config/Config-kernel.in

   1 # SPDX-License-Identifier: GPL-2.0-only
   2 #
   3 # Copyright (C) 2006-2014 OpenWrt.org
   4
   5 config KERNEL_BUILD_USER
   6         string "Custom Kernel Build User Name"
   7         default "builder" if BUILDBOT
   8         default ""
   9         help
  10           Sets the Kernel build user string, which for example will be returned
  11           by 'uname -a' on running systems.
  12           If not set, uses system user at build time.
  13
  14 config KERNEL_BUILD_DOMAIN
  15         string "Custom Kernel Build Domain Name"
  16         default "buildhost" if BUILDBOT
  17         default ""
  18         help
  19           Sets the Kernel build domain string, which for example will be
  20           returned by 'uname -a' on running systems.
  21           If not set, uses system hostname at build time.
  22
  23 config KERNEL_PRINTK
  24         bool "Enable support for printk"
  25         default y
  26
  27 config KERNEL_SWAP
  28         bool "Support for paging of anonymous memory (swap)"
  29         default y if !SMALL_FLASH
  30
  31 config KERNEL_PROC_STRIPPED
  32         bool "Strip non-essential /proc functionality to reduce code size"
  33         default y if SMALL_FLASH
  34
  35 config KERNEL_DEBUG_FS
  36         bool "Compile the kernel with debug filesystem enabled"
  37         default y
  38         help
  39           debugfs is a virtual file system that kernel developers use to put
  40           debugging files into. Enable this option to be able to read and
  41           write to these files. Many common debugging facilities, such as
  42           ftrace, require the existence of debugfs.
  43
  44 config KERNEL_MIPS_FP_SUPPORT
  45         bool
  46         default y if TARGET_pistachio
  47
  48 config KERNEL_ARM_PMU
  49         bool
  50         depends on (arm || aarch64)
  51
  52 config KERNEL_X86_VSYSCALL_EMULATION
  53         bool "Enable vsyscall emulation"
  54         depends on x86_64
  55         help
  56           This enables emulation of the legacy vsyscall page.  Disabling
  57           it is roughly equivalent to booting with vsyscall=none, except
  58           that it will also disable the helpful warning if a program
  59           tries to use a vsyscall.  With this option set to N, offending
  60           programs will just segfault, citing addresses of the form
  61           0xffffffffff600?00.
  62
  63           This option is required by many programs built before 2013, and
  64           care should be used even with newer programs if set to N.
  65
  66           Disabling this option saves about 7K of kernel size and
  67           possibly 4K of additional runtime pagetable memory.
  68
  69 config KERNEL_PERF_EVENTS
  70         bool "Compile the kernel with performance events and counters"
  71         select KERNEL_ARM_PMU if (arm || aarch64)
  72
  73 config KERNEL_PROFILING
  74         bool "Compile the kernel with profiling enabled"
  75         select KERNEL_PERF_EVENTS
  76         help
  77           Enable the extended profiling support mechanisms used by profilers such
  78           as OProfile.
  79
  80 config KERNEL_RPI_AXIPERF
  81         bool "Compile the kernel with RaspberryPi AXI Performance monitors"
  82         default y
  83         depends on KERNEL_PERF_EVENTS && TARGET_bcm27xx
  84
  85 config KERNEL_UBSAN
  86         bool "Compile the kernel with undefined behaviour sanity checker"
  87         help
  88           This option enables undefined behaviour sanity checker
  89           Compile-time instrumentation is used to detect various undefined
  90           behaviours in runtime. Various types of checks may be enabled
  91           via boot parameter ubsan_handle
  92           (see: Documentation/dev-tools/ubsan.rst).
  93
  94 config KERNEL_UBSAN_SANITIZE_ALL
  95         bool "Enable instrumentation for the entire kernel"
  96         depends on KERNEL_UBSAN
  97         default y
  98         help
  99           This option activates instrumentation for the entire kernel.
 100           If you don't enable this option, you have to explicitly specify
 101           UBSAN_SANITIZE := y for the files/directories you want to check for UB.
 102           Enabling this option will get kernel image size increased
 103           significantly.
 104
 105 config KERNEL_UBSAN_ALIGNMENT
 106         bool "Enable checking of pointers alignment"
 107         depends on KERNEL_UBSAN
 108         help
 109           This option enables detection of unaligned memory accesses.
 110           Enabling this option on architectures that support unaligned
 111           accesses may produce a lot of false positives.
 112
 113 config KERNEL_UBSAN_BOUNDS
 114         bool "Perform array index bounds checking"
 115         depends on KERNEL_UBSAN
 116         help
 117           This option enables detection of directly indexed out of bounds array
 118           accesses, where the array size is known at compile time. Note that
 119           this does not protect array overflows via bad calls to the
 120           {str,mem}*cpy() family of functions (that is addressed by
 121           FORTIFY_SOURCE).
 122
 123 config KERNEL_UBSAN_NULL
 124         bool "Enable checking of null pointers"
 125         depends on KERNEL_UBSAN
 126         help
 127           This option enables detection of memory accesses via a
 128           null pointer.
 129
 130 config KERNEL_UBSAN_TRAP
 131         bool "On Sanitizer warnings, abort the running kernel code"
 132         depends on KERNEL_UBSAN
 133         help
 134           Building kernels with Sanitizer features enabled tends to grow the
 135           kernel size by around 5%, due to adding all the debugging text on
 136           failure paths. To avoid this, Sanitizer instrumentation can just
 137           issue a trap. This reduces the kernel size overhead but turns all
 138           warnings (including potentially harmless conditions) into full
 139           exceptions that abort the running kernel code (regardless of context,
 140           locks held, etc), which may destabilize the system. For some system
 141           builders this is an acceptable trade-off.
 142
 143 config KERNEL_KASAN
 144         bool "Compile the kernel with KASan: runtime memory debugger"
 145         select KERNEL_SLUB_DEBUG
 146         depends on (x86_64 || aarch64)
 147         help
 148           Enables kernel address sanitizer - runtime memory debugger,
 149           designed to find out-of-bounds accesses and use-after-free bugs.
 150           This is strictly a debugging feature and it requires a gcc version
 151           of 4.9.2 or later. Detection of out of bounds accesses to stack or
 152           global variables requires gcc 5.0 or later.
 153           This feature consumes about 1/8 of available memory and brings about
 154           ~x3 performance slowdown.
 155           For better error detection enable CONFIG_STACKTRACE.
 156           Currently CONFIG_KASAN doesn't work with CONFIG_DEBUG_SLAB
 157           (the resulting kernel does not boot).
