kernel: enable SRv6 support by enabling lwtunnel

[openwrt/openwrt.git] / config / Config-kernel.in

diff --git a/config/Config-kernel.in b/config/Config-kernel.in
index bbdf28bb233fd0f5a43c125253d2b950837a8ecc..858ee0cf60b11aeb766197af33adc8d069bc11f2 100644 (file)
--- a/config/Config-kernel.in
+++ b/config/Config-kernel.in
@@ -4,18 +4,40 @@
 # See /LICENSE for more information.
 #
 
 # See /LICENSE for more information.
 #
 

+config KERNEL_BUILD_USER
+       string "Custom Kernel Build User Name"
+       default "builder" if BUILDBOT
+       default ""
+       help
+         Sets the Kernel build user string, which for example will be returned
+         by 'uname -a' on running systems.
+         If not set, uses system user at build time.
+
+config KERNEL_BUILD_DOMAIN
+       string "Custom Kernel Build Domain Name"
+       default "buildhost" if BUILDBOT
+       default ""
+       help
+         Sets the Kernel build domain string, which for example will be
+         returned by 'uname -a' on running systems.
+         If not set, uses system hostname at build time.
+

 config KERNEL_PRINTK
        bool "Enable support for printk"
        default y
 
 config KERNEL_CRASHLOG
        bool "Crash logging"
 config KERNEL_PRINTK
        bool "Enable support for printk"
        default y
 
 config KERNEL_CRASHLOG
        bool "Crash logging"

-       depends on !(arm || powerpc || sparc || TARGET_uml)
+       depends on !(arm || powerpc || sparc || TARGET_uml || i386 || x86_64)

        default y
 
 config KERNEL_SWAP
        bool "Support for paging of anonymous memory (swap)"
        default y
 
 config KERNEL_SWAP
        bool "Support for paging of anonymous memory (swap)"

-       default y
+       default y if !SMALL_FLASH
+
+config KERNEL_PROC_STRIPPED
+       bool "Strip non-essential /proc functionality to reduce code size"
+       default y if SMALL_FLASH

 
 config KERNEL_DEBUG_FS
        bool "Compile the kernel with debug filesystem enabled"
 
 config KERNEL_DEBUG_FS
        bool "Compile the kernel with debug filesystem enabled"


@@ -26,9 +48,37 @@ config KERNEL_DEBUG_FS
          write to these files. Many common debugging facilities, such as
          ftrace, require the existence of debugfs.
 
          write to these files. Many common debugging facilities, such as
          ftrace, require the existence of debugfs.
 

-config KERNEL_PERF_EVENTS
+config KERNEL_MIPS_FP_SUPPORT
+       bool
+       default y if TARGET_pistachio
+
+config KERNEL_ARM_PMU

        bool
        default n
        bool
        default n

+       depends on (arm || aarch64)
+
+config KERNEL_X86_VSYSCALL_EMULATION
+       bool "Enable vsyscall emulation"
+       default n
+       depends on x86_64
+       help
+         This enables emulation of the legacy vsyscall page.  Disabling
+         it is roughly equivalent to booting with vsyscall=none, except
+         that it will also disable the helpful warning if a program
+         tries to use a vsyscall.  With this option set to N, offending
+         programs will just segfault, citing addresses of the form
+         0xffffffffff600?00.
+
+         This option is required by many programs built before 2013, and
+         care should be used even with newer programs if set to N.
+
+         Disabling this option saves about 7K of kernel size and
+         possibly 4K of additional runtime pagetable memory.
+
+config KERNEL_PERF_EVENTS
+       bool "Compile the kernel with performance events and counters"
+       default n
+       select KERNEL_ARM_PMU if (arm || aarch64)

 
 config KERNEL_PROFILING
        bool "Compile the kernel with profiling enabled"
 
 config KERNEL_PROFILING
        bool "Compile the kernel with profiling enabled"


@@ -38,9 +88,150 @@ config KERNEL_PROFILING
          Enable the extended profiling support mechanisms used by profilers such
          as OProfile.
 
          Enable the extended profiling support mechanisms used by profilers such
          as OProfile.
 

