]>
Commit | Line | Data |
---|---|---|
1 | # | |
2 | # General architecture dependent options | |
3 | # | |
4 | ||
5 | config KEXEC_CORE | |
6 | bool | |
7 | ||
8 | config HAVE_IMA_KEXEC | |
9 | bool | |
10 | ||
11 | config OPROFILE | |
12 | tristate "OProfile system profiling" | |
13 | depends on PROFILING | |
14 | depends on HAVE_OPROFILE | |
15 | select RING_BUFFER | |
16 | select RING_BUFFER_ALLOW_SWAP | |
17 | help | |
18 | OProfile is a profiling system capable of profiling the | |
19 | whole system, include the kernel, kernel modules, libraries, | |
20 | and applications. | |
21 | ||
22 | If unsure, say N. | |
23 | ||
24 | config OPROFILE_EVENT_MULTIPLEX | |
25 | bool "OProfile multiplexing support (EXPERIMENTAL)" | |
26 | default n | |
27 | depends on OPROFILE && X86 | |
28 | help | |
29 | The number of hardware counters is limited. The multiplexing | |
30 | feature enables OProfile to gather more events than counters | |
31 | are provided by the hardware. This is realized by switching | |
32 | between events at a user specified time interval. | |
33 | ||
34 | If unsure, say N. | |
35 | ||
36 | config HAVE_OPROFILE | |
37 | bool | |
38 | ||
39 | config OPROFILE_NMI_TIMER | |
40 | def_bool y | |
41 | depends on PERF_EVENTS && HAVE_PERF_EVENTS_NMI && !PPC64 | |
42 | ||
43 | config KPROBES | |
44 | bool "Kprobes" | |
45 | depends on MODULES | |
46 | depends on HAVE_KPROBES | |
47 | select KALLSYMS | |
48 | help | |
49 | Kprobes allows you to trap at almost any kernel address and | |
50 | execute a callback function. register_kprobe() establishes | |
51 | a probepoint and specifies the callback. Kprobes is useful | |
52 | for kernel debugging, non-intrusive instrumentation and testing. | |
53 | If in doubt, say "N". | |
54 | ||
55 | config JUMP_LABEL | |
56 | bool "Optimize very unlikely/likely branches" | |
57 | depends on HAVE_ARCH_JUMP_LABEL | |
58 | help | |
59 | This option enables a transparent branch optimization that | |
60 | makes certain almost-always-true or almost-always-false branch | |
61 | conditions even cheaper to execute within the kernel. | |
62 | ||
63 | Certain performance-sensitive kernel code, such as trace points, | |
64 | scheduler functionality, networking code and KVM have such | |
65 | branches and include support for this optimization technique. | |
66 | ||
67 | If it is detected that the compiler has support for "asm goto", | |
68 | the kernel will compile such branches with just a nop | |
69 | instruction. When the condition flag is toggled to true, the | |
70 | nop will be converted to a jump instruction to execute the | |
71 | conditional block of instructions. | |
72 | ||
73 | This technique lowers overhead and stress on the branch prediction | |
74 | of the processor and generally makes the kernel faster. The update | |
75 | of the condition is slower, but those are always very rare. | |
76 | ||
77 | ( On 32-bit x86, the necessary options added to the compiler | |
78 | flags may increase the size of the kernel slightly. ) | |
79 | ||
80 | config STATIC_KEYS_SELFTEST | |
81 | bool "Static key selftest" | |
82 | depends on JUMP_LABEL | |
83 | help | |
84 | Boot time self-test of the branch patching code. | |
85 | ||
86 | config OPTPROBES | |
87 | def_bool y | |
88 | depends on KPROBES && HAVE_OPTPROBES | |
89 | depends on !PREEMPT | |
90 | ||
91 | config KPROBES_ON_FTRACE | |
92 | def_bool y | |
93 | depends on KPROBES && HAVE_KPROBES_ON_FTRACE | |
94 | depends on DYNAMIC_FTRACE_WITH_REGS | |
95 | help | |
96 | If function tracer is enabled and the arch supports full | |
97 | passing of pt_regs to function tracing, then kprobes can | |
98 | optimize on top of function tracing. | |
99 | ||
100 | config UPROBES | |
101 | def_bool n | |
102 | depends on ARCH_SUPPORTS_UPROBES | |
103 | help | |
104 | Uprobes is the user-space counterpart to kprobes: they | |
105 | enable instrumentation applications (such as 'perf probe') | |
106 | to establish unintrusive probes in user-space binaries and | |
107 | libraries, by executing handler functions when the probes | |
108 | are hit by user-space applications. | |
