5 default "/lib/modules/$(shell,uname -r)/.config"
6 default "/etc/kernel-config"
7 default "/boot/config-$(shell,uname -r)"
9 default "arch/$(ARCH)/defconfig"
12 def_bool $(success,$(CC) --version | head -n 1 | grep -q gcc)
16 default $(shell,$(srctree)/scripts/gcc-version.sh -p $(CC) | sed 's/^0*//') if CC_IS_GCC
20 def_bool $(success,$(CC) --version | head -n 1 | grep -q clang)
24 default $(shell,$(srctree)/scripts/clang-version.sh $(CC))
26 config CC_HAS_ASM_GOTO
27 def_bool $(success,$(srctree)/scripts/gcc-goto.sh $(CC))
29 config CC_HAS_WARN_MAYBE_UNINITIALIZED
30 def_bool $(cc-option,-Wmaybe-uninitialized)
32 GCC >= 4.7 supports this option.
34 config CC_DISABLE_WARN_MAYBE_UNINITIALIZED
36 depends on CC_HAS_WARN_MAYBE_UNINITIALIZED
37 default CC_IS_GCC && GCC_VERSION < 40900 # unreliable for GCC < 4.9
39 GCC's -Wmaybe-uninitialized is not reliable by definition.
40 Lots of false positive warnings are produced in some cases.
42 If this option is enabled, -Wno-maybe-uninitialzed is passed
43 to the compiler to suppress maybe-uninitialized warnings.
52 config BUILDTIME_EXTABLE_SORT
55 config THREAD_INFO_IN_TASK
58 Select this to move thread_info off the stack into task_struct. To
59 make this work, an arch will need to remove all thread_info fields
60 except flags and fix any runtime bugs.
62 One subtle change that will be needed is to use try_get_task_stack()
63 and put_task_stack() in save_thread_stack_tsk() and get_wchan().
72 depends on BROKEN || !SMP
75 config INIT_ENV_ARG_LIMIT
80 Maximum of each of the number of arguments and environment
81 variables passed to init from the kernel command line.
84 bool "Compile also drivers which will not load"
88 Some drivers can be compiled on a different platform than they are
89 intended to be run on. Despite they cannot be loaded there (or even
90 when they load they cannot be used due to missing HW support),
91 developers still, opposing to distributors, might want to build such
92 drivers to compile-test them.
94 If you are a developer and want to build everything available, say Y
95 here. If you are a user/distributor, say N here to exclude useless
96 drivers to be distributed.
99 string "Local version - append to kernel release"
101 Append an extra string to the end of your kernel version.
102 This will show up when you type uname, for example.
103 The string you set here will be appended after the contents of
104 any files with a filename matching localversion* in your
105 object and source tree, in that order. Your total string can
106 be a maximum of 64 characters.
108 config LOCALVERSION_AUTO
109 bool "Automatically append version information to the version string"
111 depends on !COMPILE_TEST
113 This will try to automatically determine if the current tree is a
114 release tree by looking for git tags that belong to the current
115 top of tree revision.
117 A string of the format -gxxxxxxxx will be added to the localversion
118 if a git-based tree is found. The string generated by this will be
119 appended after any matching localversion* files, and after the value
120 set in CONFIG_LOCALVERSION.
122 (The actual string used here is the first eight characters produced
123 by running the command:
125 $ git rev-parse --verify HEAD
127 which is done within the script "scripts/setlocalversion".)
130 string "Build ID Salt"
133 The build ID is used to link binaries and their debug info. Setting
134 this option will use the value in the calculation of the build id.
135 This is mostly useful for distributions which want to ensure the
136 build is unique between builds. It's safe to leave the default.
138 config HAVE_KERNEL_GZIP
141 config HAVE_KERNEL_BZIP2
144 config HAVE_KERNEL_LZMA
147 config HAVE_KERNEL_XZ
150 config HAVE_KERNEL_LZO
153 config HAVE_KERNEL_LZ4
156 config HAVE_KERNEL_UNCOMPRESSED
160 prompt "Kernel compression mode"
162 depends on HAVE_KERNEL_GZIP || HAVE_KERNEL_BZIP2 || HAVE_KERNEL_LZMA || HAVE_KERNEL_XZ || HAVE_KERNEL_LZO || HAVE_KERNEL_LZ4 || HAVE_KERNEL_UNCOMPRESSED
164 The linux kernel is a kind of self-extracting executable.
165 Several compression algorithms are available, which differ
166 in efficiency, compression and decompression speed.
167 Compression speed is only relevant when building a kernel.
168 Decompression speed is relevant at each boot.
170 If you have any problems with bzip2 or lzma compressed
171 kernels, mail me (Alain Knaff) <alain@knaff.lu>. (An older
172 version of this functionality (bzip2 only), for 2.4, was
173 supplied by Christian Ludwig)
175 High compression options are mostly useful for users, who
176 are low on disk space (embedded systems), but for whom ram
179 If in doubt, select 'gzip'
183 depends on HAVE_KERNEL_GZIP
185 The old and tried gzip compression. It provides a good balance
186 between compression ratio and decompression speed.
190 depends on HAVE_KERNEL_BZIP2
192 Its compression ratio and speed is intermediate.
193 Decompression speed is slowest among the choices. The kernel
194 size is about 10% smaller with bzip2, in comparison to gzip.
195 Bzip2 uses a large amount of memory. For modern kernels you
196 will need at least 8MB RAM or more for booting.
200 depends on HAVE_KERNEL_LZMA
202 This compression algorithm's ratio is best. Decompression speed
203 is between gzip and bzip2. Compression is slowest.
204 The kernel size is about 33% smaller with LZMA in comparison to gzip.
208 depends on HAVE_KERNEL_XZ
210 XZ uses the LZMA2 algorithm and instruction set specific
211 BCJ filters which can improve compression ratio of executable
212 code. The size of the kernel is about 30% smaller with XZ in
213 comparison to gzip. On architectures for which there is a BCJ
214 filter (i386, x86_64, ARM, IA-64, PowerPC, and SPARC), XZ
215 will create a few percent smaller kernel than plain LZMA.
217 The speed is about the same as with LZMA: The decompression
218 speed of XZ is better than that of bzip2 but worse than gzip
219 and LZO. Compression is slow.
223 depends on HAVE_KERNEL_LZO
225 Its compression ratio is the poorest among the choices. The kernel
226 size is about 10% bigger than gzip; however its speed
227 (both compression and decompression) is the fastest.
231 depends on HAVE_KERNEL_LZ4
233 LZ4 is an LZ77-type compressor with a fixed, byte-oriented encoding.
234 A preliminary version of LZ4 de/compression tool is available at
235 <https://code.google.com/p/lz4/>.
237 Its compression ratio is worse than LZO. The size of the kernel
238 is about 8% bigger than LZO. But the decompression speed is
241 config KERNEL_UNCOMPRESSED
243 depends on HAVE_KERNEL_UNCOMPRESSED
245 Produce uncompressed kernel image. This option is usually not what
246 you want. It is useful for debugging the kernel in slow simulation
247 environments, where decompressing and moving the kernel is awfully
248 slow. This option allows early boot code to skip the decompressor
249 and jump right at uncompressed kernel image.
253 config DEFAULT_HOSTNAME
254 string "Default hostname"
257 This option determines the default system hostname before userspace
258 calls sethostname(2). The kernel traditionally uses "(none)" here,
259 but you may wish to use a different default here to make a minimal
260 system more usable with less configuration.