 158
 159 config KERNEL_KASAN_EXTRA
 160         bool "KAsan: extra checks"
 161         depends on KERNEL_KASAN && KERNEL_DEBUG_KERNEL
 162         help
 163           This enables further checks in the kernel address sanitizer, for now
 164           it only includes the address-use-after-scope check that can lead
 165           to excessive kernel stack usage, frame size warnings and longer
 166           compile time.
 167           https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 has more
 168
 169 config KERNEL_KASAN_VMALLOC
 170         bool "Back mappings in vmalloc space with real shadow memory"
 171         depends on KERNEL_KASAN
 172         help
 173           By default, the shadow region for vmalloc space is the read-only
 174           zero page. This means that KASAN cannot detect errors involving
 175           vmalloc space.
 176
 177           Enabling this option will hook in to vmap/vmalloc and back those
 178           mappings with real shadow memory allocated on demand. This allows
 179           for KASAN to detect more sorts of errors (and to support vmapped
 180           stacks), but at the cost of higher memory usage.
 181
 182           This option depends on HAVE_ARCH_KASAN_VMALLOC, but we can't
 183           depend on that in here, so it is possible that enabling this
 184           will have no effect.
 185
 186 if KERNEL_KASAN
 187         config KERNEL_KASAN_GENERIC
 188         def_bool y
 189
 190         config KERNEL_KASAN_SW_TAGS
 191         def_bool n
 192 endif
 193
 194 choice
 195         prompt "Instrumentation type"
 196         depends on KERNEL_KASAN
 197         default KERNEL_KASAN_OUTLINE
 198
 199 config KERNEL_KASAN_OUTLINE
 200         bool "Outline instrumentation"
 201         help
 202           Before every memory access compiler insert function call
 203           __asan_load*/__asan_store*. These functions performs check
 204           of shadow memory. This is slower than inline instrumentation,
 205           however it doesn't bloat size of kernel's .text section so
 206           much as inline does.
 207
 208 config KERNEL_KASAN_INLINE
 209         bool "Inline instrumentation"
 210         help
 211           Compiler directly inserts code checking shadow memory before
 212           memory accesses. This is faster than outline (in some workloads
 213           it gives about x2 boost over outline instrumentation), but
 214           make kernel's .text size much bigger.
 215           This requires a gcc version of 5.0 or later.
 216
 217 endchoice
 218
 219 config KERNEL_KCOV
 220         bool "Compile the kernel with code coverage for fuzzing"
 221         select KERNEL_DEBUG_FS
 222         help
 223           KCOV exposes kernel code coverage information in a form suitable
 224           for coverage-guided fuzzing (randomized testing).
 225
 226           If RANDOMIZE_BASE is enabled, PC values will not be stable across
 227           different machines and across reboots. If you need stable PC values,
 228           disable RANDOMIZE_BASE.
 229
 230           For more details, see Documentation/kcov.txt.
 231
 232 config KERNEL_KCOV_ENABLE_COMPARISONS
 233         bool "Enable comparison operands collection by KCOV"
 234         depends on KERNEL_KCOV
 235         help
 236           KCOV also exposes operands of every comparison in the instrumented
 237           code along with operand sizes and PCs of the comparison instructions.
 238           These operands can be used by fuzzing engines to improve the quality
 239           of fuzzing coverage.
 240
 241 config KERNEL_KCOV_INSTRUMENT_ALL
 242         bool "Instrument all code by default"
 243         depends on KERNEL_KCOV
 244         default y if KERNEL_KCOV
 245         help
 246           If you are doing generic system call fuzzing (like e.g. syzkaller),
 247           then you will want to instrument the whole kernel and you should
 248           say y here. If you are doing more targeted fuzzing (like e.g.
 249           filesystem fuzzing with AFL) then you will want to enable coverage
 250           for more specific subsets of files, and should say n here.
 251
 252 config KERNEL_TASKSTATS
 253         bool "Compile the kernel with task resource/io statistics and accounting"
 254         help
 255           Enable the collection and publishing of task/io statistics and
 256           accounting.  Enable this option to enable i/o monitoring in system
 257           monitors.
 258
 259 if KERNEL_TASKSTATS
 260
 261         config KERNEL_TASK_DELAY_ACCT
 262                 def_bool y
 263
 264         config KERNEL_TASK_IO_ACCOUNTING
 265                 def_bool y
 266
 267         config KERNEL_TASK_XACCT
 268                 def_bool y
 269
 270 endif
 271
 272 config KERNEL_KALLSYMS
 273         bool "Compile the kernel with symbol table information"
 274         default y if !SMALL_FLASH
 275         help
 276           This will give you more information in stack traces from kernel oopses.
 277
 278 config KERNEL_FTRACE
 279         bool "Compile the kernel with tracing support"
 280         depends on !TARGET_uml
 281
 282 config KERNEL_FTRACE_SYSCALLS
 283         bool "Trace system calls"
 284         depends on KERNEL_FTRACE
 285
 286 config KERNEL_ENABLE_DEFAULT_TRACERS
 287         bool "Trace process context switches and events"
 288         depends on KERNEL_FTRACE
 289
 290 config KERNEL_FUNCTION_TRACER
 291         bool "Function tracer"
 292         depends on KERNEL_FTRACE
 293
 294 config KERNEL_FUNCTION_GRAPH_TRACER
 295         bool "Function graph tracer"
 296         depends on KERNEL_FUNCTION_TRACER
 297
 298 config KERNEL_DYNAMIC_FTRACE
 299         bool "Enable/disable function tracing dynamically"
 300         depends on KERNEL_FUNCTION_TRACER
 301
 302 config KERNEL_FUNCTION_PROFILER
 303         bool "Function profiler"
 304         depends on KERNEL_FUNCTION_TRACER
 305
 306 config KERNEL_IRQSOFF_TRACER
 307         bool "Interrupts-off Latency Tracer"
 308         depends on KERNEL_FTRACE
 309         help
 310           This option measures the time spent in irqs-off critical
 311           sections, with microsecond accuracy.
 312
 313           The default measurement method is a maximum search, which is
 314           disabled by default and can be runtime (re-)started
 315           via:
 316
 317               echo 0 > /sys/kernel/debug/tracing/tracing_max_latency
 318
 319           (Note that kernel size and overhead increase with this option
 320           enabled. This option and the preempt-off timing option can be
 321           used together or separately.)
 322
 323 config KERNEL_PREEMPT_TRACER
 324         bool "Preemption-off Latency Tracer"
 325         depends on KERNEL_FTRACE
 326         help
 327           This option measures the time spent in preemption-off critical
 328           sections, with microsecond accuracy.
 329
 330           The default measurement method is a maximum search, which is
 331           disabled by default and can be runtime (re-)started
 332           via:
 333
 334               echo 0 > /sys/kernel/debug/tracing/tracing_max_latency
 335
 336           (Note that kernel size and overhead increase with this option
 337           enabled. This option and the irqs-off timing option can be
 338           used together or separately.)