109 | ||
110 | ( These probes come in the form of single-byte breakpoints, | |
111 | managed by the kernel and kept transparent to the probed | |
112 | application. ) | |
113 | ||
114 | config HAVE_64BIT_ALIGNED_ACCESS | |
115 | def_bool 64BIT && !HAVE_EFFICIENT_UNALIGNED_ACCESS | |
116 | help | |
117 | Some architectures require 64 bit accesses to be 64 bit | |
118 | aligned, which also requires structs containing 64 bit values | |
119 | to be 64 bit aligned too. This includes some 32 bit | |
120 | architectures which can do 64 bit accesses, as well as 64 bit | |
121 | architectures without unaligned access. | |
122 | ||
123 | This symbol should be selected by an architecture if 64 bit | |
124 | accesses are required to be 64 bit aligned in this way even | |
125 | though it is not a 64 bit architecture. | |
126 | ||
127 | See Documentation/unaligned-memory-access.txt for more | |
128 | information on the topic of unaligned memory accesses. | |
129 | ||
130 | config HAVE_EFFICIENT_UNALIGNED_ACCESS | |
131 | bool | |
132 | help | |
133 | Some architectures are unable to perform unaligned accesses | |
134 | without the use of get_unaligned/put_unaligned. Others are | |
135 | unable to perform such accesses efficiently (e.g. trap on | |
136 | unaligned access and require fixing it up in the exception | |
137 | handler.) | |
138 | ||
139 | This symbol should be selected by an architecture if it can | |
140 | perform unaligned accesses efficiently to allow different | |
141 | code paths to be selected for these cases. Some network | |
142 | drivers, for example, could opt to not fix up alignment | |
143 | problems with received packets if doing so would not help | |
144 | much. | |
145 | ||
146 | See Documentation/unaligned-memory-access.txt for more | |
147 | information on the topic of unaligned memory accesses. | |
148 | ||
149 | config ARCH_USE_BUILTIN_BSWAP | |
150 | bool | |
151 | help | |
152 | Modern versions of GCC (since 4.4) have builtin functions | |
153 | for handling byte-swapping. Using these, instead of the old | |
154 | inline assembler that the architecture code provides in the | |
155 | __arch_bswapXX() macros, allows the compiler to see what's | |
156 | happening and offers more opportunity for optimisation. In | |
157 | particular, the compiler will be able to combine the byteswap | |
158 | with a nearby load or store and use load-and-swap or | |
159 | store-and-swap instructions if the architecture has them. It | |
160 | should almost *never* result in code which is worse than the | |
161 | hand-coded assembler in <asm/swab.h>. But just in case it | |
162 | does, the use of the builtins is optional. | |
163 | ||
164 | Any architecture with load-and-swap or store-and-swap | |
165 | instructions should set this. And it shouldn't hurt to set it | |
166 | on architectures that don't have such instructions. | |
167 | ||
168 | config KRETPROBES | |
169 | def_bool y | |
170 | depends on KPROBES && HAVE_KRETPROBES | |
171 | ||
172 | config USER_RETURN_NOTIFIER | |
173 | bool | |
174 | depends on HAVE_USER_RETURN_NOTIFIER | |
175 | help | |
176 | Provide a kernel-internal notification when a cpu is about to | |
177 | switch to user mode. | |
178 | ||
179 | config HAVE_IOREMAP_PROT | |
180 | bool | |
181 | ||
182 | config HAVE_KPROBES | |
183 | bool | |
184 | ||
185 | config HAVE_KRETPROBES | |
186 | bool | |
187 | ||
188 | config HAVE_OPTPROBES | |
189 | bool | |
190 | ||
191 | config HAVE_KPROBES_ON_FTRACE | |
192 | bool | |
193 | ||
194 | config HAVE_NMI | |
195 | bool | |
196 | ||
197 | config HAVE_NMI_WATCHDOG | |
198 | depends on HAVE_NMI | |
199 | bool | |
200 | # | |
201 | # An arch should select this if it provides all these things: | |
202 | # | |
203 | # task_pt_regs() in asm/processor.h or asm/ptrace.h | |
204 | # arch_has_single_step() if there is hardware single-step support | |
205 | # arch_has_block_step() if there is hardware block-step support | |
206 | # asm/syscall.h supplying asm-generic/syscall.h interface | |
207 | # linux/regset.h user_regset interfaces | |
208 | # CORE_DUMP_USE_REGSET #define'd in linux/elf.h | |