+config KERNEL_UBSAN
+       bool "Compile the kernel with undefined behaviour sanity checker"
+       help
+         This option enables undefined behaviour sanity checker
+         Compile-time instrumentation is used to detect various undefined
+         behaviours in runtime. Various types of checks may be enabled
+         via boot parameter ubsan_handle
+         (see: Documentation/dev-tools/ubsan.rst).
+
+config KERNEL_UBSAN_SANITIZE_ALL
+       bool "Enable instrumentation for the entire kernel"
+       depends on KERNEL_UBSAN
+       default y
+       help
+         This option activates instrumentation for the entire kernel.
+         If you don't enable this option, you have to explicitly specify
+         UBSAN_SANITIZE := y for the files/directories you want to check for UB.
+         Enabling this option will get kernel image size increased
+         significantly.
+
+config KERNEL_UBSAN_ALIGNMENT
+       bool "Enable checking of pointers alignment"
+       depends on KERNEL_UBSAN
+       help
+         This option enables detection of unaligned memory accesses.
+         Enabling this option on architectures that support unaligned
+         accesses may produce a lot of false positives.
+
+config KERNEL_UBSAN_NULL
+       bool "Enable checking of null pointers"
+       depends on KERNEL_UBSAN
+       help
+         This option enables detection of memory accesses via a
+         null pointer.
+
+config KERNEL_KASAN
+       bool "Compile the kernel with KASan: runtime memory debugger"
+       select KERNEL_SLUB_DEBUG
+       depends on (x86_64 || aarch64)
+       help
+         Enables kernel address sanitizer - runtime memory debugger,
+         designed to find out-of-bounds accesses and use-after-free bugs.
+         This is strictly a debugging feature and it requires a gcc version
+         of 4.9.2 or later. Detection of out of bounds accesses to stack or
+         global variables requires gcc 5.0 or later.
+         This feature consumes about 1/8 of available memory and brings about
+         ~x3 performance slowdown.
+         For better error detection enable CONFIG_STACKTRACE.
+         Currently CONFIG_KASAN doesn't work with CONFIG_DEBUG_SLAB
+         (the resulting kernel does not boot).
+
+config KERNEL_KASAN_EXTRA
+       bool "KAsan: extra checks"
+       depends on KERNEL_KASAN && KERNEL_DEBUG_KERNEL
+       help
+         This enables further checks in the kernel address sanitizer, for now
+         it only includes the address-use-after-scope check that can lead
+         to excessive kernel stack usage, frame size warnings and longer
+         compile time.
+         https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 has more
+
+
+choice
+       prompt "Instrumentation type"
+       depends on KERNEL_KASAN
+       default KERNEL_KASAN_OUTLINE
+
+config KERNEL_KASAN_OUTLINE
+       bool "Outline instrumentation"
+       help
+         Before every memory access compiler insert function call
+         __asan_load*/__asan_store*. These functions performs check
+         of shadow memory. This is slower than inline instrumentation,
+         however it doesn't bloat size of kernel's .text section so
+         much as inline does.
+
+config KERNEL_KASAN_INLINE
+       bool "Inline instrumentation"
+       help
+         Compiler directly inserts code checking shadow memory before
+         memory accesses. This is faster than outline (in some workloads
+         it gives about x2 boost over outline instrumentation), but
+         make kernel's .text size much bigger.
+         This requires a gcc version of 5.0 or later.
+
+endchoice
+
+config KERNEL_KCOV
+       bool "Compile the kernel with code coverage for fuzzing"
+       select KERNEL_DEBUG_FS
+       help
+         KCOV exposes kernel code coverage information in a form suitable
+         for coverage-guided fuzzing (randomized testing).
+
+         If RANDOMIZE_BASE is enabled, PC values will not be stable across
+         different machines and across reboots. If you need stable PC values,
+         disable RANDOMIZE_BASE.
+
+         For more details, see Documentation/kcov.txt.
+
+config KERNEL_KCOV_ENABLE_COMPARISONS
+       bool "Enable comparison operands collection by KCOV"
+       depends on KERNEL_KCOV
+       help
+         KCOV also exposes operands of every comparison in the instrumented
+         code along with operand sizes and PCs of the comparison instructions.
+         These operands can be used by fuzzing engines to improve the quality
+         of fuzzing coverage.
+
+config KERNEL_KCOV_INSTRUMENT_ALL
+       bool "Instrument all code by default"
+       depends on KERNEL_KCOV
+       default y if KERNEL_KCOV
+       help
+         If you are doing generic system call fuzzing (like e.g. syzkaller),
+         then you will want to instrument the whole kernel and you should
+         say y here. If you are doing more targeted fuzzing (like e.g.
+         filesystem fuzzing with AFL) then you will want to enable coverage
+         for more specific subsets of files, and should say n here.
+
+config KERNEL_TASKSTATS
+       bool "Compile the kernel with task resource/io statistics and accounting"
+       default n
+       help
+         Enable the collection and publishing of task/io statistics and
+         accounting.  Enable this option to enable i/o monitoring in system
+         monitors.
+
+if KERNEL_TASKSTATS
+
+       config KERNEL_TASK_DELAY_ACCT
+               def_bool y
+
+       config KERNEL_TASK_IO_ACCOUNTING
+               def_bool y
+
+       config KERNEL_TASK_XACCT
+               def_bool y
+
+endif
+

 config KERNEL_KALLSYMS
        bool "Compile the kernel with symbol table information"
 config KERNEL_KALLSYMS
        bool "Compile the kernel with symbol table information"

-       default y
+       default y if !SMALL_FLASH

        help
          This will give you more information in stack traces from kernel oopses.
 
        help
          This will give you more information in stack traces from kernel oopses.
 


@@ -79,13 +270,47 @@ config KERNEL_FUNCTION_PROFILER
        depends on KERNEL_FUNCTION_TRACER
        default n
 
        depends on KERNEL_FUNCTION_TRACER
        default n
 

+config KERNEL_IRQSOFF_TRACER
+       bool "Interrupts-off Latency Tracer"
+       depends on KERNEL_FTRACE
+       help
+         This option measures the time spent in irqs-off critical
+         sections, with microsecond accuracy.
+
+         The default measurement method is a maximum search, which is
+         disabled by default and can be runtime (re-)started
+         via:
+
+             echo 0 > /sys/kernel/debug/tracing/tracing_max_latency
+
+         (Note that kernel size and overhead increase with this option
+         enabled. This option and the preempt-off timing option can be
+         used together or separately.)
+
+config KERNEL_PREEMPT_TRACER
+       bool "Preemption-off Latency Tracer"
+       depends on KERNEL_FTRACE
+       help
+         This option measures the time spent in preemption-off critical
+         sections, with microsecond accuracy.
+
+         The default measurement method is a maximum search, which is
+         disabled by default and can be runtime (re-)started
+         via:
+
+             echo 0 > /sys/kernel/debug/tracing/tracing_max_latency
+
+         (Note that kernel size and overhead increase with this option
+         enabled. This option and the irqs-off timing option can be
+         used together or separately.)
+