263 # For some reason microblaze and nios2 hard code SWAP=n. Hopefully we can
264 # add proper SWAP support to them, in which case this can be remove.
270 bool "Support for paging of anonymous memory (swap)"
271 depends on MMU && BLOCK && !ARCH_NO_SWAP
274 This option allows you to choose whether you want to have support
275 for so called swap devices or swap files in your kernel that are
276 used to provide more virtual memory than the actual RAM present
277 in your computer. If unsure say Y.
282 Inter Process Communication is a suite of library functions and
283 system calls which let processes (running programs) synchronize and
284 exchange information. It is generally considered to be a good thing,
285 and some programs won't run unless you say Y here. In particular, if
286 you want to run the DOS emulator dosemu under Linux (read the
287 DOSEMU-HOWTO, available from <http://www.tldp.org/docs.html#howto>),
288 you'll need to say Y here.
290 You can find documentation about IPC with "info ipc" and also in
291 section 6.4 of the Linux Programmer's Guide, available from
292 <http://www.tldp.org/guides.html>.
294 config SYSVIPC_SYSCTL
301 bool "POSIX Message Queues"
304 POSIX variant of message queues is a part of IPC. In POSIX message
305 queues every message has a priority which decides about succession
306 of receiving it by a process. If you want to compile and run
307 programs written e.g. for Solaris with use of its POSIX message
308 queues (functions mq_*) say Y here.
310 POSIX message queues are visible as a filesystem called 'mqueue'
311 and can be mounted somewhere if you want to do filesystem
312 operations on message queues.
316 config POSIX_MQUEUE_SYSCTL
318 depends on POSIX_MQUEUE
322 config CROSS_MEMORY_ATTACH
323 bool "Enable process_vm_readv/writev syscalls"
327 Enabling this option adds the system calls process_vm_readv and
328 process_vm_writev which allow a process with the correct privileges
329 to directly read from or write to another process' address space.
330 See the man page for more details.
333 bool "uselib syscall"
334 def_bool ALPHA || M68K || SPARC || X86_32 || IA32_EMULATION
336 This option enables the uselib syscall, a system call used in the
337 dynamic linker from libc5 and earlier. glibc does not use this
338 system call. If you intend to run programs built on libc5 or
339 earlier, you may need to enable this syscall. Current systems
340 running glibc can safely disable this.
343 bool "Auditing support"
346 Enable auditing infrastructure that can be used with another
347 kernel subsystem, such as SELinux (which requires this for
348 logging of avc messages output). System call auditing is included
349 on architectures which support it.
351 config HAVE_ARCH_AUDITSYSCALL
356 depends on AUDIT && HAVE_ARCH_AUDITSYSCALL
359 source "kernel/irq/Kconfig"
360 source "kernel/time/Kconfig"
361 source "kernel/Kconfig.preempt"
363 menu "CPU/Task time and stats accounting"
365 config VIRT_CPU_ACCOUNTING
369 prompt "Cputime accounting"
370 default TICK_CPU_ACCOUNTING if !PPC64
371 default VIRT_CPU_ACCOUNTING_NATIVE if PPC64
373 # Kind of a stub config for the pure tick based cputime accounting
374 config TICK_CPU_ACCOUNTING
375 bool "Simple tick based cputime accounting"
376 depends on !S390 && !NO_HZ_FULL
378 This is the basic tick based cputime accounting that maintains
379 statistics about user, system and idle time spent on per jiffies
384 config VIRT_CPU_ACCOUNTING_NATIVE
385 bool "Deterministic task and CPU time accounting"
386 depends on HAVE_VIRT_CPU_ACCOUNTING && !NO_HZ_FULL
387 select VIRT_CPU_ACCOUNTING
389 Select this option to enable more accurate task and CPU time
390 accounting. This is done by reading a CPU counter on each
391 kernel entry and exit and on transitions within the kernel
392 between system, softirq and hardirq state, so there is a
393 small performance impact. In the case of s390 or IBM POWER > 5,
394 this also enables accounting of stolen time on logically-partitioned
397 config VIRT_CPU_ACCOUNTING_GEN
398 bool "Full dynticks CPU time accounting"
399 depends on HAVE_CONTEXT_TRACKING
400 depends on HAVE_VIRT_CPU_ACCOUNTING_GEN
401 select VIRT_CPU_ACCOUNTING
402 select CONTEXT_TRACKING
404 Select this option to enable task and CPU time accounting on full
405 dynticks systems. This accounting is implemented by watching every
406 kernel-user boundaries using the context tracking subsystem.
407 The accounting is thus performed at the expense of some significant
410 For now this is only useful if you are working on the full
411 dynticks subsystem development.
417 config IRQ_TIME_ACCOUNTING
418 bool "Fine granularity task level IRQ time accounting"
419 depends on HAVE_IRQ_TIME_ACCOUNTING && !VIRT_CPU_ACCOUNTING_NATIVE
421 Select this option to enable fine granularity task irq time
422 accounting. This is done by reading a timestamp on each
423 transitions between softirq and hardirq state, so there can be a
424 small performance impact.
426 If in doubt, say N here.
428 config HAVE_SCHED_AVG_IRQ
430 depends on IRQ_TIME_ACCOUNTING || PARAVIRT_TIME_ACCOUNTING
433 config BSD_PROCESS_ACCT
434 bool "BSD Process Accounting"
437 If you say Y here, a user level program will be able to instruct the
438 kernel (via a special system call) to write process accounting
439 information to a file: whenever a process exits, information about
440 that process will be appended to the file by the kernel. The
441 information includes things such as creation time, owning user,
442 command name, memory usage, controlling terminal etc. (the complete
443 list is in the struct acct in <file:include/linux/acct.h>). It is
444 up to the user level program to do useful things with this
445 information. This is generally a good idea, so say Y.
447 config BSD_PROCESS_ACCT_V3
448 bool "BSD Process Accounting version 3 file format"
449 depends on BSD_PROCESS_ACCT
452 If you say Y here, the process accounting information is written
453 in a new file format that also logs the process IDs of each
454 process and its parent. Note that this file format is incompatible
455 with previous v0/v1/v2 file formats, so you will need updated tools
456 for processing it. A preliminary version of these tools is available
457 at <http://www.gnu.org/software/acct/>.
460 bool "Export task/process statistics through netlink"
465 Export selected statistics for tasks/processes through the
466 generic netlink interface. Unlike BSD process accounting, the
467 statistics are available during the lifetime of tasks/processes as
468 responses to commands. Like BSD accounting, they are sent to user
473 config TASK_DELAY_ACCT
474 bool "Enable per-task delay accounting"
478 Collect information on time spent by a task waiting for system
479 resources like cpu, synchronous block I/O completion and swapping
480 in pages. Such statistics can help in setting a task's priorities
481 relative to other tasks for cpu, io, rss limits etc.
486 bool "Enable extended accounting over taskstats"
489 Collect extended task accounting data and send the data
490 to userland for processing over the taskstats interface.
494 config TASK_IO_ACCOUNTING
495 bool "Enable per-task storage I/O accounting"
496 depends on TASK_XACCT
498 Collect information on the number of bytes of storage I/O which this
504 bool "Pressure stall information tracking"
506 Collect metrics that indicate how overcommitted the CPU, memory,
507 and IO capacity are in the system.
509 If you say Y here, the kernel will create /proc/pressure/ with the
510 pressure statistics files cpu, memory, and io. These will indicate
511 the share of walltime in which some or all tasks in the system are
512 delayed due to contention of the respective resource.