 339
 340 config KERNEL_HIST_TRIGGERS
 341         bool "Histogram triggers"
 342         depends on KERNEL_FTRACE
 343         help
 344           Hist triggers allow one or more arbitrary trace event fields to be
 345           aggregated into hash tables and dumped to stdout by reading a
 346           debugfs/tracefs file. They're useful for gathering quick and dirty
 347           (though precise) summaries of event activity as an initial guide for
 348           further investigation using more advanced tools.
 349
 350           Inter-event tracing of quantities such as latencies is also
 351           supported using hist triggers under this option.
 352
 353 config KERNEL_DEBUG_KERNEL
 354         bool
 355
 356 config KERNEL_DEBUG_INFO
 357         bool "Compile the kernel with debug information"
 358         default y if !SMALL_FLASH
 359         select KERNEL_DEBUG_KERNEL
 360         help
 361           This will compile your kernel and modules with debug information.
 362
 363 config KERNEL_DEBUG_INFO_BTF
 364
 365         bool "Enable additional BTF type information"
 366         depends on !HOST_OS_MACOS
 367         depends on KERNEL_DEBUG_INFO && !KERNEL_DEBUG_INFO_REDUCED
 368         select DWARVES
 369         help
 370           Generate BPF Type Format (BTF) information from DWARF debug info.
 371           Turning this on expects presence of pahole tool, which will convert
 372           DWARF type info into equivalent deduplicated BTF type info.
 373
 374           Required to run BPF CO-RE applications.
 375
 376 config KERNEL_MODULE_ALLOW_BTF_MISMATCH
 377         bool "Allow loading modules with non-matching BTF type info"
 378         depends on KERNEL_DEBUG_INFO_BTF
 379         help
 380           For modules whose split BTF does not match vmlinux, load without
 381           BTF rather than refusing to load. The default behavior with
 382           module BTF enabled is to reject modules with such mismatches;
 383           this option will still load module BTF where possible but ignore
 384           it when a mismatch is found.
 385
 386 config KERNEL_DEBUG_INFO_REDUCED
 387         bool "Reduce debugging information"
 388         default y
 389         depends on KERNEL_DEBUG_INFO
 390         help
 391           If you say Y here gcc is instructed to generate less debugging
 392           information for structure types. This means that tools that
 393           need full debugging information (like kgdb or systemtap) won't
 394           be happy. But if you merely need debugging information to
 395           resolve line numbers there is no loss. Advantage is that
 396           build directory object sizes shrink dramatically over a full
 397           DEBUG_INFO build and compile times are reduced too.
 398           Only works with newer gcc versions.
 399
 400 config KERNEL_FRAME_WARN
 401         int
 402         range 0 8192
 403         default 1280 if KERNEL_KASAN && !ARCH_64BIT
 404         default 1024 if !ARCH_64BIT
 405         default 2048 if ARCH_64BIT
 406         help
 407           Tell the compiler to warn at build time for stack frames larger than this.
 408           Setting this too low will cause a lot of warnings.
 409           Setting it to 0 disables the warning.
 410
 411 # KERNEL_DEBUG_LL symbols must have the default value set as otherwise
 412 # KConfig wont evaluate them unless KERNEL_EARLY_PRINTK is selected
 413 # which means that buildroot wont override the DEBUG_LL symbols in target
 414 # kernel configurations and lead to devices that dont have working console
 415 config KERNEL_DEBUG_LL_UART_NONE
 416         bool
 417         default n
 418         depends on arm
 419
 420 config KERNEL_DEBUG_LL
 421         bool
 422         default n
 423         depends on arm
 424         select KERNEL_DEBUG_LL_UART_NONE
 425         help
 426           ARM low level debugging.
 427
 428 config KERNEL_DEBUG_VIRTUAL
 429         bool "Compile the kernel with VM translations debugging"
 430         select KERNEL_DEBUG_KERNEL
 431         help
 432           Enable checks sanity checks to catch invalid uses of
 433           virt_to_phys()/phys_to_virt() against the non-linear address space.
 434
 435 config KERNEL_DYNAMIC_DEBUG
 436         bool "Compile the kernel with dynamic printk"
 437         select KERNEL_DEBUG_FS
 438         help
 439           Compiles debug level messages into the kernel, which would not
 440           otherwise be available at runtime. These messages can then be
 441           enabled/disabled based on various levels of scope - per source file,
 442           function, module, format string, and line number. This mechanism
 443           implicitly compiles in all pr_debug() and dev_dbg() calls, which
 444           enlarges the kernel text size by about 2%.
 445
 446 config KERNEL_EARLY_PRINTK
 447         bool "Compile the kernel with early printk"
 448         default y if TARGET_bcm53xx
 449         depends on arm
 450         select KERNEL_DEBUG_KERNEL
 451         select KERNEL_DEBUG_LL if arm
 452         help
 453           Compile the kernel with early printk support.  This is only useful for
 454           debugging purposes to send messages over the serial console in early boot.
 455           Enable this to debug early boot problems.
 456
 457 config KERNEL_KPROBES
 458         bool "Compile the kernel with kprobes support"
 459         select KERNEL_FTRACE
 460         select KERNEL_PERF_EVENTS
 461         help
 462           Compiles the kernel with KPROBES support, which allows you to trap
 463           at almost any kernel address and execute a callback function.
 464           register_kprobe() establishes a probepoint and specifies the
 465           callback. Kprobes is useful for kernel debugging, non-intrusive
 466           instrumentation and testing.
 467           If in doubt, say "N".
 468
 469 config KERNEL_KPROBE_EVENTS
 470         bool
 471         default y if KERNEL_KPROBES
 472
 473 config KERNEL_BPF_EVENTS
 474         bool "Compile the kernel with BPF event support"
 475         select KERNEL_KPROBES
 476         help
 477           Allows to attach BPF programs to kprobe, uprobe and tracepoint events.
 478           This is required to use BPF maps of type BPF_MAP_TYPE_PERF_EVENT_ARRAY
 479           for sending data from BPF programs to user-space for post-processing
 480           or logging.