 config KERNEL_DEBUG_KERNEL
        bool
        default n
 
 config KERNEL_DEBUG_INFO
        bool "Compile the kernel with debug information"
 config KERNEL_DEBUG_KERNEL
        bool
        default n
 
 config KERNEL_DEBUG_INFO
        bool "Compile the kernel with debug information"

-       default y
+       default y if !SMALL_FLASH

        select KERNEL_DEBUG_KERNEL
        help
          This will compile your kernel and modules with debug information.
        select KERNEL_DEBUG_KERNEL
        help
          This will compile your kernel and modules with debug information.


@@ -144,43 +369,148 @@ config KERNEL_KPROBE_EVENT
        bool
        default y if KERNEL_KPROBES
 
        bool
        default y if KERNEL_KPROBES
 

+config KERNEL_KPROBE_EVENTS
+       bool
+       default y if KERNEL_KPROBES
+

 config KERNEL_AIO
        bool "Compile the kernel with asynchronous IO support"
 config KERNEL_AIO
        bool "Compile the kernel with asynchronous IO support"

-       default n
+       default y if !SMALL_FLASH

 
 

-config KERNEL_DIRECT_IO
-       bool "Compile the kernel with direct IO support"
-       default n
+config KERNEL_IO_URING
+       bool "Compile the kernel with io_uring support"
+       default y if !SMALL_FLASH
+       depends on LINUX_5_4

 
 config KERNEL_FHANDLE
        bool "Compile the kernel with support for fhandle syscalls"
 
 config KERNEL_FHANDLE
        bool "Compile the kernel with support for fhandle syscalls"

-       default n
+       default y if !SMALL_FLASH

 
 config KERNEL_FANOTIFY
        bool "Compile the kernel with modern file notification support"
 
 config KERNEL_FANOTIFY
        bool "Compile the kernel with modern file notification support"

-       default n
+       default y if !SMALL_FLASH

 
 config KERNEL_BLK_DEV_BSG
        bool "Compile the kernel with SCSI generic v4 support for any block device"
        default n
 
 
 config KERNEL_BLK_DEV_BSG
        bool "Compile the kernel with SCSI generic v4 support for any block device"
        default n
 

+config KERNEL_TRANSPARENT_HUGEPAGE
+       bool
+
+choice
+       prompt "Transparent Hugepage Support sysfs defaults"
+       depends on KERNEL_TRANSPARENT_HUGEPAGE
+       default KERNEL_TRANSPARENT_HUGEPAGE_ALWAYS
+
+       config KERNEL_TRANSPARENT_HUGEPAGE_ALWAYS
+               bool "always"
+
+       config KERNEL_TRANSPARENT_HUGEPAGE_MADVISE
+               bool "madvise"
+endchoice
+
+config KERNEL_HUGETLBFS
+       bool
+
+config KERNEL_HUGETLB_PAGE
+       bool "Compile the kernel with HugeTLB support"
+       select KERNEL_TRANSPARENT_HUGEPAGE
+       select KERNEL_HUGETLBFS
+       default n
+

 config KERNEL_MAGIC_SYSRQ
        bool "Compile the kernel with SysRq support"
        default y
 
 config KERNEL_MAGIC_SYSRQ
        bool "Compile the kernel with SysRq support"
        default y
 

+config KERNEL_DEBUG_PINCTRL
+       bool "Compile the kernel with pinctrl debugging"
+       select KERNEL_DEBUG_KERNEL
+
+config KERNEL_DEBUG_GPIO
+       bool "Compile the kernel with gpio debugging"
+       select KERNEL_DEBUG_KERNEL
+

 config KERNEL_COREDUMP
        bool
 
 config KERNEL_ELF_CORE
        bool "Enable process core dump support"
        select KERNEL_COREDUMP
 config KERNEL_COREDUMP
        bool
 
 config KERNEL_ELF_CORE
        bool "Enable process core dump support"
        select KERNEL_COREDUMP

-       default y
+       default y if !SMALL_FLASH

 
 config KERNEL_PROVE_LOCKING
        bool "Enable kernel lock checking"
        select KERNEL_DEBUG_KERNEL
        default n
 
 
 config KERNEL_PROVE_LOCKING
        bool "Enable kernel lock checking"
        select KERNEL_DEBUG_KERNEL
        default n
 