209 | # TIF_SYSCALL_TRACE calls tracehook_report_syscall_{entry,exit} | |
210 | # TIF_NOTIFY_RESUME calls tracehook_notify_resume() | |
211 | # signal delivery calls tracehook_signal_handler() | |
212 | # | |
213 | config HAVE_ARCH_TRACEHOOK | |
214 | bool | |
215 | ||
216 | config HAVE_DMA_CONTIGUOUS | |
217 | bool | |
218 | ||
219 | config GENERIC_SMP_IDLE_THREAD | |
220 | bool | |
221 | ||
222 | config GENERIC_IDLE_POLL_SETUP | |
223 | bool | |
224 | ||
225 | # Select if arch has all set_memory_ro/rw/x/nx() functions in asm/cacheflush.h | |
226 | config ARCH_HAS_SET_MEMORY | |
227 | bool | |
228 | ||
229 | # Select if arch init_task initializer is different to init/init_task.c | |
230 | config ARCH_INIT_TASK | |
231 | bool | |
232 | ||
233 | # Select if arch has its private alloc_task_struct() function | |
234 | config ARCH_TASK_STRUCT_ALLOCATOR | |
235 | bool | |
236 | ||
237 | # Select if arch has its private alloc_thread_stack() function | |
238 | config ARCH_THREAD_STACK_ALLOCATOR | |
239 | bool | |
240 | ||
241 | # Select if arch wants to size task_struct dynamically via arch_task_struct_size: | |
242 | config ARCH_WANTS_DYNAMIC_TASK_STRUCT | |
243 | bool | |
244 | ||
245 | config HAVE_REGS_AND_STACK_ACCESS_API | |
246 | bool | |
247 | help | |
248 | This symbol should be selected by an architecure if it supports | |
249 | the API needed to access registers and stack entries from pt_regs, | |
250 | declared in asm/ptrace.h | |
251 | For example the kprobes-based event tracer needs this API. | |
252 | ||
253 | config HAVE_CLK | |
254 | bool | |
255 | help | |
256 | The <linux/clk.h> calls support software clock gating and | |
257 | thus are a key power management tool on many systems. | |
258 | ||
259 | config HAVE_DMA_API_DEBUG | |
260 | bool | |
261 | ||
262 | config HAVE_HW_BREAKPOINT | |
263 | bool | |
264 | depends on PERF_EVENTS | |
265 | ||
266 | config HAVE_MIXED_BREAKPOINTS_REGS | |
267 | bool | |
268 | depends on HAVE_HW_BREAKPOINT | |
269 | help | |
270 | Depending on the arch implementation of hardware breakpoints, | |
271 | some of them have separate registers for data and instruction | |
272 | breakpoints addresses, others have mixed registers to store | |
273 | them but define the access type in a control register. | |
274 | Select this option if your arch implements breakpoints under the | |
275 | latter fashion. | |
276 | ||
277 | config HAVE_USER_RETURN_NOTIFIER | |
278 | bool | |
279 | ||
280 | config HAVE_PERF_EVENTS_NMI | |
281 | bool | |
282 | help | |
283 | System hardware can generate an NMI using the perf event | |
284 | subsystem. Also has support for calculating CPU cycle events | |
285 | to determine how many clock cycles in a given period. | |
286 | ||
287 | config HAVE_PERF_REGS | |
288 | bool | |
289 | help | |
290 | Support selective register dumps for perf events. This includes | |
291 | bit-mapping of each registers and a unique architecture id. | |
292 | ||
293 | config HAVE_PERF_USER_STACK_DUMP | |
294 | bool | |
295 | help | |
296 | Support user stack dumps for perf event samples. This needs | |
297 | access to the user stack pointer which is not unified across | |
298 | architectures. | |
299 | ||
300 | config HAVE_ARCH_JUMP_LABEL | |
301 | bool | |
302 | ||
303 | config HAVE_RCU_TABLE_FREE | |
304 | bool | |
305 | ||
306 | config ARCH_HAVE_NMI_SAFE_CMPXCHG | |
307 | bool | |
308 | ||
309 | config HAVE_ALIGNED_STRUCT_PAGE | |
310 | bool | |
311 | help | |
312 | This makes sure that struct pages are double word aligned and that | |
313 | e.g. the SLUB allocator can perform double word atomic operations | |
314 | on a struct page for better performance. However selecting this | |
315 | might increase the size of a struct page by a word. | |
316 | ||
317 | config HAVE_CMPXCHG_LOCAL | |
318 | bool | |
319 | ||
320 | config HAVE_CMPXCHG_DOUBLE | |
321 | bool | |
322 | ||
323 | config ARCH_WANT_IPC_PARSE_VERSION | |
324 | bool | |
325 | ||
326 | config ARCH_WANT_COMPAT_IPC_PARSE_VERSION | |
327 | bool | |
328 | ||
329 | config ARCH_WANT_OLD_COMPAT_IPC | |