 481
 482 config KERNEL_BPF_KPROBE_OVERRIDE
 483         bool
 484         depends on KERNEL_KPROBES
 485         default n
 486
 487 config KERNEL_AIO
 488         bool "Compile the kernel with asynchronous IO support"
 489         default y if !SMALL_FLASH
 490
 491 config KERNEL_IO_URING
 492         bool "Compile the kernel with io_uring support"
 493         depends on !SMALL_FLASH
 494         default y if (x86_64 || aarch64)
 495
 496 config KERNEL_FHANDLE
 497         bool "Compile the kernel with support for fhandle syscalls"
 498         default y if !SMALL_FLASH
 499
 500 config KERNEL_FANOTIFY
 501         bool "Compile the kernel with modern file notification support"
 502         default y if !SMALL_FLASH
 503
 504 config KERNEL_BLK_DEV_BSG
 505         bool "Compile the kernel with SCSI generic v4 support for any block device"
 506
 507 config KERNEL_TRANSPARENT_HUGEPAGE
 508         bool
 509
 510 choice
 511         prompt "Transparent Hugepage Support sysfs defaults"
 512         depends on KERNEL_TRANSPARENT_HUGEPAGE
 513         default KERNEL_TRANSPARENT_HUGEPAGE_ALWAYS
 514
 515         config KERNEL_TRANSPARENT_HUGEPAGE_ALWAYS
 516                 bool "always"
 517
 518         config KERNEL_TRANSPARENT_HUGEPAGE_MADVISE
 519                 bool "madvise"
 520 endchoice
 521
 522 config KERNEL_HUGETLBFS
 523         bool
 524
 525 config KERNEL_HUGETLB_PAGE
 526         bool "Compile the kernel with HugeTLB support"
 527         select KERNEL_TRANSPARENT_HUGEPAGE
 528         select KERNEL_HUGETLBFS
 529
 530 config KERNEL_MAGIC_SYSRQ
 531         bool "Compile the kernel with SysRq support"
 532         default y
 533
 534 config KERNEL_DEBUG_PINCTRL
 535         bool "Compile the kernel with pinctrl debugging"
 536         select KERNEL_DEBUG_KERNEL
 537
 538 config KERNEL_DEBUG_GPIO
 539         bool "Compile the kernel with gpio debugging"
 540         select KERNEL_DEBUG_KERNEL
 541
 542 config KERNEL_COREDUMP
 543         bool
 544
 545 config KERNEL_ELF_CORE
 546         bool "Enable process core dump support"
 547         select KERNEL_COREDUMP
 548         default y if !SMALL_FLASH
 549
 550 config KERNEL_PROVE_LOCKING
 551         bool "Enable kernel lock checking"
 552         select KERNEL_DEBUG_KERNEL
 553
 554 config KERNEL_SOFTLOCKUP_DETECTOR
 555         bool "Compile the kernel with detect Soft Lockups"
 556         depends on KERNEL_DEBUG_KERNEL
 557         help
 558           Say Y here to enable the kernel to act as a watchdog to detect
 559           soft lockups.
 560
 561           Softlockups are bugs that cause the kernel to loop in kernel
 562           mode for more than 20 seconds, without giving other tasks a
 563           chance to run.  The current stack trace is displayed upon
 564           detection and the system will stay locked up.
 565
 566 config KERNEL_HARDLOCKUP_DETECTOR
 567         bool "Compile the kernel with detect Hard Lockups"
 568         depends on KERNEL_DEBUG_KERNEL
 569         help
 570           Say Y here to enable the kernel to act as a watchdog to detect
 571           hard lockups.
 572
 573           Hardlockups are bugs that cause the CPU to loop in kernel mode
 574           for more than 10 seconds, without letting other interrupts have a
 575           chance to run.  The current stack trace is displayed upon detection
 576           and the system will stay locked up.
 577
 578 config KERNEL_DETECT_HUNG_TASK
 579         bool "Compile the kernel with detect Hung Tasks"
 580         depends on KERNEL_DEBUG_KERNEL
 581         default KERNEL_SOFTLOCKUP_DETECTOR
 582         help
 583           Say Y here to enable the kernel to detect "hung tasks",
 584           which are bugs that cause the task to be stuck in
 585           uninterruptible "D" state indefinitely.
 586
 587           When a hung task is detected, the kernel will print the
 588           current stack trace (which you should report), but the
 589           task will stay in uninterruptible state. If lockdep is
 590           enabled then all held locks will also be reported. This
 591           feature has negligible overhead.
 592
 593 config KERNEL_WQ_WATCHDOG
 594         bool "Compile the kernel with detect Workqueue Stalls"
 595         depends on KERNEL_DEBUG_KERNEL
 596         help
 597           Say Y here to enable stall detection on workqueues.  If a
 598           worker pool doesn't make forward progress on a pending work
 599           item for over a given amount of time, 30s by default, a
 600           warning message is printed along with dump of workqueue
 601           state.  This can be configured through kernel parameter
 602           "workqueue.watchdog_thresh" and its sysfs counterpart.
 603
 604 config KERNEL_DEBUG_ATOMIC_SLEEP
 605         bool "Compile the kernel with sleep inside atomic section checking"
 606         depends on KERNEL_DEBUG_KERNEL
 607         help
 608           If you say Y here, various routines which may sleep will become very
 609           noisy if they are called inside atomic sections: when a spinlock is
 610           held, inside an rcu read side critical section, inside preempt disabled
 611           sections, inside an interrupt, etc...
 612
 613 config KERNEL_DEBUG_VM
 614         bool "Compile the kernel with debug VM"
 615         depends on KERNEL_DEBUG_KERNEL
 616         help
 617           Enable this to turn on extended checks in the virtual-memory system
 618           that may impact performance.
 619
 620           If unsure, say N.
 621
 622 config KERNEL_PRINTK_TIME
 623         bool "Enable printk timestamps"
 624         default y
 625
 626 config KERNEL_SLUB_DEBUG
 627         bool
 628
 629 config KERNEL_SLUB_DEBUG_ON
 630         bool
 631
 632 config KERNEL_SLABINFO
 633         select KERNEL_SLUB_DEBUG
 634         select KERNEL_SLUB_DEBUG_ON
 635         bool "Enable /proc slab debug info"
 636
 637 config KERNEL_PROC_PAGE_MONITOR
 638         bool "Enable /proc page monitoring"
 639
 640 config KERNEL_RELAY
 641         bool
 642
 643 config KERNEL_KEXEC
 644         bool "Enable kexec support"
 645
 646 config KERNEL_PROC_VMCORE
 647         bool
 648
 649 config KERNEL_PROC_KCORE
 650         bool
 651
 652 config KERNEL_CRASH_DUMP
 653         depends on i386 || x86_64 || arm || armeb
 654         select KERNEL_KEXEC
 655         select KERNEL_PROC_VMCORE
 656         select KERNEL_PROC_KCORE
 657         bool "Enable support for kexec crashdump"
 658         default y
 659
 660 config USE_RFKILL
 661         bool "Enable rfkill support"
 662         default RFKILL_SUPPORT
 663
 664 config USE_SPARSE
 665         bool "Enable sparse check during kernel build"
 666
 667 config KERNEL_DEVTMPFS
 668         bool "Compile the kernel with device tmpfs enabled"
 669         help
 670           devtmpfs is a simple, kernel-managed /dev filesystem. The kernel creates
 671           devices nodes for all registered devices to simplify boot, but leaves more
 672           complex tasks to userspace (e.g. udev).