+config KERNEL_LOCKUP_DETECTOR
+       bool "Compile the kernel with detect Hard and Soft Lockups"
+       depends on KERNEL_DEBUG_KERNEL
+       help
+         Say Y here to enable the kernel to act as a watchdog to detect
+         hard and soft lockups.
+
+         Softlockups are bugs that cause the kernel to loop in kernel
+         mode for more than 20 seconds, without giving other tasks a
+         chance to run.  The current stack trace is displayed upon
+         detection and the system will stay locked up.
+
+         Hardlockups are bugs that cause the CPU to loop in kernel mode
+         for more than 10 seconds, without letting other interrupts have a
+         chance to run.  The current stack trace is displayed upon detection
+         and the system will stay locked up.
+
+         The overhead should be minimal.  A periodic hrtimer runs to
+         generate interrupts and kick the watchdog task every 4 seconds.
+         An NMI is generated every 10 seconds or so to check for hardlockups.
+
+         The frequency of hrtimer and NMI events and the soft and hard lockup
+         thresholds can be controlled through the sysctl watchdog_thresh.
+
+config KERNEL_DETECT_HUNG_TASK
+       bool "Compile the kernel with detect Hung Tasks"
+       depends on KERNEL_DEBUG_KERNEL
+       default KERNEL_LOCKUP_DETECTOR
+       help
+         Say Y here to enable the kernel to detect "hung tasks",
+         which are bugs that cause the task to be stuck in
+         uninterruptible "D" state indefinitely.
+
+         When a hung task is detected, the kernel will print the
+         current stack trace (which you should report), but the
+         task will stay in uninterruptible state. If lockdep is
+         enabled then all held locks will also be reported. This
+         feature has negligible overhead.
+
+config KERNEL_WQ_WATCHDOG
+       bool "Compile the kernel with detect Workqueue Stalls"
+       depends on KERNEL_DEBUG_KERNEL
+       help
+         Say Y here to enable stall detection on workqueues.  If a
+         worker pool doesn't make forward progress on a pending work
+         item for over a given amount of time, 30s by default, a
+         warning message is printed along with dump of workqueue
+         state.  This can be configured through kernel parameter
+         "workqueue.watchdog_thresh" and its sysfs counterpart.
+
+config KERNEL_DEBUG_ATOMIC_SLEEP
+       bool "Compile the kernel with sleep inside atomic section checking"
+       depends on KERNEL_DEBUG_KERNEL
+       help
+         If you say Y here, various routines which may sleep will become very
+         noisy if they are called inside atomic sections: when a spinlock is
+         held, inside an rcu read side critical section, inside preempt disabled
+         sections, inside an interrupt, etc...
+
+config KERNEL_DEBUG_VM
+       bool "Compile the kernel with debug VM"
+       depends on KERNEL_DEBUG_KERNEL
+       help
+         Enable this to turn on extended checks in the virtual-memory system
+          that may impact performance.
+
+         If unsure, say N.
+

 config KERNEL_PRINTK_TIME
        bool "Enable printk timestamps"
        default y
 config KERNEL_PRINTK_TIME
        bool "Enable printk timestamps"
        default y


@@ -205,6 +535,20 @@ config KERNEL_RELAY
 config KERNEL_KEXEC
        bool "Enable kexec support"
 
 config KERNEL_KEXEC
        bool "Enable kexec support"
 

+config KERNEL_PROC_VMCORE
+       bool
+
+config KERNEL_PROC_KCORE
+       bool
+
+config KERNEL_CRASH_DUMP
+       depends on i386 || x86_64 || arm || armeb
+       select KERNEL_KEXEC
+       select KERNEL_PROC_VMCORE
+       select KERNEL_PROC_KCORE
+       bool "Enable support for kexec crashdump"
+       default y
+

 config USE_RFKILL
        bool "Enable rfkill support"
        default RFKILL_SUPPORT
 config USE_RFKILL
        bool "Enable rfkill support"
        default RFKILL_SUPPORT


@@ -218,7 +562,7 @@ config KERNEL_DEVTMPFS
        default n
        help
          devtmpfs is a simple, kernel-managed /dev filesystem. The kernel creates
        default n
        help
          devtmpfs is a simple, kernel-managed /dev filesystem. The kernel creates

-         devices nodes for all registered devices ti simplify boot, but leaves more
+         devices nodes for all registered devices to simplify boot, but leaves more

          complex tasks to userspace (e.g. udev).
 
 if KERNEL_DEVTMPFS
          complex tasks to userspace (e.g. udev).
 
 if KERNEL_DEVTMPFS


@@ -229,13 +573,32 @@ if KERNEL_DEVTMPFS
 
 endif
 
 
 endif
 

+config KERNEL_KEYS
+       bool "Enable kernel access key retention support"
+       default !SMALL_FLASH
+
+config KERNEL_PERSISTENT_KEYRINGS
+       bool "Enable kernel persistent keyrings"
+       depends on KERNEL_KEYS
+       default n
+
+config KERNEL_KEYS_REQUEST_CACHE
+       bool "Enable temporary caching of the last request_key() result"
+       depends on KERNEL_KEYS
+       default n
+
+config KERNEL_BIG_KEYS
+       bool "Enable large payload keys on kernel keyrings"
+       depends on KERNEL_KEYS
+       default n
+

 #
 # CGROUP support symbols
 #
 
 config KERNEL_CGROUPS
        bool "Enable kernel cgroups"
 #
 # CGROUP support symbols
 #
 
 config KERNEL_CGROUPS
        bool "Enable kernel cgroups"

-       default n
+       default y if !SMALL_FLASH

 
 if KERNEL_CGROUPS
 
 
 if KERNEL_CGROUPS
 


@@ -249,25 +612,48 @@ if KERNEL_CGROUPS
 
        config KERNEL_FREEZER
                bool
 
        config KERNEL_FREEZER
                bool

-               default y if KERNEL_CGROUP_FREEZER

 
        config KERNEL_CGROUP_FREEZER
 
        config KERNEL_CGROUP_FREEZER

-               bool "Freezer cgroup subsystem"
-               default y
+               bool "legacy Freezer cgroup subsystem"
+               default n
+               select KERNEL_FREEZER

                help
                  Provides a way to freeze and unfreeze all tasks in a
                  cgroup.
                help
                  Provides a way to freeze and unfreeze all tasks in a
                  cgroup.