330 | select ARCH_WANT_COMPAT_IPC_PARSE_VERSION | |
331 | bool | |
332 | ||
333 | config HAVE_ARCH_SECCOMP_FILTER | |
334 | bool | |
335 | help | |
336 | An arch should select this symbol if it provides all of these things: | |
337 | - syscall_get_arch() | |
338 | - syscall_get_arguments() | |
339 | - syscall_rollback() | |
340 | - syscall_set_return_value() | |
341 | - SIGSYS siginfo_t support | |
342 | - secure_computing is called from a ptrace_event()-safe context | |
343 | - secure_computing return value is checked and a return value of -1 | |
344 | results in the system call being skipped immediately. | |
345 | - seccomp syscall wired up | |
346 | ||
347 | config SECCOMP_FILTER | |
348 | def_bool y | |
349 | depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET | |
350 | help | |
351 | Enable tasks to build secure computing environments defined | |
352 | in terms of Berkeley Packet Filter programs which implement | |
353 | task-defined system call filtering polices. | |
354 | ||
355 | See Documentation/prctl/seccomp_filter.txt for details. | |
356 | ||
357 | config HAVE_GCC_PLUGINS | |
358 | bool | |
359 | help | |
360 | An arch should select this symbol if it supports building with | |
361 | GCC plugins. | |
362 | ||
363 | menuconfig GCC_PLUGINS | |
364 | bool "GCC plugins" | |
365 | depends on HAVE_GCC_PLUGINS | |
366 | depends on !COMPILE_TEST | |
367 | help | |
368 | GCC plugins are loadable modules that provide extra features to the | |
369 | compiler. They are useful for runtime instrumentation and static analysis. | |
370 | ||
371 | See Documentation/gcc-plugins.txt for details. | |
372 | ||
373 | config GCC_PLUGIN_CYC_COMPLEXITY | |
374 | bool "Compute the cyclomatic complexity of a function" if EXPERT | |
375 | depends on GCC_PLUGINS | |
376 | depends on !COMPILE_TEST | |
377 | help | |
378 | The complexity M of a function's control flow graph is defined as: | |
379 | M = E - N + 2P | |
380 | where | |
381 | ||
382 | E = the number of edges | |
383 | N = the number of nodes | |
384 | P = the number of connected components (exit nodes). | |
385 | ||
386 | Enabling this plugin reports the complexity to stderr during the | |
387 | build. It mainly serves as a simple example of how to create a | |
388 | gcc plugin for the kernel. | |
389 | ||
390 | config GCC_PLUGIN_SANCOV | |
391 | bool | |
392 | depends on GCC_PLUGINS | |
393 | help | |
394 | This plugin inserts a __sanitizer_cov_trace_pc() call at the start of | |
395 | basic blocks. It supports all gcc versions with plugin support (from | |
396 | gcc-4.5 on). It is based on the commit "Add fuzzing coverage support" | |
397 | by Dmitry Vyukov <dvyukov@google.com>. | |
398 | ||
399 | config GCC_PLUGIN_LATENT_ENTROPY | |
400 | bool "Generate some entropy during boot and runtime" | |
401 | depends on GCC_PLUGINS | |
402 | help | |
403 | By saying Y here the kernel will instrument some kernel code to | |
404 | extract some entropy from both original and artificially created | |
405 | program state. This will help especially embedded systems where | |
406 | there is little 'natural' source of entropy normally. The cost | |
407 | is some slowdown of the boot process (about 0.5%) and fork and | |
408 | irq processing. | |
409 | ||
410 | Note that entropy extracted this way is not cryptographically | |
411 | secure! | |
412 | ||
413 | This plugin was ported from grsecurity/PaX. More information at: | |
414 | * https://grsecurity.net/ | |
415 | * https://pax.grsecurity.net/ | |
416 | ||
417 | config GCC_PLUGIN_STRUCTLEAK | |
418 | bool "Force initialization of variables containing userspace addresses" | |
419 | depends on GCC_PLUGINS | |
420 | help | |
421 | This plugin zero-initializes any structures that containing a | |
422 | __user attribute. This can prevent some classes of information | |
423 | exposures. | |
424 | ||
425 | This plugin was ported from grsecurity/PaX. More information at: | |
426 | * https://grsecurity.net/ | |
427 | * https://pax.grsecurity.net/ | |
428 | ||
429 | config GCC_PLUGIN_STRUCTLEAK_VERBOSE | |
430 | bool "Report forcefully initialized variables" | |