 673
 674 if KERNEL_DEVTMPFS
 675
 676         config KERNEL_DEVTMPFS_MOUNT
 677                 bool "Automatically mount devtmpfs after root filesystem is mounted"
 678
 679 endif
 680
 681 config KERNEL_KEYS
 682         bool "Enable kernel access key retention support"
 683         default !SMALL_FLASH
 684
 685 config KERNEL_PERSISTENT_KEYRINGS
 686         bool "Enable kernel persistent keyrings"
 687         depends on KERNEL_KEYS
 688
 689 config KERNEL_KEYS_REQUEST_CACHE
 690         bool "Enable temporary caching of the last request_key() result"
 691         depends on KERNEL_KEYS
 692
 693 config KERNEL_BIG_KEYS
 694         bool "Enable large payload keys on kernel keyrings"
 695         depends on KERNEL_KEYS
 696
 697 #
 698 # CGROUP support symbols
 699 #
 700
 701 config KERNEL_CGROUPS
 702         bool "Enable kernel cgroups"
 703         default y if !SMALL_FLASH
 704
 705 if KERNEL_CGROUPS
 706
 707         config KERNEL_CGROUP_DEBUG
 708                 bool "Example debug cgroup subsystem"
 709                 help
 710                   This option enables a simple cgroup subsystem that
 711                   exports useful debugging information about the cgroups
 712                   framework.
 713
 714         config KERNEL_FREEZER
 715                 bool
 716
 717         config KERNEL_CGROUP_FREEZER
 718                 bool "legacy Freezer cgroup subsystem"
 719                 select KERNEL_FREEZER
 720                 help
 721                   Provides a way to freeze and unfreeze all tasks in a
 722                   cgroup.
 723                   (legacy cgroup1-only controller, in cgroup2 freezer
 724                   is integrated in the Memory controller)
 725
 726         config KERNEL_CGROUP_DEVICE
 727                 bool "legacy Device controller for cgroups"
 728                 help
 729                   Provides a cgroup implementing whitelists for devices which
 730                   a process in the cgroup can mknod or open.
 731                   (legacy cgroup1-only controller)
 732
 733         config KERNEL_CGROUP_HUGETLB
 734                 bool "HugeTLB controller"
 735                 select KERNEL_HUGETLB_PAGE
 736
 737         config KERNEL_CGROUP_PIDS
 738                 bool "PIDs cgroup subsystem"
 739                 default y
 740                 help
 741                   Provides enforcement of process number limits in the scope of a
 742                   cgroup.
 743
 744         config KERNEL_CGROUP_RDMA
 745                 bool "RDMA controller for cgroups"
 746                 default y
 747
 748         config KERNEL_CGROUP_BPF
 749                 bool "Support for eBPF programs attached to cgroups"
 750                 default y
 751
 752         config KERNEL_CPUSETS
 753                 bool "Cpuset support"
 754                 default y
 755                 help
 756                   This option will let you create and manage CPUSETs which
 757                   allow dynamically partitioning a system into sets of CPUs and
 758                   Memory Nodes and assigning tasks to run only within those sets.
 759                   This is primarily useful on large SMP or NUMA systems.
 760
 761         config KERNEL_PROC_PID_CPUSET
 762                 bool "Include legacy /proc/<pid>/cpuset file"
 763                 depends on KERNEL_CPUSETS
 764
 765         config KERNEL_CGROUP_CPUACCT
 766                 bool "Simple CPU accounting cgroup subsystem"
 767                 default y
 768                 help
 769                   Provides a simple Resource Controller for monitoring the
 770                   total CPU consumed by the tasks in a cgroup.
 771
 772         config KERNEL_RESOURCE_COUNTERS
 773                 bool "Resource counters"
 774                 default y
 775                 help
 776                   This option enables controller independent resource accounting
 777                   infrastructure that works with cgroups.
 778
 779         config KERNEL_MM_OWNER
 780                 bool
 781                 default y if KERNEL_MEMCG
 782
 783         config KERNEL_MEMCG
 784                 bool "Memory Resource Controller for Control Groups"
 785                 default y
 786                 select KERNEL_FREEZER
 787                 depends on KERNEL_RESOURCE_COUNTERS
 788                 help
 789                   Provides a memory resource controller that manages both anonymous
 790                   memory and page cache. (See Documentation/cgroups/memory.txt)
 791
 792                   Note that setting this option increases fixed memory overhead
 793                   associated with each page of memory in the system. By this,
 794                   20(40)bytes/PAGE_SIZE on 32(64)bit system will be occupied by memory
 795                   usage tracking struct at boot. Total amount of this is printed out
 796                   at boot.
 797
 798                   Only enable when you're ok with these tradeoffs and really
 799                   sure you need the memory resource controller. Even when you enable
 800                   this, you can set "cgroup_disable=memory" at your boot option to
 801                   disable memory resource controller and you can avoid overheads
 802                   (but lose benefits of memory resource controller).
 803
 804                   This config option also selects MM_OWNER config option, which
 805                   could in turn add some fork/exit overhead.
 806
 807         config KERNEL_MEMCG_SWAP
 808                 bool "Memory Resource Controller Swap Extension"
 809                 default y
 810                 depends on KERNEL_MEMCG
 811                 help
 812                   Add swap management feature to memory resource controller. When you
 813                   enable this, you can limit mem+swap usage per cgroup. In other words,
 814                   when you disable this, memory resource controller has no cares to
 815                   usage of swap...a process can exhaust all of the swap. This extension
 816                   is useful when you want to avoid exhaustion swap but this itself
 817                   adds more overheads and consumes memory for remembering information.
 818                   Especially if you use 32bit system or small memory system, please
 819                   be careful about enabling this. When memory resource controller
 820                   is disabled by boot option, this will be automatically disabled and
 821                   there will be no overhead from this. Even when you set this config=y,
 822                   if boot option "swapaccount=0" is set, swap will not be accounted.
 823                   Now, memory usage of swap_cgroup is 2 bytes per entry. If swap page
 824                   size is 4096bytes, 512k per 1Gbytes of swap.
 825
 826         config KERNEL_MEMCG_SWAP_ENABLED
 827                 bool "Memory Resource Controller Swap Extension enabled by default"
 828                 depends on KERNEL_MEMCG_SWAP
 829                 help
 830                   Memory Resource Controller Swap Extension comes with its price in
 831                   a bigger memory consumption. General purpose distribution kernels
 832                   which want to enable the feature but keep it disabled by default
 833                   and let the user enable it by swapaccount boot command line
 834                   parameter should have this option unselected.