514 In kernels with cgroup support, cgroups (cgroup2 only) will
515 have cpu.pressure, memory.pressure, and io.pressure files,
516 which aggregate pressure stalls for the grouped tasks only.
518 For more details see Documentation/accounting/psi.txt.
522 config PSI_DEFAULT_DISABLED
523 bool "Require boot parameter to enable pressure stall information tracking"
527 If set, pressure stall information tracking will be disabled
528 per default but can be enabled through passing psi=1 on the
529 kernel commandline during boot.
531 endmenu # "CPU/Task time and stats accounting"
535 depends on SMP || COMPILE_TEST
538 Make sure that CPUs running critical tasks are not disturbed by
539 any source of "noise" such as unbound workqueues, timers, kthreads...
540 Unbound jobs get offloaded to housekeeping CPUs. This is driven by
541 the "isolcpus=" boot parameter.
545 source "kernel/rcu/Kconfig"
552 tristate "Kernel .config support"
555 This option enables the complete Linux kernel ".config" file
556 contents to be saved in the kernel. It provides documentation
557 of which kernel options are used in a running kernel or in an
558 on-disk kernel. This information can be extracted from the kernel
559 image file with the script scripts/extract-ikconfig and used as
560 input to rebuild the current kernel or to build another kernel.
561 It can also be extracted from a running kernel by reading
562 /proc/config.gz if enabled (below).
565 bool "Enable access to .config through /proc/config.gz"
566 depends on IKCONFIG && PROC_FS
568 This option enables access to the kernel configuration file
569 through /proc/config.gz.
572 int "Kernel log buffer size (16 => 64KB, 17 => 128KB)"
577 Select the minimal kernel log buffer size as a power of 2.
578 The final size is affected by LOG_CPU_MAX_BUF_SHIFT config
579 parameter, see below. Any higher size also might be forced
580 by "log_buf_len" boot parameter.
590 config LOG_CPU_MAX_BUF_SHIFT
591 int "CPU kernel log buffer size contribution (13 => 8 KB, 17 => 128KB)"
594 default 12 if !BASE_SMALL
595 default 0 if BASE_SMALL
598 This option allows to increase the default ring buffer size
599 according to the number of CPUs. The value defines the contribution
600 of each CPU as a power of 2. The used space is typically only few
601 lines however it might be much more when problems are reported,
604 The increased size means that a new buffer has to be allocated and
605 the original static one is unused. It makes sense only on systems
606 with more CPUs. Therefore this value is used only when the sum of
607 contributions is greater than the half of the default kernel ring
608 buffer as defined by LOG_BUF_SHIFT. The default values are set
609 so that more than 64 CPUs are needed to trigger the allocation.
611 Also this option is ignored when "log_buf_len" kernel parameter is
612 used as it forces an exact (power of two) size of the ring buffer.
614 The number of possible CPUs is used for this computation ignoring
615 hotplugging making the computation optimal for the worst case
616 scenario while allowing a simple algorithm to be used from bootup.
618 Examples shift values and their meaning:
619 17 => 128 KB for each CPU
620 16 => 64 KB for each CPU
621 15 => 32 KB for each CPU
622 14 => 16 KB for each CPU
623 13 => 8 KB for each CPU
624 12 => 4 KB for each CPU
626 config PRINTK_SAFE_LOG_BUF_SHIFT
627 int "Temporary per-CPU printk log buffer size (12 => 4KB, 13 => 8KB)"
632 Select the size of an alternate printk per-CPU buffer where messages
633 printed from usafe contexts are temporary stored. One example would
634 be NMI messages, another one - printk recursion. The messages are
635 copied to the main log buffer in a safe context to avoid a deadlock.
636 The value defines the size as a power of 2.
638 Those messages are rare and limited. The largest one is when
639 a backtrace is printed. It usually fits into 4KB. Select
640 8KB if you want to be on the safe side.
643 17 => 128 KB for each CPU
644 16 => 64 KB for each CPU
645 15 => 32 KB for each CPU
646 14 => 16 KB for each CPU
647 13 => 8 KB for each CPU
648 12 => 4 KB for each CPU
651 # Architectures with an unreliable sched_clock() should select this:
653 config HAVE_UNSTABLE_SCHED_CLOCK
656 config GENERIC_SCHED_CLOCK
660 # For architectures that want to enable the support for NUMA-affine scheduler
663 config ARCH_SUPPORTS_NUMA_BALANCING
667 # For architectures that prefer to flush all TLBs after a number of pages
668 # are unmapped instead of sending one IPI per page to flush. The architecture
669 # must provide guarantees on what happens if a clean TLB cache entry is
670 # written after the unmap. Details are in mm/rmap.c near the check for
671 # should_defer_flush. The architecture should also consider if the full flush
672 # and the refill costs are offset by the savings of sending fewer IPIs.
673 config ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
677 # For architectures that know their GCC __int128 support is sound
679 config ARCH_SUPPORTS_INT128
682 # For architectures that (ab)use NUMA to represent different memory regions
683 # all cpu-local but of different latencies, such as SuperH.
685 config ARCH_WANT_NUMA_VARIABLE_LOCALITY
688 config NUMA_BALANCING
689 bool "Memory placement aware NUMA scheduler"
690 depends on ARCH_SUPPORTS_NUMA_BALANCING
691 depends on !ARCH_WANT_NUMA_VARIABLE_LOCALITY
692 depends on SMP && NUMA && MIGRATION
694 This option adds support for automatic NUMA aware memory/task placement.
695 The mechanism is quite primitive and is based on migrating memory when
696 it has references to the node the task is running on.
698 This system will be inactive on UMA systems.
700 config NUMA_BALANCING_DEFAULT_ENABLED
701 bool "Automatically enable NUMA aware memory/task placement"
703 depends on NUMA_BALANCING
705 If set, automatic NUMA balancing will be enabled if running on a NUMA
709 bool "Control Group support"
712 This option adds support for grouping sets of processes together, for
713 use with process control subsystems such as Cpusets, CFS, memory
714 controls or device isolation.
716 - Documentation/scheduler/sched-design-CFS.txt (CFS)
717 - Documentation/cgroup-v1/ (features for grouping, isolation
718 and resource control)
728 bool "Memory controller"
732 Provides control over the memory footprint of tasks in a cgroup.
735 bool "Swap controller"
736 depends on MEMCG && SWAP
738 Provides control over the swap space consumed by tasks in a cgroup.
740 config MEMCG_SWAP_ENABLED
741 bool "Swap controller enabled by default"
742 depends on MEMCG_SWAP
745 Memory Resource Controller Swap Extension comes with its price in
746 a bigger memory consumption. General purpose distribution kernels
747 which want to enable the feature but keep it disabled by default
748 and let the user enable it by swapaccount=1 boot command line
749 parameter should have this option unselected.
750 For those who want to have the feature enabled by default should
751 select this option (if, for some reason, they need to disable it
752 then swapaccount=0 does the trick).
756 depends on MEMCG && !SLOB
764 Generic block IO controller cgroup interface. This is the common
765 cgroup interface which should be used by various IO controlling
768 Currently, CFQ IO scheduler uses it to recognize task groups and
769 control disk bandwidth allocation (proportional time slice allocation)
770 to such task groups. It is also used by bio throttling logic in
771 block layer to implement upper limit in IO rates on a device.