431 | depends on GCC_PLUGIN_STRUCTLEAK | |
432 | depends on !COMPILE_TEST | |
433 | help | |
434 | This option will cause a warning to be printed each time the | |
435 | structleak plugin finds a variable it thinks needs to be | |
436 | initialized. Since not all existing initializers are detected | |
437 | by the plugin, this can produce false positive warnings. | |
438 | ||
439 | config HAVE_CC_STACKPROTECTOR | |
440 | bool | |
441 | help | |
442 | An arch should select this symbol if: | |
443 | - its compiler supports the -fstack-protector option | |
444 | - it has implemented a stack canary (e.g. __stack_chk_guard) | |
445 | ||
446 | config CC_STACKPROTECTOR | |
447 | def_bool n | |
448 | help | |
449 | Set when a stack-protector mode is enabled, so that the build | |
450 | can enable kernel-side support for the GCC feature. | |
451 | ||
452 | choice | |
453 | prompt "Stack Protector buffer overflow detection" | |
454 | depends on HAVE_CC_STACKPROTECTOR | |
455 | default CC_STACKPROTECTOR_NONE | |
456 | help | |
457 | This option turns on the "stack-protector" GCC feature. This | |
458 | feature puts, at the beginning of functions, a canary value on | |
459 | the stack just before the return address, and validates | |
460 | the value just before actually returning. Stack based buffer | |
461 | overflows (that need to overwrite this return address) now also | |
462 | overwrite the canary, which gets detected and the attack is then | |
463 | neutralized via a kernel panic. | |
464 | ||
465 | config CC_STACKPROTECTOR_NONE | |
466 | bool "None" | |
467 | help | |
468 | Disable "stack-protector" GCC feature. | |
469 | ||
470 | config CC_STACKPROTECTOR_REGULAR | |
471 | bool "Regular" | |
472 | select CC_STACKPROTECTOR | |
473 | help | |
474 | Functions will have the stack-protector canary logic added if they | |
475 | have an 8-byte or larger character array on the stack. | |
476 | ||
477 | This feature requires gcc version 4.2 or above, or a distribution | |
478 | gcc with the feature backported ("-fstack-protector"). | |
479 | ||
480 | On an x86 "defconfig" build, this feature adds canary checks to | |
481 | about 3% of all kernel functions, which increases kernel code size | |
482 | by about 0.3%. | |
483 | ||
484 | config CC_STACKPROTECTOR_STRONG | |
485 | bool "Strong" | |
486 | select CC_STACKPROTECTOR | |
487 | help | |
488 | Functions will have the stack-protector canary logic added in any | |
489 | of the following conditions: | |
490 | ||
491 | - local variable's address used as part of the right hand side of an | |
492 | assignment or function argument | |
493 | - local variable is an array (or union containing an array), | |
494 | regardless of array type or length | |
495 | - uses register local variables | |
496 | ||
497 | This feature requires gcc version 4.9 or above, or a distribution | |
498 | gcc with the feature backported ("-fstack-protector-strong"). | |
499 | ||
500 | On an x86 "defconfig" build, this feature adds canary checks to | |
501 | about 20% of all kernel functions, which increases the kernel code | |
502 | size by about 2%. | |
503 | ||
504 | endchoice | |
505 | ||
506 | config THIN_ARCHIVES | |
507 | bool | |
508 | help | |
509 | Select this if the architecture wants to use thin archives | |
510 | instead of ld -r to create the built-in.o files. | |
511 | ||
512 | config LD_DEAD_CODE_DATA_ELIMINATION | |
513 | bool | |
514 | help | |
515 | Select this if the architecture wants to do dead code and | |
516 | data elimination with the linker by compiling with | |
517 | -ffunction-sections -fdata-sections and linking with | |
518 | --gc-sections. | |
519 | ||
520 | This requires that the arch annotates or otherwise protects | |
521 | its external entry points from being discarded. Linker scripts | |
522 | must also merge .text.*, .data.*, and .bss.* correctly into | |
523 | output sections. Care must be taken not to pull in unrelated | |
524 | sections (e.g., '.text.init'). Typically '.' in section names | |
525 | is used to distinguish them from label names / C identifiers. | |
526 | ||
527 | config HAVE_ARCH_WITHIN_STACK_FRAMES | |