 835
 836                   Those who want to have the feature enabled by default should
 837                   select this option (if, for some reason, they need to disable it,
 838                   then swapaccount=0 does the trick).
 839
 840
 841         config KERNEL_MEMCG_KMEM
 842                 bool "Memory Resource Controller Kernel Memory accounting (EXPERIMENTAL)"
 843                 default y
 844                 depends on KERNEL_MEMCG
 845                 help
 846                   The Kernel Memory extension for Memory Resource Controller can limit
 847                   the amount of memory used by kernel objects in the system. Those are
 848                   fundamentally different from the entities handled by the standard
 849                   Memory Controller, which are page-based, and can be swapped. Users of
 850                   the kmem extension can use it to guarantee that no group of processes
 851                   will ever exhaust kernel resources alone.
 852
 853         config KERNEL_CGROUP_PERF
 854                 bool "Enable perf_event per-cpu per-container group (cgroup) monitoring"
 855                 select KERNEL_PERF_EVENTS
 856                 help
 857                   This option extends the per-cpu mode to restrict monitoring to
 858                   threads which belong to the cgroup specified and run on the
 859                   designated cpu.
 860
 861         menuconfig KERNEL_CGROUP_SCHED
 862                 bool "Group CPU scheduler"
 863                 default y
 864                 help
 865                   This feature lets CPU scheduler recognize task groups and control CPU
 866                   bandwidth allocation to such task groups. It uses cgroups to group
 867                   tasks.
 868
 869         if KERNEL_CGROUP_SCHED
 870
 871                 config KERNEL_FAIR_GROUP_SCHED
 872                         bool "Group scheduling for SCHED_OTHER"
 873                         default y
 874
 875                 config KERNEL_CFS_BANDWIDTH
 876                         bool "CPU bandwidth provisioning for FAIR_GROUP_SCHED"
 877                         default y
 878                         depends on KERNEL_FAIR_GROUP_SCHED
 879                         help
 880                           This option allows users to define CPU bandwidth rates (limits) for
 881                           tasks running within the fair group scheduler.  Groups with no limit
 882                           set are considered to be unconstrained and will run with no
 883                           restriction.
 884                           See tip/Documentation/scheduler/sched-bwc.txt for more information.
 885
 886                 config KERNEL_RT_GROUP_SCHED
 887                         bool "Group scheduling for SCHED_RR/FIFO"
 888                         default y
 889                         help
 890                           This feature lets you explicitly allocate real CPU bandwidth
 891                           to task groups. If enabled, it will also make it impossible to
 892                           schedule realtime tasks for non-root users until you allocate
 893                           realtime bandwidth for them.
 894
 895         endif
 896
 897         config KERNEL_BLK_CGROUP
 898                 bool "Block IO controller"
 899                 default y
 900                 help
 901                   Generic block IO controller cgroup interface. This is the common
 902                   cgroup interface which should be used by various IO controlling
 903                   policies.
 904
 905                   Currently, CFQ IO scheduler uses it to recognize task groups and
 906                   control disk bandwidth allocation (proportional time slice allocation)
 907                   to such task groups. It is also used by bio throttling logic in
 908                   block layer to implement upper limit in IO rates on a device.
 909
 910                   This option only enables generic Block IO controller infrastructure.
 911                   One needs to also enable actual IO controlling logic/policy. For
 912                   enabling proportional weight division of disk bandwidth in CFQ, set
 913                   CONFIG_CFQ_GROUP_IOSCHED=y; for enabling throttling policy, set
 914                   CONFIG_BLK_DEV_THROTTLING=y.
 915
 916         if KERNEL_BLK_CGROUP
 917
 918                 config KERNEL_CFQ_GROUP_IOSCHED
 919                         bool "Proportional weight of disk bandwidth in CFQ"
 920
 921                 config KERNEL_BLK_DEV_THROTTLING
 922                         bool "Enable throttling policy"
 923                         default y
 924
 925                 config KERNEL_BLK_DEV_THROTTLING_LOW
 926                         bool "Block throttling .low limit interface support (EXPERIMENTAL)"
 927                         depends on KERNEL_BLK_DEV_THROTTLING
 928         endif
 929
 930         config KERNEL_DEBUG_BLK_CGROUP
 931                 bool "Enable Block IO controller debugging"
 932                 depends on KERNEL_BLK_CGROUP
 933                 help
 934                   Enable some debugging help. Currently it exports additional stat
 935                   files in a cgroup which can be useful for debugging.
 936
 937         config KERNEL_NET_CLS_CGROUP
 938                 bool "legacy Control Group Classifier"
 939
 940         config KERNEL_CGROUP_NET_CLASSID
 941                 bool "legacy Network classid cgroup"
 942
 943         config KERNEL_CGROUP_NET_PRIO
 944                 bool "legacy Network priority cgroup"
 945
 946 endif
 947
 948 #
 949 # Namespace support symbols
 950 #
 951
 952 config KERNEL_NAMESPACES
 953         bool "Enable kernel namespaces"
 954         default y if !SMALL_FLASH
 955
 956 if KERNEL_NAMESPACES
 957
 958         config KERNEL_UTS_NS
 959                 bool "UTS namespace"
 960                 default y
 961                 help
 962                   In this namespace, tasks see different info provided
 963                   with the uname() system call.
 964
 965         config KERNEL_IPC_NS
 966                 bool "IPC namespace"
 967                 default y
 968                 help
 969                   In this namespace, tasks work with IPC ids which correspond to
 970                   different IPC objects in different namespaces.
 971
 972         config KERNEL_USER_NS
 973                 bool "User namespace (EXPERIMENTAL)"
 974                 default y
 975                 help
 976                   This allows containers, i.e. vservers, to use user namespaces
 977                   to provide different user info for different servers.
 978
 979         config KERNEL_PID_NS
 980                 bool "PID Namespaces"
 981                 default y
 982                 help
 983                   Support process id namespaces. This allows having multiple
 984                   processes with the same pid as long as they are in different
 985                   pid namespaces. This is a building block of containers.
 986
 987         config KERNEL_NET_NS
 988                 bool "Network namespace"
 989                 default y
 990                 help
 991                   Allow user space to create what appear to be multiple instances
 992                   of the network stack.
 993
 994 endif
 995
 996 config KERNEL_DEVPTS_MULTIPLE_INSTANCES
 997         bool "Support multiple instances of devpts"
 998         default y if !SMALL_FLASH
 999         help
1000           Enable support for multiple instances of devpts filesystem.
1001           If you want to have isolated PTY namespaces (eg: in containers),
1002           say Y here. Otherwise, say N. If enabled, each mount of devpts
1003           filesystem with the '-o newinstance' option will create an
1004           independent PTY namespace.