773 This option only enables generic Block IO controller infrastructure.
774 One needs to also enable actual IO controlling logic/policy. For
775 enabling proportional weight division of disk bandwidth in CFQ, set
776 CONFIG_CFQ_GROUP_IOSCHED=y; for enabling throttling policy, set
777 CONFIG_BLK_DEV_THROTTLING=y.
779 See Documentation/cgroup-v1/blkio-controller.txt for more information.
781 config DEBUG_BLK_CGROUP
782 bool "IO controller debugging"
783 depends on BLK_CGROUP
786 Enable some debugging help. Currently it exports additional stat
787 files in a cgroup which can be useful for debugging.
789 config CGROUP_WRITEBACK
791 depends on MEMCG && BLK_CGROUP
794 menuconfig CGROUP_SCHED
795 bool "CPU controller"
798 This feature lets CPU scheduler recognize task groups and control CPU
799 bandwidth allocation to such task groups. It uses cgroups to group
803 config FAIR_GROUP_SCHED
804 bool "Group scheduling for SCHED_OTHER"
805 depends on CGROUP_SCHED
809 bool "CPU bandwidth provisioning for FAIR_GROUP_SCHED"
810 depends on FAIR_GROUP_SCHED
813 This option allows users to define CPU bandwidth rates (limits) for
814 tasks running within the fair group scheduler. Groups with no limit
815 set are considered to be unconstrained and will run with no
817 See Documentation/scheduler/sched-bwc.txt for more information.
819 config RT_GROUP_SCHED
820 bool "Group scheduling for SCHED_RR/FIFO"
821 depends on CGROUP_SCHED
824 This feature lets you explicitly allocate real CPU bandwidth
825 to task groups. If enabled, it will also make it impossible to
826 schedule realtime tasks for non-root users until you allocate
827 realtime bandwidth for them.
828 See Documentation/scheduler/sched-rt-group.txt for more information.
833 bool "PIDs controller"
835 Provides enforcement of process number limits in the scope of a
836 cgroup. Any attempt to fork more processes than is allowed in the
837 cgroup will fail. PIDs are fundamentally a global resource because it
838 is fairly trivial to reach PID exhaustion before you reach even a
839 conservative kmemcg limit. As a result, it is possible to grind a
840 system to halt without being limited by other cgroup policies. The
841 PIDs controller is designed to stop this from happening.
843 It should be noted that organisational operations (such as attaching
844 to a cgroup hierarchy will *not* be blocked by the PIDs controller),
845 since the PIDs limit only affects a process's ability to fork, not to
849 bool "RDMA controller"
851 Provides enforcement of RDMA resources defined by IB stack.
852 It is fairly easy for consumers to exhaust RDMA resources, which
853 can result into resource unavailability to other consumers.
854 RDMA controller is designed to stop this from happening.
855 Attaching processes with active RDMA resources to the cgroup
856 hierarchy is allowed even if can cross the hierarchy's limit.
858 config CGROUP_FREEZER
859 bool "Freezer controller"
861 Provides a way to freeze and unfreeze all tasks in a
864 This option affects the ORIGINAL cgroup interface. The cgroup2 memory
865 controller includes important in-kernel memory consumers per default.
867 If you're using cgroup2, say N.
869 config CGROUP_HUGETLB
870 bool "HugeTLB controller"
871 depends on HUGETLB_PAGE
875 Provides a cgroup controller for HugeTLB pages.
876 When you enable this, you can put a per cgroup limit on HugeTLB usage.
877 The limit is enforced during page fault. Since HugeTLB doesn't
878 support page reclaim, enforcing the limit at page fault time implies
879 that, the application will get SIGBUS signal if it tries to access
880 HugeTLB pages beyond its limit. This requires the application to know
881 beforehand how much HugeTLB pages it would require for its use. The
882 control group is tracked in the third page lru pointer. This means
883 that we cannot use the controller with huge page less than 3 pages.
886 bool "Cpuset controller"
889 This option will let you create and manage CPUSETs which
890 allow dynamically partitioning a system into sets of CPUs and
891 Memory Nodes and assigning tasks to run only within those sets.
892 This is primarily useful on large SMP or NUMA systems.
896 config PROC_PID_CPUSET
897 bool "Include legacy /proc/<pid>/cpuset file"
902 bool "Device controller"
904 Provides a cgroup controller implementing whitelists for
905 devices which a process in the cgroup can mknod or open.
907 config CGROUP_CPUACCT
908 bool "Simple CPU accounting controller"
910 Provides a simple controller for monitoring the
911 total CPU consumed by the tasks in a cgroup.
914 bool "Perf controller"
915 depends on PERF_EVENTS
917 This option extends the perf per-cpu mode to restrict monitoring
918 to threads which belong to the cgroup specified and run on the
924 bool "Support for eBPF programs attached to cgroups"
925 depends on BPF_SYSCALL
926 select SOCK_CGROUP_DATA
928 Allow attaching eBPF programs to a cgroup using the bpf(2)
929 syscall command BPF_PROG_ATTACH.
931 In which context these programs are accessed depends on the type
932 of attachment. For instance, programs that are attached using
933 BPF_CGROUP_INET_INGRESS will be executed on the ingress path of
937 bool "Debug controller"
939 depends on DEBUG_KERNEL
941 This option enables a simple controller that exports
942 debugging information about the cgroups framework. This
943 controller is for control cgroup debugging only. Its
944 interfaces are not stable.
948 config SOCK_CGROUP_DATA
954 menuconfig NAMESPACES
955 bool "Namespaces support" if EXPERT
959 Provides the way to make tasks work with different objects using
960 the same id. For example same IPC id may refer to different objects
961 or same user id or pid may refer to different tasks when used in
962 different namespaces.
970 In this namespace tasks see different info provided with the
975 depends on (SYSVIPC || POSIX_MQUEUE)
978 In this namespace tasks work with IPC ids which correspond to
979 different IPC objects in different namespaces.
982 bool "User namespace"
985 This allows containers, i.e. vservers, to use user namespaces
986 to provide different user info for different servers.
988 When user namespaces are enabled in the kernel it is
989 recommended that the MEMCG option also be enabled and that
990 user-space use the memory control groups to limit the amount
991 of memory a memory unprivileged users can use.
996 bool "PID Namespaces"
999 Support process id namespaces. This allows having multiple
1000 processes with the same pid as long as they are in different
1001 pid namespaces. This is a building block of containers.
1004 bool "Network namespace"
1008 Allow user space to create what appear to be multiple instances
1009 of the network stack.
1013 config CHECKPOINT_RESTORE
1014 bool "Checkpoint/restore support"
1015 select PROC_CHILDREN
1018 Enables additional kernel features in a sake of checkpoint/restore.
1019 In particular it adds auxiliary prctl codes to setup process text,
1020 data and heap segment sizes, and a few additional /proc filesystem
1023 If unsure, say N here.
1025 config SCHED_AUTOGROUP
1026 bool "Automatic process group scheduling"
1029 select FAIR_GROUP_SCHED
1031 This option optimizes the scheduler for common desktop workloads by
1032 automatically creating and populating task groups. This separation
1033 of workloads isolates aggressive CPU burners (like build jobs) from
1034 desktop applications. Task group autogeneration is currently based
1037 config SYSFS_DEPRECATED
1038 bool "Enable deprecated sysfs features to support old userspace tools"
1042 This option adds code that switches the layout of the "block" class
1043 devices, to not show up in /sys/class/block/, but only in
1046 This switch is only active when the sysfs.deprecated=1 boot option is
1047 passed or the SYSFS_DEPRECATED_V2 option is set.