528 | bool | |
529 | help | |
530 | An architecture should select this if it can walk the kernel stack | |
531 | frames to determine if an object is part of either the arguments | |
532 | or local variables (i.e. that it excludes saved return addresses, | |
533 | and similar) by implementing an inline arch_within_stack_frames(), | |
534 | which is used by CONFIG_HARDENED_USERCOPY. | |
535 | ||
536 | config HAVE_CONTEXT_TRACKING | |
537 | bool | |
538 | help | |
539 | Provide kernel/user boundaries probes necessary for subsystems | |
540 | that need it, such as userspace RCU extended quiescent state. | |
541 | Syscalls need to be wrapped inside user_exit()-user_enter() through | |
542 | the slow path using TIF_NOHZ flag. Exceptions handlers must be | |
543 | wrapped as well. Irqs are already protected inside | |
544 | rcu_irq_enter/rcu_irq_exit() but preemption or signal handling on | |
545 | irq exit still need to be protected. | |
546 | ||
547 | config HAVE_VIRT_CPU_ACCOUNTING | |
548 | bool | |
549 | ||
550 | config ARCH_HAS_SCALED_CPUTIME | |
551 | bool | |
552 | ||
553 | config HAVE_VIRT_CPU_ACCOUNTING_GEN | |
554 | bool | |
555 | default y if 64BIT | |
556 | help | |
557 | With VIRT_CPU_ACCOUNTING_GEN, cputime_t becomes 64-bit. | |
558 | Before enabling this option, arch code must be audited | |
559 | to ensure there are no races in concurrent read/write of | |
560 | cputime_t. For example, reading/writing 64-bit cputime_t on | |
561 | some 32-bit arches may require multiple accesses, so proper | |
562 | locking is needed to protect against concurrent accesses. | |
563 | ||
564 | ||
565 | config HAVE_IRQ_TIME_ACCOUNTING | |
566 | bool | |
567 | help | |
568 | Archs need to ensure they use a high enough resolution clock to | |
569 | support irq time accounting and then call enable_sched_clock_irqtime(). | |
570 | ||
571 | config HAVE_ARCH_TRANSPARENT_HUGEPAGE | |
572 | bool | |
573 | ||
574 | config HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD | |
575 | bool | |
576 | ||
577 | config HAVE_ARCH_HUGE_VMAP | |
578 | bool | |
579 | ||
580 | config HAVE_ARCH_SOFT_DIRTY | |
581 | bool | |
582 | ||
583 | config HAVE_MOD_ARCH_SPECIFIC | |
584 | bool | |
585 | help | |
586 | The arch uses struct mod_arch_specific to store data. Many arches | |
587 | just need a simple module loader without arch specific data - those | |
588 | should not enable this. | |
589 | ||
590 | config MODULES_USE_ELF_RELA | |
591 | bool | |
592 | help | |
593 | Modules only use ELF RELA relocations. Modules with ELF REL | |
594 | relocations will give an error. | |
595 | ||
596 | config MODULES_USE_ELF_REL | |
597 | bool | |
598 | help | |
599 | Modules only use ELF REL relocations. Modules with ELF RELA | |
600 | relocations will give an error. | |
601 | ||
602 | config HAVE_UNDERSCORE_SYMBOL_PREFIX | |
603 | bool | |
604 | help | |
605 | Some architectures generate an _ in front of C symbols; things like | |
606 | module loading and assembly files need to know about this. | |
607 | ||
608 | config HAVE_IRQ_EXIT_ON_IRQ_STACK | |
609 | bool | |
610 | help | |
611 | Architecture doesn't only execute the irq handler on the irq stack | |
612 | but also irq_exit(). This way we can process softirqs on this irq | |
613 | stack instead of switching to a new one when we call __do_softirq() | |
614 | in the end of an hardirq. | |
615 | This spares a stack switch and improves cache usage on softirq | |
616 | processing. | |
617 | ||
618 | config PGTABLE_LEVELS | |
619 | int | |
620 | default 2 | |
621 | ||
622 | config ARCH_HAS_ELF_RANDOMIZE | |
623 | bool | |
624 | help | |
625 | An architecture supports choosing randomized locations for | |
626 | stack, mmap, brk, and ET_DYN. Defined functions: | |
627 | - arch_mmap_rnd() | |
628 | - arch_randomize_brk() | |
629 | ||
630 | config HAVE_ARCH_MMAP_RND_BITS | |
631 | bool | |
632 | help | |
633 | An arch should select this symbol if it supports setting a variable | |
634 | number of bits for use in establishing the base address for mmap | |
635 | allocations, has MMU enabled and provides values for both: | |