1005
1006 config KERNEL_POSIX_MQUEUE
1007         bool "POSIX Message Queues"
1008         default y if !SMALL_FLASH
1009         help
1010           POSIX variant of message queues is a part of IPC. In POSIX message
1011           queues every message has a priority which decides about succession
1012           of receiving it by a process. If you want to compile and run
1013           programs written e.g. for Solaris with use of its POSIX message
1014           queues (functions mq_*) say Y here.
1015
1016           POSIX message queues are visible as a filesystem called 'mqueue'
1017           and can be mounted somewhere if you want to do filesystem
1018           operations on message queues.
1019
1020
1021 config KERNEL_SECCOMP_FILTER
1022         bool
1023         default y if !SMALL_FLASH
1024
1025 config KERNEL_SECCOMP
1026         bool "Enable seccomp support"
1027                 depends on !(TARGET_uml)
1028                 select KERNEL_SECCOMP_FILTER
1029                 default y if !SMALL_FLASH
1030                 help
1031                   Build kernel with support for seccomp.
1032
1033 #
1034 # IPv4 configuration
1035 #
1036
1037 config KERNEL_IP_MROUTE
1038         bool "Enable IPv4 multicast routing"
1039         default y
1040         help
1041           Multicast routing requires a multicast routing daemon in
1042           addition to kernel support.
1043
1044 if KERNEL_IP_MROUTE
1045
1046         config KERNEL_IP_MROUTE_MULTIPLE_TABLES
1047                 def_bool y
1048
1049         config KERNEL_IP_PIMSM_V1
1050                 def_bool y
1051
1052         config KERNEL_IP_PIMSM_V2
1053                 def_bool y
1054
1055 endif
1056
1057 #
1058 # IPv6 configuration
1059 #
1060
1061 config KERNEL_IPV6
1062         def_bool IPV6
1063
1064 if KERNEL_IPV6
1065
1066         config KERNEL_IPV6_MULTIPLE_TABLES
1067                 def_bool y
1068
1069         config KERNEL_IPV6_SUBTREES
1070                 def_bool y
1071
1072         config KERNEL_IPV6_MROUTE
1073                 bool "Enable IPv6 multicast routing"
1074                 default y
1075                 help
1076                   Multicast routing requires a multicast routing daemon in
1077                   addition to kernel support.
1078
1079         if KERNEL_IPV6_MROUTE
1080
1081                 config KERNEL_IPV6_MROUTE_MULTIPLE_TABLES
1082                         def_bool y
1083
1084                 config KERNEL_IPV6_PIMSM_V2
1085                         def_bool y
1086
1087         endif
1088
1089         config KERNEL_IPV6_SEG6_LWTUNNEL
1090                 bool "Enable support for lightweight tunnels"
1091                 default y if !SMALL_FLASH
1092                 help
1093                   Using lwtunnel (needed for IPv6 segment routing) requires ip-full package.
1094
1095         config KERNEL_LWTUNNEL_BPF
1096                 def_bool n
1097
1098 endif
1099
1100 #
1101 # Miscellaneous network configuration
1102 #
1103
1104 config KERNEL_NET_L3_MASTER_DEV
1105         bool "L3 Master device support"
1106         help
1107           This module provides glue between core networking code and device
1108           drivers to support L3 master devices like VRF.
1109
1110 config KERNEL_XDP_SOCKETS
1111         bool "XDP sockets support"
1112         help
1113           XDP sockets allows a channel between XDP programs and
1114           userspace applications.
1115
1116 config KERNEL_WIRELESS_EXT
1117         def_bool n
1118
1119 config KERNEL_WEXT_CORE
1120         def_bool KERNEL_WIRELESS_EXT
1121
1122 config KERNEL_WEXT_PRIV
1123         def_bool KERNEL_WIRELESS_EXT
1124
1125 config KERNEL_WEXT_PROC
1126         def_bool KERNEL_WIRELESS_EXT
1127
1128 config KERNEL_WEXT_SPY
1129         def_bool KERNEL_WIRELESS_EXT
1130
1131 config KERNEL_PAGE_POOL
1132         def_bool n
1133
1134 config KERNEL_PAGE_POOL_STATS
1135         bool "Page pool stats support"
1136         depends on KERNEL_PAGE_POOL
1137
1138 #
1139 # NFS related symbols
1140 #
1141 config KERNEL_IP_PNP
1142         bool "Compile the kernel with rootfs on NFS"
1143         help
1144            If you want to make your kernel boot off a NFS server as root
1145            filesystem, select Y here.
1146
1147 if KERNEL_IP_PNP
1148
1149         config KERNEL_IP_PNP_DHCP
1150                 def_bool y
1151
1152         config KERNEL_IP_PNP_BOOTP
1153                 def_bool n
1154
1155         config KERNEL_IP_PNP_RARP
1156                 def_bool n
1157
1158         config KERNEL_NFS_FS
1159                 def_bool y
1160
1161         config KERNEL_NFS_V2
1162                 def_bool y
1163
1164         config KERNEL_NFS_V3
1165                 def_bool y
1166
1167         config KERNEL_ROOT_NFS
1168                 def_bool y
1169
1170 endif
1171
1172 menu "Filesystem ACL and attr support options"
1173         config USE_FS_ACL_ATTR
1174                 bool "Use filesystem ACL and attr support by default"
1175                 help
1176                   Make using ACLs (e.g. POSIX ACL, NFSv4 ACL) the default
1177                   for kernel and packages, except tmpfs, flash filesystems,
1178                   and old NFS.  Also enable userspace extended attribute support
1179                   by default.  (OpenWrt already has an expection it will be
1180                   present in the kernel).