+                 (legacy cgroup1-only controller, in cgroup2 freezer
+                 is integrated in the Memory controller)

 
        config KERNEL_CGROUP_DEVICE
 
        config KERNEL_CGROUP_DEVICE

-               bool "Device controller for cgroups"
-               default y
+               bool "legacy Device controller for cgroups"
+               default n

                help
                  Provides a cgroup implementing whitelists for devices which
                  a process in the cgroup can mknod or open.
                help
                  Provides a cgroup implementing whitelists for devices which
                  a process in the cgroup can mknod or open.

+                 (legacy cgroup1-only controller)
+
+       config KERNEL_CGROUP_HUGETLB
+               bool "HugeTLB controller"
+               default n
+               select KERNEL_HUGETLB_PAGE
+
+       config KERNEL_CGROUP_PIDS
+               bool "PIDs cgroup subsystem"
+               default y
+               help
+                 Provides enforcement of process number limits in the scope of a
+                 cgroup.
+
+       config KERNEL_CGROUP_RDMA
+               bool "RDMA controller for cgroups"
+               default y
+
+       config KERNEL_CGROUP_BPF
+               bool "Support for eBPF programs attached to cgroups"
+               default y

 
        config KERNEL_CPUSETS
                bool "Cpuset support"
 
        config KERNEL_CPUSETS
                bool "Cpuset support"

-               default n
+               default y

                help
                  This option will let you create and manage CPUSETs which
                  allow dynamically partitioning a system into sets of CPUs and
                help
                  This option will let you create and manage CPUSETs which
                  allow dynamically partitioning a system into sets of CPUs and


@@ -281,14 +667,14 @@ if KERNEL_CGROUPS
 
        config KERNEL_CGROUP_CPUACCT
                bool "Simple CPU accounting cgroup subsystem"
 
        config KERNEL_CGROUP_CPUACCT
                bool "Simple CPU accounting cgroup subsystem"

-               default n
+               default y

                help
                  Provides a simple Resource Controller for monitoring the
                  total CPU consumed by the tasks in a cgroup.
 
        config KERNEL_RESOURCE_COUNTERS
                bool "Resource counters"
                help
                  Provides a simple Resource Controller for monitoring the
                  total CPU consumed by the tasks in a cgroup.
 
        config KERNEL_RESOURCE_COUNTERS
                bool "Resource counters"

-               default n
+               default y

                help
                  This option enables controller independent resource accounting
                  infrastructure that works with cgroups.
                help
                  This option enables controller independent resource accounting
                  infrastructure that works with cgroups.


@@ -299,7 +685,8 @@ if KERNEL_CGROUPS
 
        config KERNEL_MEMCG
                bool "Memory Resource Controller for Control Groups"
 
        config KERNEL_MEMCG
                bool "Memory Resource Controller for Control Groups"

-               default n
+               default y
+               select KERNEL_FREEZER

                depends on KERNEL_RESOURCE_COUNTERS || !LINUX_3_18
                help
                  Provides a memory resource controller that manages both anonymous
                depends on KERNEL_RESOURCE_COUNTERS || !LINUX_3_18
                help
                  Provides a memory resource controller that manages both anonymous


@@ -322,7 +709,7 @@ if KERNEL_CGROUPS
 
        config KERNEL_MEMCG_SWAP
                bool "Memory Resource Controller Swap Extension"
 
        config KERNEL_MEMCG_SWAP
                bool "Memory Resource Controller Swap Extension"

-               default n
+               default y

                depends on KERNEL_MEMCG
                help
                  Add swap management feature to memory resource controller. When you
                depends on KERNEL_MEMCG
                help
                  Add swap management feature to memory resource controller. When you


@@ -357,7 +744,7 @@ if KERNEL_CGROUPS
 
        config KERNEL_MEMCG_KMEM
                bool "Memory Resource Controller Kernel Memory accounting (EXPERIMENTAL)"
 
        config KERNEL_MEMCG_KMEM
                bool "Memory Resource Controller Kernel Memory accounting (EXPERIMENTAL)"

-               default n
+               default y

                depends on KERNEL_MEMCG
                help
                  The Kernel Memory extension for Memory Resource Controller can limit
                depends on KERNEL_MEMCG
                help
                  The Kernel Memory extension for Memory Resource Controller can limit


@@ -378,7 +765,7 @@ if KERNEL_CGROUPS
 
        menuconfig KERNEL_CGROUP_SCHED
                bool "Group CPU scheduler"
 
        menuconfig KERNEL_CGROUP_SCHED
                bool "Group CPU scheduler"