1049 This option allows new kernels to run on old distributions and tools,
1050 which might get confused by /sys/class/block/. Since 2007/2008 all
1051 major distributions and tools handle this just fine.
1053 Recent distributions and userspace tools after 2009/2010 depend on
1054 the existence of /sys/class/block/, and will not work with this
1057 Only if you are using a new kernel on an old distribution, you might
1060 config SYSFS_DEPRECATED_V2
1061 bool "Enable deprecated sysfs features by default"
1064 depends on SYSFS_DEPRECATED
1066 Enable deprecated sysfs by default.
1068 See the CONFIG_SYSFS_DEPRECATED option for more details about this
1071 Only if you are using a new kernel on an old distribution, you might
1072 need to say Y here. Even then, odds are you would not need it
1073 enabled, you can always pass the boot option if absolutely necessary.
1076 bool "Kernel->user space relay support (formerly relayfs)"
1079 This option enables support for relay interface support in
1080 certain file systems (such as debugfs).
1081 It is designed to provide an efficient mechanism for tools and
1082 facilities to relay large amounts of data from kernel space to
1087 config BLK_DEV_INITRD
1088 bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
1090 The initial RAM filesystem is a ramfs which is loaded by the
1091 boot loader (loadlin or lilo) and that is mounted as root
1092 before the normal boot procedure. It is typically used to
1093 load modules needed to mount the "real" root file system,
1094 etc. See <file:Documentation/admin-guide/initrd.rst> for details.
1096 If RAM disk support (BLK_DEV_RAM) is also included, this
1097 also enables initial RAM disk (initrd) support and adds
1098 15 Kbytes (more on some other architectures) to the kernel size.
1104 source "usr/Kconfig"
1109 prompt "Compiler optimization level"
1110 default CC_OPTIMIZE_FOR_PERFORMANCE
1112 config CC_OPTIMIZE_FOR_PERFORMANCE
1113 bool "Optimize for performance"
1115 This is the default optimization level for the kernel, building
1116 with the "-O2" compiler flag for best performance and most
1117 helpful compile-time warnings.
1119 config CC_OPTIMIZE_FOR_SIZE
1120 bool "Optimize for size"
1121 imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives
1123 Enabling this option will pass "-Os" instead of "-O2" to
1124 your compiler resulting in a smaller kernel.
1130 config HAVE_LD_DEAD_CODE_DATA_ELIMINATION
1133 This requires that the arch annotates or otherwise protects
1134 its external entry points from being discarded. Linker scripts
1135 must also merge .text.*, .data.*, and .bss.* correctly into
1136 output sections. Care must be taken not to pull in unrelated
1137 sections (e.g., '.text.init'). Typically '.' in section names
1138 is used to distinguish them from label names / C identifiers.
1140 config LD_DEAD_CODE_DATA_ELIMINATION
1141 bool "Dead code and data elimination (EXPERIMENTAL)"
1142 depends on HAVE_LD_DEAD_CODE_DATA_ELIMINATION
1144 depends on !(FUNCTION_TRACER && CC_IS_GCC && GCC_VERSION < 40800)
1145 depends on $(cc-option,-ffunction-sections -fdata-sections)
1146 depends on $(ld-option,--gc-sections)
1148 Enable this if you want to do dead code and data elimination with
1149 the linker by compiling with -ffunction-sections -fdata-sections,
1150 and linking with --gc-sections.
1152 This can reduce on disk and in-memory size of the kernel
1153 code and static data, particularly for small configs and
1154 on small systems. This has the possibility of introducing
1155 silently broken kernel if the required annotations are not
1156 present. This option is not well tested yet, so use at your
1168 config SYSCTL_EXCEPTION_TRACE
1171 Enable support for /proc/sys/debug/exception-trace.
1173 config SYSCTL_ARCH_UNALIGN_NO_WARN
1176 Enable support for /proc/sys/kernel/ignore-unaligned-usertrap
1177 Allows arch to define/use @no_unaligned_warning to possibly warn
1178 about unaligned access emulation going on under the hood.
1180 config SYSCTL_ARCH_UNALIGN_ALLOW
1183 Enable support for /proc/sys/kernel/unaligned-trap
1184 Allows arches to define/use @unaligned_enabled to runtime toggle
1185 the unaligned access emulation.
1186 see arch/parisc/kernel/unaligned.c for reference
1188 config HAVE_PCSPKR_PLATFORM
1191 # interpreter that classic socket filters depend on
1196 bool "Configure standard kernel features (expert users)"
1197 # Unhide debug options, to make the on-by-default options visible
1200 This option allows certain base kernel options and settings
1201 to be disabled or tweaked. This is for specialized
1202 environments which can tolerate a "non-standard" kernel.
1203 Only use this if you really know what you are doing.
1206 bool "Enable 16-bit UID system calls" if EXPERT
1207 depends on HAVE_UID16 && MULTIUSER
1210 This enables the legacy 16-bit UID syscall wrappers.
1213 bool "Multiple users, groups and capabilities support" if EXPERT
1216 This option enables support for non-root users, groups and
1219 If you say N here, all processes will run with UID 0, GID 0, and all
1220 possible capabilities. Saying N here also compiles out support for
1221 system calls related to UIDs, GIDs, and capabilities, such as setuid,
1224 If unsure, say Y here.
1226 config SGETMASK_SYSCALL
1227 bool "sgetmask/ssetmask syscalls support" if EXPERT
1228 def_bool PARISC || M68K || PPC || MIPS || X86 || SPARC || MICROBLAZE || SUPERH
1230 sys_sgetmask and sys_ssetmask are obsolete system calls
1231 no longer supported in libc but still enabled by default in some
1234 If unsure, leave the default option here.
1236 config SYSFS_SYSCALL
1237 bool "Sysfs syscall support" if EXPERT
1240 sys_sysfs is an obsolete system call no longer supported in libc.
1241 Note that disabling this option is more secure but might break
1242 compatibility with some systems.
1244 If unsure say Y here.
1246 config SYSCTL_SYSCALL
1247 bool "Sysctl syscall support" if EXPERT
1248 depends on PROC_SYSCTL
1252 sys_sysctl uses binary paths that have been found challenging
1253 to properly maintain and use. The interface in /proc/sys
1254 using paths with ascii names is now the primary path to this
1257 Almost nothing using the binary sysctl interface so if you are
1258 trying to save some space it is probably safe to disable this,
1259 making your kernel marginally smaller.
1261 If unsure say N here.
1264 bool "open by fhandle syscalls" if EXPERT
1268 If you say Y here, a user level program will be able to map
1269 file names to handle and then later use the handle for
1270 different file system operations. This is useful in implementing
1271 userspace file servers, which now track files using handles instead
1272 of names. The handle would remain the same even if file names
1273 get renamed. Enables open_by_handle_at(2) and name_to_handle_at(2)
1277 bool "Posix Clocks & timers" if EXPERT
1280 This includes native support for POSIX timers to the kernel.
1281 Some embedded systems have no use for them and therefore they
1282 can be configured out to reduce the size of the kernel image.
1284 When this option is disabled, the following syscalls won't be
1285 available: timer_create, timer_gettime: timer_getoverrun,
1286 timer_settime, timer_delete, clock_adjtime, getitimer,
1287 setitimer, alarm. Furthermore, the clock_settime, clock_gettime,
1288 clock_getres and clock_nanosleep syscalls will be limited to
1289 CLOCK_REALTIME, CLOCK_MONOTONIC and CLOCK_BOOTTIME only.
1295 bool "Enable support for printk" if EXPERT
1298 This option enables normal printk support. Removing it
1299 eliminates most of the message strings from the kernel image
1300 and makes the kernel more or less silent. As this makes it
1301 very difficult to diagnose system problems, saying N here is
1302 strongly discouraged.