1181
1182         config KERNEL_FS_POSIX_ACL
1183                 bool "Enable POSIX ACL support"
1184                 default y if USE_FS_ACL_ATTR
1185
1186         config KERNEL_BTRFS_FS_POSIX_ACL
1187                 bool "Enable POSIX ACL for BtrFS Filesystems"
1188                 select KERNEL_FS_POSIX_ACL
1189                 default y if USE_FS_ACL_ATTR
1190
1191         config KERNEL_EXT4_FS_POSIX_ACL
1192                 bool "Enable POSIX ACL for Ext4 Filesystems"
1193                 select KERNEL_FS_POSIX_ACL
1194                 default y if USE_FS_ACL_ATTR
1195
1196         config KERNEL_F2FS_FS_POSIX_ACL
1197                 bool "Enable POSIX ACL for F2FS Filesystems"
1198                 select KERNEL_FS_POSIX_ACL
1199
1200         config KERNEL_JFFS2_FS_POSIX_ACL
1201                 bool "Enable POSIX ACL for JFFS2 Filesystems"
1202                 select KERNEL_FS_POSIX_ACL
1203
1204         config KERNEL_TMPFS_POSIX_ACL
1205                 bool "Enable POSIX ACL for TMPFS Filesystems"
1206                 select KERNEL_FS_POSIX_ACL
1207
1208         config KERNEL_CIFS_ACL
1209                 bool "Enable CIFS ACLs"
1210                 select KERNEL_FS_POSIX_ACL
1211                 default y if USE_FS_ACL_ATTR
1212
1213         config KERNEL_HFS_FS_POSIX_ACL
1214                 bool "Enable POSIX ACL for HFS Filesystems"
1215                 select KERNEL_FS_POSIX_ACL
1216                 default y if USE_FS_ACL_ATTR
1217
1218         config KERNEL_HFSPLUS_FS_POSIX_ACL
1219                 bool "Enable POSIX ACL for HFS+ Filesystems"
1220                 select KERNEL_FS_POSIX_ACL
1221                 default y if USE_FS_ACL_ATTR
1222
1223         config KERNEL_NFS_ACL_SUPPORT
1224                 bool "Enable ACLs for NFS"
1225                 default y if USE_FS_ACL_ATTR
1226
1227         config KERNEL_NFS_V3_ACL_SUPPORT
1228                 bool "Enable ACLs for NFSv3"
1229
1230         config KERNEL_NFSD_V2_ACL_SUPPORT
1231                 bool "Enable ACLs for NFSDv2"
1232
1233         config KERNEL_NFSD_V3_ACL_SUPPORT
1234                 bool "Enable ACLs for NFSDv3"
1235
1236         config KERNEL_REISER_FS_POSIX_ACL
1237                 bool "Enable POSIX ACLs for ReiserFS"
1238                 select KERNEL_FS_POSIX_ACL
1239                 default y if USE_FS_ACL_ATTR
1240
1241         config KERNEL_XFS_POSIX_ACL
1242                 bool "Enable POSIX ACLs for XFS"
1243                 select KERNEL_FS_POSIX_ACL
1244                 default y if USE_FS_ACL_ATTR
1245
1246         config KERNEL_JFS_POSIX_ACL
1247                 bool "Enable POSIX ACLs for JFS"
1248                 select KERNEL_FS_POSIX_ACL
1249                 default y if USE_FS_ACL_ATTR
1250
1251 endmenu
1252
1253 config KERNEL_DEVMEM
1254         bool "/dev/mem virtual device support"
1255         help
1256           Say Y here if you want to support the /dev/mem device.
1257           The /dev/mem device is used to access areas of physical
1258           memory.
1259
1260 config KERNEL_DEVKMEM
1261         bool "/dev/kmem virtual device support"
1262         help
1263           Say Y here if you want to support the /dev/kmem device. The
1264           /dev/kmem device is rarely used, but can be used for certain
1265           kind of kernel debugging operations.
1266
1267 config KERNEL_SQUASHFS_FRAGMENT_CACHE_SIZE
1268         int "Number of squashfs fragments cached"
1269         default 2 if (SMALL_FLASH && !LOW_MEMORY_FOOTPRINT)
1270         default 3
1271
1272 config KERNEL_SQUASHFS_XATTR
1273         bool "Squashfs XATTR support"
1274
1275 #
1276 # compile optimization setting
1277 #
1278 choice
1279         prompt "Compiler optimization level"
1280         default KERNEL_CC_OPTIMIZE_FOR_SIZE if SMALL_FLASH
1281
1282 config KERNEL_CC_OPTIMIZE_FOR_PERFORMANCE
1283         bool "Optimize for performance"
1284         help
1285           This is the default optimization level for the kernel, building
1286           with the "-O2" compiler flag for best performance and most
1287           helpful compile-time warnings.
1288
1289 config KERNEL_CC_OPTIMIZE_FOR_SIZE
1290         bool "Optimize for size"
1291         help
1292           Enabling this option will pass "-Os" instead of "-O2" to
1293           your compiler resulting in a smaller kernel.
1294
1295 endchoice
1296
1297 config KERNEL_AUDIT
1298         bool "Auditing support"
1299
1300 config KERNEL_SECURITY
1301         bool "Enable different security models"
1302
1303 config KERNEL_SECURITY_NETWORK
1304         bool "Socket and Networking Security Hooks"
1305         select KERNEL_SECURITY
1306
1307 config KERNEL_SECURITY_SELINUX
1308         bool "NSA SELinux Support"
1309         select KERNEL_SECURITY_NETWORK
1310         select KERNEL_AUDIT
1311
1312 config KERNEL_SECURITY_SELINUX_BOOTPARAM
1313         bool "NSA SELinux boot parameter"
1314         depends on KERNEL_SECURITY_SELINUX
1315         default y
1316
1317 config KERNEL_SECURITY_SELINUX_DISABLE
1318         bool "NSA SELinux runtime disable"
1319         depends on KERNEL_SECURITY_SELINUX
1320
1321 config KERNEL_SECURITY_SELINUX_DEVELOP
1322         bool "NSA SELinux Development Support"
1323         depends on KERNEL_SECURITY_SELINUX
1324         default y
1325
1326 config KERNEL_SECURITY_SELINUX_SIDTAB_HASH_BITS
1327         int
1328         depends on KERNEL_SECURITY_SELINUX
1329         default 9
1330
1331 config KERNEL_SECURITY_SELINUX_SID2STR_CACHE_SIZE
1332         int
1333         depends on KERNEL_SECURITY_SELINUX
1334         default 256
1335
1336 config KERNEL_LSM
1337         string
1338         default "lockdown,yama,loadpin,safesetid,integrity,selinux"
1339         depends on KERNEL_SECURITY_SELINUX
1340
1341 config KERNEL_EXT4_FS_SECURITY
1342         bool "Ext4 Security Labels"
1343
1344 config KERNEL_F2FS_FS_SECURITY
1345         bool "F2FS Security Labels"
1346
1347 config KERNEL_UBIFS_FS_SECURITY
1348         bool "UBIFS Security Labels"
1349
1350 config KERNEL_JFFS2_FS_SECURITY
1351         bool "JFFS2 Security Labels"
1352
1353 config KERNEL_WERROR
1354         bool "Compile the kernel with warnings as errors"
1355         default BUILDBOT
1356         default y if GCC_USE_VERSION_12
1357         help
1358           A kernel build should not cause any compiler warnings, and this
1359           enables the '-Werror' (for C) and '-Dwarnings' (for Rust) flags
1360           to enforce that rule by default. Certain warnings from other tools
1361           such as the linker may be upgraded to errors with this option as
1362           well.
1363
1364           However, if you have a new (or very old) compiler or linker with odd
1365           and unusual warnings, or you have some architecture with problems,
1366           you may need to disable this config option in order to
1367           successfully build the kernel.