-               default n
+               default y

                help
                  This feature lets CPU scheduler recognize task groups and control CPU
                  bandwidth allocation to such task groups. It uses cgroups to group
                help
                  This feature lets CPU scheduler recognize task groups and control CPU
                  bandwidth allocation to such task groups. It uses cgroups to group


@@ -388,11 +775,11 @@ if KERNEL_CGROUPS
 
                config KERNEL_FAIR_GROUP_SCHED
                        bool "Group scheduling for SCHED_OTHER"
 
                config KERNEL_FAIR_GROUP_SCHED
                        bool "Group scheduling for SCHED_OTHER"

-                       default n
+                       default y

 
                config KERNEL_CFS_BANDWIDTH
                        bool "CPU bandwidth provisioning for FAIR_GROUP_SCHED"
 
                config KERNEL_CFS_BANDWIDTH
                        bool "CPU bandwidth provisioning for FAIR_GROUP_SCHED"

-                       default n
+                       default y

                        depends on KERNEL_FAIR_GROUP_SCHED
                        help
                          This option allows users to define CPU bandwidth rates (limits) for
                        depends on KERNEL_FAIR_GROUP_SCHED
                        help
                          This option allows users to define CPU bandwidth rates (limits) for


@@ -403,7 +790,7 @@ if KERNEL_CGROUPS
 
                config KERNEL_RT_GROUP_SCHED
                        bool "Group scheduling for SCHED_RR/FIFO"
 
                config KERNEL_RT_GROUP_SCHED
                        bool "Group scheduling for SCHED_RR/FIFO"

-                       default n
+                       default y

                        help
                          This feature lets you explicitly allocate real CPU bandwidth
                          to task groups. If enabled, it will also make it impossible to
                        help
                          This feature lets you explicitly allocate real CPU bandwidth
                          to task groups. If enabled, it will also make it impossible to


@@ -431,6 +818,20 @@ if KERNEL_CGROUPS
                  CONFIG_CFQ_GROUP_IOSCHED=y; for enabling throttling policy, set
                  CONFIG_BLK_DEV_THROTTLING=y.
 
                  CONFIG_CFQ_GROUP_IOSCHED=y; for enabling throttling policy, set
                  CONFIG_BLK_DEV_THROTTLING=y.
 

+       if KERNEL_BLK_CGROUP
+
+               config KERNEL_CFQ_GROUP_IOSCHED
+                       bool "Proportional weight of disk bandwidth in CFQ"
+
+               config KERNEL_BLK_DEV_THROTTLING
+                       bool "Enable throttling policy"
+                       default y
+
+               config KERNEL_BLK_DEV_THROTTLING_LOW
+                       bool "Block throttling .low limit interface support (EXPERIMENTAL)"
+                       depends on KERNEL_BLK_DEV_THROTTLING
+       endif
+

        config KERNEL_DEBUG_BLK_CGROUP
                bool "Enable Block IO controller debugging"
                default n
        config KERNEL_DEBUG_BLK_CGROUP
                bool "Enable Block IO controller debugging"
                default n


@@ -440,12 +841,16 @@ if KERNEL_CGROUPS
                  files in a cgroup which can be useful for debugging.
 
        config KERNEL_NET_CLS_CGROUP
                  files in a cgroup which can be useful for debugging.
 
        config KERNEL_NET_CLS_CGROUP

-               bool "Control Group Classifier"
-               default y
+               bool "legacy Control Group Classifier"
+               default n

 
 

-       config KERNEL_NETPRIO_CGROUP
-               bool "Network priority cgroup"
-               default y
+       config KERNEL_CGROUP_NET_CLASSID
+               bool "legacy Network classid cgroup"
+               default n
+
+       config KERNEL_CGROUP_NET_PRIO
+               bool "legacy Network priority cgroup"
+               default n

 
 endif
 
 
 endif
 


@@ -455,7 +860,7 @@ endif
 
 config KERNEL_NAMESPACES
        bool "Enable kernel namespaces"
 
 config KERNEL_NAMESPACES
        bool "Enable kernel namespaces"

-       default n
+       default y if !SMALL_FLASH

 
 if KERNEL_NAMESPACES
 
 
 if KERNEL_NAMESPACES
 


@@ -497,50 +902,297 @@ if KERNEL_NAMESPACES
 
 endif
 
 
 endif
 

+config KERNEL_DEVPTS_MULTIPLE_INSTANCES
+       bool "Support multiple instances of devpts"
+       default y if !SMALL_FLASH
+       help
+         Enable support for multiple instances of devpts filesystem.
+         If you want to have isolated PTY namespaces (eg: in containers),
+         say Y here. Otherwise, say N. If enabled, each mount of devpts
+         filesystem with the '-o newinstance' option will create an
+         independent PTY namespace.
+
+config KERNEL_POSIX_MQUEUE
+       bool "POSIX Message Queues"
+       default y if !SMALL_FLASH
+       help
+         POSIX variant of message queues is a part of IPC. In POSIX message
+         queues every message has a priority which decides about succession
+         of receiving it by a process. If you want to compile and run
+         programs written e.g. for Solaris with use of its POSIX message
+         queues (functions mq_*) say Y here.
+
+         POSIX message queues are visible as a filesystem called 'mqueue'
+         and can be mounted somewhere if you want to do filesystem
+         operations on message queues.
+
+
+config KERNEL_SECCOMP_FILTER
+       bool
+       default y if !SMALL_FLASH
+
+config KERNEL_SECCOMP
+       bool "Enable seccomp support"
+               depends on !(TARGET_uml)
+               select KERNEL_SECCOMP_FILTER
+               default y if !SMALL_FLASH
+               help
+                 Build kernel with support for seccomp.
+