636 | - ARCH_MMAP_RND_BITS_MIN | |
637 | - ARCH_MMAP_RND_BITS_MAX | |
638 | ||
639 | config HAVE_EXIT_THREAD | |
640 | bool | |
641 | help | |
642 | An architecture implements exit_thread. | |
643 | ||
644 | config ARCH_MMAP_RND_BITS_MIN | |
645 | int | |
646 | ||
647 | config ARCH_MMAP_RND_BITS_MAX | |
648 | int | |
649 | ||
650 | config ARCH_MMAP_RND_BITS_DEFAULT | |
651 | int | |
652 | ||
653 | config ARCH_MMAP_RND_BITS | |
654 | int "Number of bits to use for ASLR of mmap base address" if EXPERT | |
655 | range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX | |
656 | default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT | |
657 | default ARCH_MMAP_RND_BITS_MIN | |
658 | depends on HAVE_ARCH_MMAP_RND_BITS | |
659 | help | |
660 | This value can be used to select the number of bits to use to | |
661 | determine the random offset to the base address of vma regions | |
662 | resulting from mmap allocations. This value will be bounded | |
663 | by the architecture's minimum and maximum supported values. | |
664 | ||
665 | This value can be changed after boot using the | |
666 | /proc/sys/vm/mmap_rnd_bits tunable | |
667 | ||
668 | config HAVE_ARCH_MMAP_RND_COMPAT_BITS | |
669 | bool | |
670 | help | |
671 | An arch should select this symbol if it supports running applications | |
672 | in compatibility mode, supports setting a variable number of bits for | |
673 | use in establishing the base address for mmap allocations, has MMU | |
674 | enabled and provides values for both: | |
675 | - ARCH_MMAP_RND_COMPAT_BITS_MIN | |
676 | - ARCH_MMAP_RND_COMPAT_BITS_MAX | |
677 | ||
678 | config ARCH_MMAP_RND_COMPAT_BITS_MIN | |
679 | int | |
680 | ||
681 | config ARCH_MMAP_RND_COMPAT_BITS_MAX | |
682 | int | |
683 | ||
684 | config ARCH_MMAP_RND_COMPAT_BITS_DEFAULT | |
685 | int | |
686 | ||
687 | config ARCH_MMAP_RND_COMPAT_BITS | |
688 | int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT | |
689 | range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX | |
690 | default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT | |
691 | default ARCH_MMAP_RND_COMPAT_BITS_MIN | |
692 | depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS | |
693 | help | |
694 | This value can be used to select the number of bits to use to | |
695 | determine the random offset to the base address of vma regions | |
696 | resulting from mmap allocations for compatible applications This | |
697 | value will be bounded by the architecture's minimum and maximum | |
698 | supported values. | |
699 | ||
700 | This value can be changed after boot using the | |
701 | /proc/sys/vm/mmap_rnd_compat_bits tunable | |
702 | ||
703 | config HAVE_COPY_THREAD_TLS | |
704 | bool | |
705 | help | |
706 | Architecture provides copy_thread_tls to accept tls argument via | |
707 | normal C parameter passing, rather than extracting the syscall | |
708 | argument from pt_regs. | |
709 | ||
710 | config HAVE_STACK_VALIDATION | |
711 | bool | |
712 | help | |
713 | Architecture supports the 'objtool check' host tool command, which | |
714 | performs compile-time stack metadata validation. | |
715 | ||
716 | config HAVE_ARCH_HASH | |
717 | bool | |
718 | default n | |
719 | help | |
720 | If this is set, the architecture provides an <asm/hash.h> | |
721 | file which provides platform-specific implementations of some | |
722 | functions in <linux/hash.h> or fs/namei.c. | |
723 | ||
724 | config ISA_BUS_API | |
725 | def_bool ISA | |
726 | ||
727 | # | |
728 | # ABI hall of shame | |
729 | # | |
730 | config CLONE_BACKWARDS | |
731 | bool | |
732 | help | |
733 | Architecture has tls passed as the 4th argument of clone(2), | |
734 | not the 5th one. | |
735 | ||
736 | config CLONE_BACKWARDS2 | |
737 | bool | |
738 | help | |
739 | Architecture has the first two arguments of clone(2) swapped. | |
740 | ||
741 | config CLONE_BACKWARDS3 | |
742 | bool | |
743 | help | |
744 | Architecture has tls passed as the 3rd argument of clone(2), | |
745 | not the 5th one. | |
746 | ||
747 | config ODD_RT_SIGACTION | |
748 | bool | |
749 | help | |
