HFS+ Filesystems"
1213                 select KERNEL_FS_POSIX_ACL
1214                 default y if USE_FS_ACL_ATTR
1215
1216         config KERNEL_NFS_ACL_SUPPORT
1217                 bool "Enable ACLs for NFS"
1218                 default y if USE_FS_ACL_ATTR
1219
1220         config KERNEL_NFS_V3_ACL_SUPPORT
1221                 bool "Enable ACLs for NFSv3"
1222                 default n
1223
1224         config KERNEL_NFSD_V2_ACL_SUPPORT
1225                 bool "Enable ACLs for NFSDv2"
1226                 default n
1227
1228         config KERNEL_NFSD_V3_ACL_SUPPORT
1229                 bool "Enable ACLs for NFSDv3"
1230                 default n
1231
1232         config KERNEL_REISER_FS_POSIX_ACL
1233                 bool "Enable POSIX ACLs for ReiserFS"
1234                 select KERNEL_FS_POSIX_ACL
1235                 default y if USE_FS_ACL_ATTR
1236
1237         config KERNEL_XFS_POSIX_ACL
1238                 bool "Enable POSIX ACLs for XFS"
1239                 select KERNEL_FS_POSIX_ACL
1240                 default y if USE_FS_ACL_ATTR
1241
1242         config KERNEL_JFS_POSIX_ACL
1243                 bool "Enable POSIX ACLs for JFS"
1244                 select KERNEL_FS_POSIX_ACL
1245                 default y if USE_FS_ACL_ATTR
1246
1247 endmenu
1248
1249 config KERNEL_DEVMEM
1250         bool "/dev/mem virtual device support"
1251         help
1252           Say Y here if you want to support the /dev/mem device.
1253           The /dev/mem device is used to access areas of physical
1254           memory.
1255
1256 config KERNEL_DEVKMEM
1257         bool "/dev/kmem virtual device support"
1258         help
1259           Say Y here if you want to support the /dev/kmem device. The
1260           /dev/kmem device is rarely used, but can be used for certain
1261           kind of kernel debugging operations.
1262
1263 config KERNEL_SQUASHFS_FRAGMENT_CACHE_SIZE
1264         int "Number of squashfs fragments cached"
1265         default 2 if (SMALL_FLASH && !LOW_MEMORY_FOOTPRINT)
1266         default 3
1267
1268 config KERNEL_SQUASHFS_XATTR
1269         bool "Squashfs XATTR support"
1270
1271 #
1272 # compile optimization setting
1273 #
1274 choice
1275         prompt "Compiler optimization level"
1276         default KERNEL_CC_OPTIMIZE_FOR_SIZE if SMALL_FLASH
1277
1278 config KERNEL_CC_OPTIMIZE_FOR_PERFORMANCE
1279         bool "Optimize for performance"
1280         help
1281           This is the default optimization level for the kernel, building
1282           with the "-O2" compiler flag for best performance and most
1283           helpful compile-time warnings.
1284
1285 config KERNEL_CC_OPTIMIZE_FOR_SIZE
1286         bool "Optimize for size"
1287         help
1288           Enabling this option will pass "-Os" instead of "-O2" to
1289           your compiler resulting in a smaller kernel.
1290
1291 endchoice
1292
1293 config KERNEL_AUDIT
1294         bool "Auditing support"
1295
1296 config KERNEL_SECURITY
1297         bool "Enable different security models"
1298
1299 config KERNEL_SECURITY_NETWORK
1300         bool "Socket and Networking Security Hooks"
1301         select KERNEL_SECURITY
1302
1303 config KERNEL_SECURITY_SELINUX
1304         bool "NSA SELinux Support"
1305         select KERNEL_SECURITY_NETWORK
1306         select KERNEL_AUDIT
1307
1308 config KERNEL_SECURITY_SELINUX_BOOTPARAM
1309         bool "NSA SELinux boot parameter"
1310         depends on KERNEL_SECURITY_SELINUX
1311         default y
1312
1313 config KERNEL_SECURITY_SELINUX_DISABLE
1314         bool "NSA SELinux runtime disable"
1315         depends on KERNEL_SECURITY_SELINUX
1316
1317 config KERNEL_SECURITY_SELINUX_DEVELOP
1318         bool "NSA SELinux Development Support"
1319         depends on KERNEL_SECURITY_SELINUX
1320         default y
1321
1322 config KERNEL_SECURITY_SELINUX_SIDTAB_HASH_BITS
1323         int
1324         depends on KERNEL_SECURITY_SELINUX
1325         default 9
1326
1327 config KERNEL_SECURITY_SELINUX_SID2STR_CACHE_SIZE
1328         int
1329         depends on KERNEL_SECURITY_SELINUX
1330         default 256
1331
1332 config KERNEL_LSM
1333         string
1334         default "lockdown,yama,loadpin,safesetid,integrity,selinux"
1335         depends on KERNEL_SECURITY_SELINUX
1336
1337 config KERNEL_EXT4_FS_SECURITY
1338         bool "Ext4 Security Labels"
1339
1340 config KERNEL_F2FS_FS_SECURITY
1341         bool "F2FS Security Labels"
1342
1343 config KERNEL_UBIFS_FS_SECURITY
1344         bool "UBIFS Security Labels"
1345
1346 config KERNEL_JFFS2_FS_SECURITY
1347         bool "JFFS2 Security Labels"