1310 bool "BUG() support" if EXPERT
1313 Disabling this option eliminates support for BUG and WARN, reducing
1314 the size of your kernel image and potentially quietly ignoring
1315 numerous fatal conditions. You should only consider disabling this
1316 option for embedded systems with no facilities for reporting errors.
1322 bool "Enable ELF core dumps" if EXPERT
1324 Enable support for generating core dumps. Disabling saves about 4k.
1327 config PCSPKR_PLATFORM
1328 bool "Enable PC-Speaker support" if EXPERT
1329 depends on HAVE_PCSPKR_PLATFORM
1333 This option allows to disable the internal PC-Speaker
1334 support, saving some memory.
1338 bool "Enable full-sized data structures for core" if EXPERT
1340 Disabling this option reduces the size of miscellaneous core
1341 kernel data structures. This saves memory on small machines,
1342 but may reduce performance.
1345 bool "Enable futex support" if EXPERT
1349 Disabling this option will cause the kernel to be built without
1350 support for "fast userspace mutexes". The resulting kernel may not
1351 run glibc-based applications correctly.
1355 depends on FUTEX && RT_MUTEXES
1358 config HAVE_FUTEX_CMPXCHG
1362 Architectures should select this if futex_atomic_cmpxchg_inatomic()
1363 is implemented and always working. This removes a couple of runtime
1367 bool "Enable eventpoll support" if EXPERT
1371 Disabling this option will cause the kernel to be built without
1372 support for epoll family of system calls.
1375 bool "Enable signalfd() system call" if EXPERT
1379 Enable the signalfd() system call that allows to receive signals
1380 on a file descriptor.
1385 bool "Enable timerfd() system call" if EXPERT
1389 Enable the timerfd() system call that allows to receive timer
1390 events on a file descriptor.
1395 bool "Enable eventfd() system call" if EXPERT
1399 Enable the eventfd() system call that allows to receive both
1400 kernel notification (ie. KAIO) or userspace notifications.
1405 bool "Use full shmem filesystem" if EXPERT
1409 The shmem is an internal filesystem used to manage shared memory.
1410 It is backed by swap and manages resource limits. It is also exported
1411 to userspace as tmpfs if TMPFS is enabled. Disabling this
1412 option replaces shmem and tmpfs with the much simpler ramfs code,
1413 which may be appropriate on small systems without swap.
1416 bool "Enable AIO support" if EXPERT
1419 This option enables POSIX asynchronous I/O which may by used
1420 by some high performance threaded applications. Disabling
1421 this option saves about 7k.
1423 config ADVISE_SYSCALLS
1424 bool "Enable madvise/fadvise syscalls" if EXPERT
1427 This option enables the madvise and fadvise syscalls, used by
1428 applications to advise the kernel about their future memory or file
1429 usage, improving performance. If building an embedded system where no
1430 applications use these syscalls, you can disable this option to save
1434 bool "Enable membarrier() system call" if EXPERT
1437 Enable the membarrier() system call that allows issuing memory
1438 barriers across all running threads, which can be used to distribute
1439 the cost of user-space memory barriers asymmetrically by transforming
1440 pairs of memory barriers into pairs consisting of membarrier() and a
1446 bool "Load all symbols for debugging/ksymoops" if EXPERT
1449 Say Y here to let the kernel print out symbolic crash information and
1450 symbolic stack backtraces. This increases the size of the kernel
1451 somewhat, as all symbols have to be loaded into the kernel image.
1454 bool "Include all symbols in kallsyms"
1455 depends on DEBUG_KERNEL && KALLSYMS
1457 Normally kallsyms only contains the symbols of functions for nicer
1458 OOPS messages and backtraces (i.e., symbols from the text and inittext
1459 sections). This is sufficient for most cases. And only in very rare
1460 cases (e.g., when a debugger is used) all symbols are required (e.g.,
1461 names of variables from the data sections, etc).
1463 This option makes sure that all symbols are loaded into the kernel
1464 image (i.e., symbols from all sections) in cost of increased kernel
1465 size (depending on the kernel configuration, it may be 300KiB or
1466 something like this).
1468 Say N unless you really need all symbols.
1470 config KALLSYMS_ABSOLUTE_PERCPU
1473 default X86_64 && SMP
1475 config KALLSYMS_BASE_RELATIVE
1480 Instead of emitting them as absolute values in the native word size,
1481 emit the symbol references in the kallsyms table as 32-bit entries,
1482 each containing a relative value in the range [base, base + U32_MAX]
1483 or, when KALLSYMS_ABSOLUTE_PERCPU is in effect, each containing either
1484 an absolute value in the range [0, S32_MAX] or a relative value in the
1485 range [base, base + S32_MAX], where base is the lowest relative symbol
1486 address encountered in the image.
1488 On 64-bit builds, this reduces the size of the address table by 50%,
1489 but more importantly, it results in entries whose values are build
1490 time constants, and no relocation pass is required at runtime to fix
1491 up the entries based on the runtime load address of the kernel.
1493 # end of the "standard kernel features (expert users)" menu
1495 # syscall, maps, verifier
1497 bool "Enable bpf() system call"
1503 Enable the bpf() system call that allows to manipulate eBPF
1504 programs and maps via file descriptors.
1506 config BPF_JIT_ALWAYS_ON
1507 bool "Permanently enable BPF JIT and remove BPF interpreter"
1508 depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
1510 Enables BPF JIT and removes BPF interpreter to avoid
1511 speculative execution of BPF instructions by the interpreter
1514 bool "Enable userfaultfd() system call"
1518 Enable the userfaultfd() system call that allows to intercept and
1519 handle page faults in userland.
1521 config ARCH_HAS_MEMBARRIER_CALLBACKS
1524 config ARCH_HAS_MEMBARRIER_SYNC_CORE
1528 bool "Enable rseq() system call" if EXPERT
1530 depends on HAVE_RSEQ
1533 Enable the restartable sequences system call. It provides a
1534 user-space cache for the current CPU number value, which
1535 speeds up getting the current CPU number from user-space,
1536 as well as an ABI to speed up user-space operations on
1543 bool "Enabled debugging of rseq() system call" if EXPERT
1544 depends on RSEQ && DEBUG_KERNEL
1546 Enable extra debugging checks for the rseq system call.
1551 bool "Embedded system"
1552 option allnoconfig_y
1555 This option should be enabled if compiling the kernel for
1556 an embedded system so certain expert options are available
1559 config HAVE_PERF_EVENTS
1562 See tools/perf/design.txt for details.
1564 config PERF_USE_VMALLOC
1567 See tools/perf/design.txt for details
1570 bool "PC/104 support" if EXPERT
1572 Expose PC/104 form factor device drivers and options available for
1573 selection and configuration. Enable this option if your target
1574 machine has a PC/104 bus.
1576 menu "Kernel Performance Events And Counters"
1579 bool "Kernel performance events and counters"
1580 default y if PROFILING
1581 depends on HAVE_PERF_EVENTS
1586 Enable kernel support for various performance events provided
1587 by software and hardware.
1589 Software events are supported either built-in or via the
1590 use of generic tracepoints.