 #
 #

-# LXC related symbols
+# IPv4 configuration

 #
 
 #
 

-config KERNEL_LXC_MISC
-       bool "Enable miscellaneous LXC related options"
-       default n
+config KERNEL_IP_MROUTE
+       bool "Enable IPv4 multicast routing"
+       default y
+       help
+         Multicast routing requires a multicast routing daemon in
+         addition to kernel support.
+
+#
+# IPv6 configuration
+#
+
+config KERNEL_IPV6
+       def_bool IPV6
+
+if KERNEL_IPV6
+
+       config KERNEL_IPV6_MULTIPLE_TABLES
+               def_bool y

 
 

-if KERNEL_LXC_MISC
+       config KERNEL_IPV6_SUBTREES
+               def_bool y

 
 

-       config KERNEL_DEVPTS_MULTIPLE_INSTANCES
-               bool "Support multiple instances of devpts"
+       config KERNEL_IPV6_MROUTE
+               bool "Enable IPv6 multicast routing"

                default y
                help
                default y
                help

-                 Enable support for multiple instances of devpts filesystem.
-                 If you want to have isolated PTY namespaces (eg: in containers),
-                 say Y here. Otherwise, say N. If enabled, each mount of devpts
-                 filesystem with the '-o newinstance' option will create an
-                 independent PTY namespace.
-
-       config KERNEL_POSIX_MQUEUE
-               bool "POSIX Message Queues"
-               default y
+                 Multicast routing requires a multicast routing daemon in
+                 addition to kernel support.
+
+       config KERNEL_IPV6_PIMSM_V2
+               def_bool n
+
+       config KERNEL_IPV6_SEG6_LWTUNNEL
+               def_bool y if !SMALL_FLASH

                help
                help

-                 POSIX variant of message queues is a part of IPC. In POSIX message
-                 queues every message has a priority which decides about succession
-                 of receiving it by a process. If you want to compile and run
-                 programs written e.g. for Solaris with use of its POSIX message
-                 queues (functions mq_*) say Y here.
+                 Using lwtunnel requires full-ip package.

 
 

-                 POSIX message queues are visible as a filesystem called 'mqueue'
-                 and can be mounted somewhere if you want to do filesystem
-                 operations on message queues.
+       config KERNEL_LWTUNNEL_BPF
+               def_bool n

 
 endif
 
 
 endif
 

-config KERNEL_SECCOMP_FILTER
-       bool
-       default n
+#
+# NFS related symbols
+#
+config KERNEL_IP_PNP
+       bool "Compile the kernel with rootfs on NFS"
+       help
+          If you want to make your kernel boot off a NFS server as root
+          filesystem, select Y here.

 
 

-config KERNEL_SECCOMP
-       bool "Enable seccomp support"
-               depends on !(TARGET_uml)
-               select KERNEL_SECCOMP_FILTER
+if KERNEL_IP_PNP
+
+       config KERNEL_IP_PNP_DHCP
+               def_bool y
+
+       config KERNEL_IP_PNP_BOOTP
+               def_bool n
+
+       config KERNEL_IP_PNP_RARP
+               def_bool n
+
+       config KERNEL_NFS_FS
+               def_bool y
+
+       config KERNEL_NFS_V2
+               def_bool y
+
+       config KERNEL_NFS_V3
+               def_bool y
+
+       config KERNEL_ROOT_NFS
+               def_bool y
+
+endif
+
+menu "Filesystem ACL and attr support options"
+       config USE_FS_ACL_ATTR
+               bool "Use filesystem ACL and attr support by default"