750 | Architecture has unusual rt_sigaction(2) arguments | |
751 | ||
752 | config OLD_SIGSUSPEND | |
753 | bool | |
754 | help | |
755 | Architecture has old sigsuspend(2) syscall, of one-argument variety | |
756 | ||
757 | config OLD_SIGSUSPEND3 | |
758 | bool | |
759 | help | |
760 | Even weirder antique ABI - three-argument sigsuspend(2) | |
761 | ||
762 | config OLD_SIGACTION | |
763 | bool | |
764 | help | |
765 | Architecture has old sigaction(2) syscall. Nope, not the same | |
766 | as OLD_SIGSUSPEND | OLD_SIGSUSPEND3 - alpha has sigsuspend(2), | |
767 | but fairly different variant of sigaction(2), thanks to OSF/1 | |
768 | compatibility... | |
769 | ||
770 | config COMPAT_OLD_SIGACTION | |
771 | bool | |
772 | ||
773 | config ARCH_NO_COHERENT_DMA_MMAP | |
774 | bool | |
775 | ||
776 | config CPU_NO_EFFICIENT_FFS | |
777 | def_bool n | |
778 | ||
779 | config HAVE_ARCH_VMAP_STACK | |
780 | def_bool n | |
781 | help | |
782 | An arch should select this symbol if it can support kernel stacks | |
783 | in vmalloc space. This means: | |
784 | ||
785 | - vmalloc space must be large enough to hold many kernel stacks. | |
786 | This may rule out many 32-bit architectures. | |
787 | ||
788 | - Stacks in vmalloc space need to work reliably. For example, if | |
789 | vmap page tables are created on demand, either this mechanism | |
790 | needs to work while the stack points to a virtual address with | |
791 | unpopulated page tables or arch code (switch_to() and switch_mm(), | |
792 | most likely) needs to ensure that the stack's page table entries | |
793 | are populated before running on a possibly unpopulated stack. | |
794 | ||
795 | - If the stack overflows into a guard page, something reasonable | |
796 | should happen. The definition of "reasonable" is flexible, but | |
797 | instantly rebooting without logging anything would be unfriendly. | |
798 | ||
799 | config VMAP_STACK | |
800 | default y | |
801 | bool "Use a virtually-mapped stack" | |
802 | depends on HAVE_ARCH_VMAP_STACK && !KASAN | |
803 | ---help--- | |
804 | Enable this if you want the use virtually-mapped kernel stacks | |
805 | with guard pages. This causes kernel stack overflows to be | |
806 | caught immediately rather than causing difficult-to-diagnose | |
807 | corruption. | |
808 | ||
809 | This is presently incompatible with KASAN because KASAN expects | |
810 | the stack to map directly to the KASAN shadow map using a formula | |
811 | that is incorrect if the stack is in vmalloc space. | |
812 | ||
813 | config ARCH_OPTIONAL_KERNEL_RWX | |
814 | def_bool n | |
815 | ||
816 | config ARCH_OPTIONAL_KERNEL_RWX_DEFAULT | |
817 | def_bool n | |
818 | ||
819 | config ARCH_HAS_STRICT_KERNEL_RWX | |
820 | def_bool n | |
821 | ||
822 | config STRICT_KERNEL_RWX | |
823 | bool "Make kernel text and rodata read-only" if ARCH_OPTIONAL_KERNEL_RWX | |
824 | depends on ARCH_HAS_STRICT_KERNEL_RWX | |
825 | default !ARCH_OPTIONAL_KERNEL_RWX || ARCH_OPTIONAL_KERNEL_RWX_DEFAULT | |
826 | help | |
827 | If this is set, kernel text and rodata memory will be made read-only, | |
828 | and non-text memory will be made non-executable. This provides | |
829 | protection against certain security exploits (e.g. executing the heap | |
830 | or modifying text) | |
831 | ||
832 | These features are considered standard security practice these days. | |
833 | You should say Y here in almost all cases. | |
834 | ||
835 | config ARCH_HAS_STRICT_MODULE_RWX | |
836 | def_bool n | |
837 | ||
838 | config STRICT_MODULE_RWX | |
839 | bool "Set loadable kernel module data as NX and text as RO" if ARCH_OPTIONAL_KERNEL_RWX | |
840 | depends on ARCH_HAS_STRICT_MODULE_RWX && MODULES | |
841 | default !ARCH_OPTIONAL_KERNEL_RWX || ARCH_OPTIONAL_KERNEL_RWX_DEFAULT | |
842 | help | |
843 | If this is set, module text and rodata memory will be made read-only, | |
844 | and non-text memory will be made non-executable. This provides | |
845 | protection against certain security exploits (e.g. writing to text) | |
846 | ||
847 | config ARCH_WANT_RELAX_ORDER | |
848 | bool | |
849 | ||
850 | source "kernel/gcov/Kconfig" |