1592 Most modern CPUs support performance events via performance
1593 counter registers. These registers count the number of certain
1594 types of hw events: such as instructions executed, cachemisses
1595 suffered, or branches mis-predicted - without slowing down the
1596 kernel or applications. These registers can also trigger interrupts
1597 when a threshold number of events have passed - and can thus be
1598 used to profile the code that runs on that CPU.
1600 The Linux Performance Event subsystem provides an abstraction of
1601 these software and hardware event capabilities, available via a
1602 system call and used by the "perf" utility in tools/perf/. It
1603 provides per task and per CPU counters, and it provides event
1604 capabilities on top of those.
1608 config DEBUG_PERF_USE_VMALLOC
1610 bool "Debug: use vmalloc to back perf mmap() buffers"
1611 depends on PERF_EVENTS && DEBUG_KERNEL && !PPC
1612 select PERF_USE_VMALLOC
1614 Use vmalloc memory to back perf mmap() buffers.
1616 Mostly useful for debugging the vmalloc code on platforms
1617 that don't require it.
1623 config VM_EVENT_COUNTERS
1625 bool "Enable VM event counters for /proc/vmstat" if EXPERT
1627 VM event counters are needed for event counts to be shown.
1628 This option allows the disabling of the VM event counters
1629 on EXPERT systems. /proc/vmstat will only show page counts
1630 if VM event counters are disabled.
1634 bool "Enable SLUB debugging support" if EXPERT
1635 depends on SLUB && SYSFS
1637 SLUB has extensive debug support features. Disabling these can
1638 result in significant savings in code size. This also disables
1639 SLUB sysfs support. /sys/slab will not exist and there will be
1640 no support for cache validation etc.
1642 config SLUB_MEMCG_SYSFS_ON
1644 bool "Enable memcg SLUB sysfs support by default" if EXPERT
1645 depends on SLUB && SYSFS && MEMCG
1647 SLUB creates a directory under /sys/kernel/slab for each
1648 allocation cache to host info and debug files. If memory
1649 cgroup is enabled, each cache can have per memory cgroup
1650 caches. SLUB can create the same sysfs directories for these
1651 caches under /sys/kernel/slab/CACHE/cgroup but it can lead
1652 to a very high number of debug files being created. This is
1653 controlled by slub_memcg_sysfs boot parameter and this
1654 config option determines the parameter's default value.
1657 bool "Disable heap randomization"
1660 Randomizing heap placement makes heap exploits harder, but it
1661 also breaks ancient binaries (including anything libc5 based).
1662 This option changes the bootup default to heap randomization
1663 disabled, and can be overridden at runtime by setting
1664 /proc/sys/kernel/randomize_va_space to 2.
1666 On non-ancient distros (post-2000 ones) N is usually a safe choice.
1669 prompt "Choose SLAB allocator"
1672 This option allows to select a slab allocator.
1676 select HAVE_HARDENED_USERCOPY_ALLOCATOR
1678 The regular slab allocator that is established and known to work
1679 well in all environments. It organizes cache hot objects in
1680 per cpu and per node queues.
1683 bool "SLUB (Unqueued Allocator)"
1684 select HAVE_HARDENED_USERCOPY_ALLOCATOR
1686 SLUB is a slab allocator that minimizes cache line usage
1687 instead of managing queues of cached objects (SLAB approach).
1688 Per cpu caching is realized using slabs of objects instead
1689 of queues of objects. SLUB can use memory efficiently
1690 and has enhanced diagnostics. SLUB is the default choice for
1695 bool "SLOB (Simple Allocator)"
1697 SLOB replaces the stock allocator with a drastically simpler
1698 allocator. SLOB is generally more space efficient but
1699 does not perform as well on large systems.
1703 config SLAB_MERGE_DEFAULT
1704 bool "Allow slab caches to be merged"
1707 For reduced kernel memory fragmentation, slab caches can be
1708 merged when they share the same size and other characteristics.
1709 This carries a risk of kernel heap overflows being able to
1710 overwrite objects from merged caches (and more easily control
1711 cache layout), which makes such heap attacks easier to exploit
1712 by attackers. By keeping caches unmerged, these kinds of exploits
1713 can usually only damage objects in the same cache. To disable
1714 merging at runtime, "slab_nomerge" can be passed on the kernel
1717 config SLAB_FREELIST_RANDOM
1719 depends on SLAB || SLUB
1720 bool "SLAB freelist randomization"
1722 Randomizes the freelist order used on creating new pages. This
1723 security feature reduces the predictability of the kernel slab
1724 allocator against heap overflows.
1726 config SLAB_FREELIST_HARDENED
1727 bool "Harden slab freelist metadata"
1730 Many kernel heap attacks try to target slab cache metadata and
1731 other infrastructure. This options makes minor performance
1732 sacrifies to harden the kernel slab allocator against common
1733 freelist exploit methods.
1735 config SLUB_CPU_PARTIAL
1737 depends on SLUB && SMP
1738 bool "SLUB per cpu partial cache"
1740 Per cpu partial caches accellerate objects allocation and freeing
1741 that is local to a processor at the price of more indeterminism
1742 in the latency of the free. On overflow these caches will be cleared
1743 which requires the taking of locks that may cause latency spikes.
1744 Typically one would choose no for a realtime system.
1746 config MMAP_ALLOW_UNINITIALIZED
1747 bool "Allow mmapped anonymous memory to be uninitialized"
1748 depends on EXPERT && !MMU
1751 Normally, and according to the Linux spec, anonymous memory obtained
1752 from mmap() has its contents cleared before it is passed to
1753 userspace. Enabling this config option allows you to request that
1754 mmap() skip that if it is given an MAP_UNINITIALIZED flag, thus
1755 providing a huge performance boost. If this option is not enabled,
1756 then the flag will be ignored.
1758 This is taken advantage of by uClibc's malloc(), and also by
1759 ELF-FDPIC binfmt's brk and stack allocator.
1761 Because of the obvious security issues, this option should only be
1762 enabled on embedded devices where you control what is run in
1763 userspace. Since that isn't generally a problem on no-MMU systems,
1764 it is normally safe to say Y here.
1766 See Documentation/nommu-mmap.txt for more information.
1768 config SYSTEM_DATA_VERIFICATION
1770 select SYSTEM_TRUSTED_KEYRING
1774 select ASYMMETRIC_KEY_TYPE
1775 select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
1778 select X509_CERTIFICATE_PARSER
1779 select PKCS7_MESSAGE_PARSER
1781 Provide PKCS#7 message verification using the contents of the system
1782 trusted keyring to provide public keys. This then can be used for
1783 module verification, kexec image verification and firmware blob
1787 bool "Profiling support"
1789 Say Y here to enable the extended profiling support mechanisms used
1790 by profilers such as OProfile.
1793 # Place an empty function call at each tracepoint site. Can be
1794 # dynamically changed for a probe function.
1799 endmenu # General setup
1801 source "arch/Kconfig"
1808 default 0 if BASE_FULL
1809 default 1 if !BASE_FULL
1812 bool "Enable loadable module support"
1815 Kernel modules are small pieces of compiled code which can
1816 be inserted in the running kernel, rather than being
1817 permanently built into the kernel. You use the "modprobe"
1818 tool to add (and sometimes remove) them. If you say Y here,
1819 many parts of the kernel can be built as modules (by
1820 answering M instead of Y where indicated): this is most
1821 useful for infrequently used options which are not required
1822 for booting. For more information, see the man pages for
1823 modprobe, lsmod, modinfo, insmod and rmmod.