                default n
                help
                default n
                help

-                 Build kernel with support for seccomp.
+                 Make using ACLs (e.g. POSIX ACL, NFSv4 ACL) the default
+                 for kernel and packages, except tmpfs, flash filesystems,
+                 and old NFS.  Also enable userspace extended attribute support
+                 by default.  (OpenWrt already has an expection it will be
+                 present in the kernel).
+
+       config KERNEL_FS_POSIX_ACL
+               bool "Enable POSIX ACL support"
+               default y if USE_FS_ACL_ATTR
+
+       config KERNEL_BTRFS_FS_POSIX_ACL
+               bool "Enable POSIX ACL for BtrFS Filesystems"
+               select KERNEL_FS_POSIX_ACL
+               default y if USE_FS_ACL_ATTR
+
+       config KERNEL_EXT4_FS_POSIX_ACL
+               bool "Enable POSIX ACL for Ext4 Filesystems"
+               select KERNEL_FS_POSIX_ACL
+               default y if USE_FS_ACL_ATTR
+
+       config KERNEL_F2FS_FS_POSIX_ACL
+               bool "Enable POSIX ACL for F2FS Filesystems"
+               select KERNEL_FS_POSIX_ACL
+               default n
+
+       config KERNEL_JFFS2_FS_POSIX_ACL
+               bool "Enable POSIX ACL for JFFS2 Filesystems"
+               select KERNEL_FS_POSIX_ACL
+               default n
+
+       config KERNEL_TMPFS_POSIX_ACL
+               bool "Enable POSIX ACL for TMPFS Filesystems"
+               select KERNEL_FS_POSIX_ACL
+               default n
+
+       config KERNEL_CIFS_ACL
+               bool "Enable CIFS ACLs"
+               select KERNEL_FS_POSIX_ACL
+               default y if USE_FS_ACL_ATTR
+
+       config KERNEL_HFS_FS_POSIX_ACL
+               bool "Enable POSIX ACL for HFS Filesystems"
+               select KERNEL_FS_POSIX_ACL
+               default y if USE_FS_ACL_ATTR
+
+       config KERNEL_HFSPLUS_FS_POSIX_ACL
+               bool "Enable POSIX ACL for HFS+ Filesystems"
+               select KERNEL_FS_POSIX_ACL
+               default y if USE_FS_ACL_ATTR
+
+       config KERNEL_NFS_ACL_SUPPORT
+               bool "Enable ACLs for NFS"
+               default y if USE_FS_ACL_ATTR
+
+       config KERNEL_NFS_V3_ACL_SUPPORT
+               bool "Enable ACLs for NFSv3"
+               default n
+
+       config KERNEL_NFSD_V2_ACL_SUPPORT
+               bool "Enable ACLs for NFSDv2"
+               default n
+
+       config KERNEL_NFSD_V3_ACL_SUPPORT
+               bool "Enable ACLs for NFSDv3"
+               default n
+
+       config KERNEL_REISER_FS_POSIX_ACL
+               bool "Enable POSIX ACLs for ReiserFS"
+               select KERNEL_FS_POSIX_ACL
+               default y if USE_FS_ACL_ATTR
+
+       config KERNEL_XFS_POSIX_ACL
+               bool "Enable POSIX ACLs for XFS"
+               select KERNEL_FS_POSIX_ACL
+               default y if USE_FS_ACL_ATTR
+
+       config KERNEL_JFS_POSIX_ACL
+               bool "Enable POSIX ACLs for JFS"
+               select KERNEL_FS_POSIX_ACL
+               default y if USE_FS_ACL_ATTR
+
+endmenu
+
+config KERNEL_DEVMEM
+       bool "/dev/mem virtual device support"
+       help
+         Say Y here if you want to support the /dev/mem device.
+         The /dev/mem device is used to access areas of physical
+         memory.
+
+config KERNEL_DEVKMEM
+       bool "/dev/kmem virtual device support"
+       help
+         Say Y here if you want to support the /dev/kmem device. The
+         /dev/kmem device is rarely used, but can be used for certain
+         kind of kernel debugging operations.
+
+config KERNEL_SQUASHFS_FRAGMENT_CACHE_SIZE
+       int "Number of squashfs fragments cached"
+       default 2 if (SMALL_FLASH && !LOW_MEMORY_FOOTPRINT)
+       default 3
+
+config KERNEL_SQUASHFS_XATTR
+       bool "Squashfs XATTR support"
+
+#
+# compile optimiziation setting
+#
+choice
+       prompt "Compiler optimization level"
+       default KERNEL_CC_OPTIMIZE_FOR_SIZE if SMALL_FLASH
+
+config KERNEL_CC_OPTIMIZE_FOR_PERFORMANCE
+       bool "Optimize for performance"
+       help
+         This is the default optimization level for the kernel, building
+         with the "-O2" compiler flag for best performance and most
+         helpful compile-time warnings.
+
+config KERNEL_CC_OPTIMIZE_FOR_SIZE
+       bool "Optimize for size"
+       help
+         Enabling this option will pass "-Os" instead of "-O2" to
+         your compiler resulting in a smaller kernel.
+
+endchoice
+
+config KERNEL_AUDIT
+       bool "Auditing support"
+
+config KERNEL_SECURITY
+       bool "Enable different security models"
+
+config KERNEL_SECURITY_NETWORK
+       bool "Socket and Networking Security Hooks"
+       select KERNEL_SECURITY
+
+config KERNEL_SECURITY_SELINUX
+       bool "NSA SELinux Support"
+       select KERNEL_SECURITY_NETWORK
+       select KERNEL_AUDIT
+
+config KERNEL_SECURITY_SELINUX_BOOTPARAM
+       bool "NSA SELinux boot parameter"
+       depends on KERNEL_SECURITY_SELINUX
+       default y
+
+config KERNEL_SECURITY_SELINUX_DISABLE
+       bool "NSA SELinux runtime disable"
+       depends on KERNEL_SECURITY_SELINUX
+
+config KERNEL_SECURITY_SELINUX_DEVELOP
+       bool "NSA SELinux Development Support"
+       depends on KERNEL_SECURITY_SELINUX
+       default y
+
+config KERNEL_LSM
+       string
+       default "lockdown,yama,loadpin,safesetid,integrity,selinux"
+       depends on KERNEL_SECURITY_SELINUX
+
+config KERNEL_EXT4_FS_SECURITY
+       bool "Ext4 Security Labels"
+
+config KERNEL_F2FS_FS_SECURITY
+       bool "F2FS Security Labels"
+
+config KERNEL_UBIFS_FS_SECURITY
+       bool "UBIFS Security Labels"
+
+config KERNEL_JFFS2_FS_SECURITY
+       bool "JFFS2 Security Labels"