1825 If you say Y here, you will need to run "make
1826 modules_install" to put the modules under /lib/modules/
1827 where modprobe can find them (you may need to be root to do
1834 config MODULE_FORCE_LOAD
1835 bool "Forced module loading"
1838 Allow loading of modules without version information (ie. modprobe
1839 --force). Forced module loading sets the 'F' (forced) taint flag and
1840 is usually a really bad idea.
1842 config MODULE_UNLOAD
1843 bool "Module unloading"
1845 Without this option you will not be able to unload any
1846 modules (note that some modules may not be unloadable
1847 anyway), which makes your kernel smaller, faster
1848 and simpler. If unsure, say Y.
1850 config MODULE_FORCE_UNLOAD
1851 bool "Forced module unloading"
1852 depends on MODULE_UNLOAD
1854 This option allows you to force a module to unload, even if the
1855 kernel believes it is unsafe: the kernel will remove the module
1856 without waiting for anyone to stop using it (using the -f option to
1857 rmmod). This is mainly for kernel developers and desperate users.
1861 bool "Module versioning support"
1863 Usually, you have to use modules compiled with your kernel.
1864 Saying Y here makes it sometimes possible to use modules
1865 compiled for different kernels, by adding enough information
1866 to the modules to (hopefully) spot any changes which would
1867 make them incompatible with the kernel you are running. If
1870 config MODULE_REL_CRCS
1872 depends on MODVERSIONS
1874 config MODULE_SRCVERSION_ALL
1875 bool "Source checksum for all modules"
1877 Modules which contain a MODULE_VERSION get an extra "srcversion"
1878 field inserted into their modinfo section, which contains a
1879 sum of the source files which made it. This helps maintainers
1880 see exactly which source was used to build a module (since
1881 others sometimes change the module source without updating
1882 the version). With this option, such a "srcversion" field
1883 will be created for all modules. If unsure, say N.
1886 bool "Module signature verification"
1888 select SYSTEM_DATA_VERIFICATION
1890 Check modules for valid signatures upon load: the signature
1891 is simply appended to the module. For more information see
1892 <file:Documentation/admin-guide/module-signing.rst>.
1894 Note that this option adds the OpenSSL development packages as a
1895 kernel build dependency so that the signing tool can use its crypto
1898 !!!WARNING!!! If you enable this option, you MUST make sure that the
1899 module DOES NOT get stripped after being signed. This includes the
1900 debuginfo strip done by some packagers (such as rpmbuild) and
1901 inclusion into an initramfs that wants the module size reduced.
1903 config MODULE_SIG_FORCE
1904 bool "Require modules to be validly signed"
1905 depends on MODULE_SIG
1907 Reject unsigned modules or signed modules for which we don't have a
1908 key. Without this, such modules will simply taint the kernel.
1910 config MODULE_SIG_ALL
1911 bool "Automatically sign all modules"
1913 depends on MODULE_SIG
1915 Sign all modules during make modules_install. Without this option,
1916 modules must be signed manually, using the scripts/sign-file tool.
1918 comment "Do not forget to sign required modules with scripts/sign-file"
1919 depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL
1922 prompt "Which hash algorithm should modules be signed with?"
1923 depends on MODULE_SIG
1925 This determines which sort of hashing algorithm will be used during
1926 signature generation. This algorithm _must_ be built into the kernel
1927 directly so that signature verification can take place. It is not
1928 possible to load a signed module containing the algorithm to check
1929 the signature on that module.
1931 config MODULE_SIG_SHA1
1932 bool "Sign modules with SHA-1"
1935 config MODULE_SIG_SHA224
1936 bool "Sign modules with SHA-224"
1937 select CRYPTO_SHA256
1939 config MODULE_SIG_SHA256
1940 bool "Sign modules with SHA-256"
1941 select CRYPTO_SHA256
1943 config MODULE_SIG_SHA384
1944 bool "Sign modules with SHA-384"
1945 select CRYPTO_SHA512
1947 config MODULE_SIG_SHA512
1948 bool "Sign modules with SHA-512"
1949 select CRYPTO_SHA512
1953 config MODULE_SIG_HASH
1955 depends on MODULE_SIG
1956 default "sha1" if MODULE_SIG_SHA1
1957 default "sha224" if MODULE_SIG_SHA224
1958 default "sha256" if MODULE_SIG_SHA256
1959 default "sha384" if MODULE_SIG_SHA384
1960 default "sha512" if MODULE_SIG_SHA512
1962 config MODULE_COMPRESS
1963 bool "Compress modules on installation"
1967 Compresses kernel modules when 'make modules_install' is run; gzip or
1968 xz depending on "Compression algorithm" below.
1970 module-init-tools MAY support gzip, and kmod MAY support gzip and xz.
1972 Out-of-tree kernel modules installed using Kbuild will also be
1973 compressed upon installation.
1975 Note: for modules inside an initrd or initramfs, it's more efficient
1976 to compress the whole initrd or initramfs instead.
1978 Note: This is fully compatible with signed modules.
1983 prompt "Compression algorithm"
1984 depends on MODULE_COMPRESS
1985 default MODULE_COMPRESS_GZIP
1987 This determines which sort of compression will be used during
1988 'make modules_install'.
1990 GZIP (default) and XZ are supported.
1992 config MODULE_COMPRESS_GZIP
1995 config MODULE_COMPRESS_XZ
2000 config TRIM_UNUSED_KSYMS
2001 bool "Trim unused exported kernel symbols"
2002 depends on MODULES && !UNUSED_SYMBOLS
2004 The kernel and some modules make many symbols available for
2005 other modules to use via EXPORT_SYMBOL() and variants. Depending
2006 on the set of modules being selected in your kernel configuration,
2007 many of those exported symbols might never be used.
2009 This option allows for unused exported symbols to be dropped from
2010 the build. In turn, this provides the compiler more opportunities
2011 (especially when using LTO) for optimizing the code and reducing
2012 binary size. This might have some security advantages as well.
2014 If unsure, or if you need to build out-of-tree modules, say N.
2018 config MODULES_TREE_LOOKUP
2020 depends on PERF_EVENTS || TRACING
2022 config INIT_ALL_POSSIBLE
2025 Back when each arch used to define their own cpu_online_mask and
2026 cpu_possible_mask, some of them chose to initialize cpu_possible_mask
2027 with all 1s, and others with all 0s. When they were centralised,
2028 it was better to provide this option than to break all the archs
2029 and have several arch maintainers pursuing me down dark alleys.
2031 source "block/Kconfig"
2033 config PREEMPT_NOTIFIERS
2043 Build a simple ASN.1 grammar compiler that produces a bytecode output
2044 that can be interpreted by the ASN.1 stream decoder and used to
2045 inform it as to what tags are to be expected in a stream and what
2046 functions to call on what tags.
2048 source "kernel/Kconfig.locks"
2050 config ARCH_HAS_SYNC_CORE_BEFORE_USERMODE
2053 # It may be useful for an architecture to override the definitions of the
2054 # SYSCALL_DEFINE() and __SYSCALL_DEFINEx() macros in <linux/syscalls.h>
2055 # and the COMPAT_ variants in <linux/compat.h>, in particular to use a
2056 # different calling convention for syscalls. They can also override the
2057 # macros for not-implemented syscalls in kernel/sys_ni.c and
2058 # kernel/time/posix-stubs.c. All these overrides need to be available in
2059 # <asm/syscall_wrapper.h>.
2060 config ARCH_HAS_SYSCALL_WRAPPER