1# 2# General architecture dependent options 3# 4 5config KEXEC_CORE 6 bool 7 8config HAVE_IMA_KEXEC 9 bool 10 11config OPROFILE 12 tristate "OProfile system profiling" 13 depends on PROFILING 14 depends on HAVE_OPROFILE 15 select RING_BUFFER 16 select RING_BUFFER_ALLOW_SWAP 17 help 18 OProfile is a profiling system capable of profiling the 19 whole system, include the kernel, kernel modules, libraries, 20 and applications. 21 22 If unsure, say N. 23 24config OPROFILE_EVENT_MULTIPLEX 25 bool "OProfile multiplexing support (EXPERIMENTAL)" 26 default n 27 depends on OPROFILE && X86 28 help 29 The number of hardware counters is limited. The multiplexing 30 feature enables OProfile to gather more events than counters 31 are provided by the hardware. This is realized by switching 32 between events at a user specified time interval. 33 34 If unsure, say N. 35 36config HAVE_OPROFILE 37 bool 38 39config OPROFILE_NMI_TIMER 40 def_bool y 41 depends on PERF_EVENTS && HAVE_PERF_EVENTS_NMI && !PPC64 42 43config KPROBES 44 bool "Kprobes" 45 depends on MODULES 46 depends on HAVE_KPROBES 47 select KALLSYMS 48 help 49 Kprobes allows you to trap at almost any kernel address and 50 execute a callback function. register_kprobe() establishes 51 a probepoint and specifies the callback. Kprobes is useful 52 for kernel debugging, non-intrusive instrumentation and testing. 53 If in doubt, say "N". 54 55config JUMP_LABEL 56 bool "Optimize very unlikely/likely branches" 57 depends on HAVE_ARCH_JUMP_LABEL 58 help 59 This option enables a transparent branch optimization that 60 makes certain almost-always-true or almost-always-false branch 61 conditions even cheaper to execute within the kernel. 62 63 Certain performance-sensitive kernel code, such as trace points, 64 scheduler functionality, networking code and KVM have such 65 branches and include support for this optimization technique. 66 67 If it is detected that the compiler has support for "asm goto", 68 the kernel will compile such branches with just a nop 69 instruction. When the condition flag is toggled to true, the 70 nop will be converted to a jump instruction to execute the 71 conditional block of instructions. 72 73 This technique lowers overhead and stress on the branch prediction 74 of the processor and generally makes the kernel faster. The update 75 of the condition is slower, but those are always very rare. 76 77 ( On 32-bit x86, the necessary options added to the compiler 78 flags may increase the size of the kernel slightly. ) 79 80config STATIC_KEYS_SELFTEST 81 bool "Static key selftest" 82 depends on JUMP_LABEL 83 help 84 Boot time self-test of the branch patching code. 85 86config OPTPROBES 87 def_bool y 88 depends on KPROBES && HAVE_OPTPROBES 89 depends on !PREEMPT 90 91config KPROBES_ON_FTRACE 92 def_bool y 93 depends on KPROBES && HAVE_KPROBES_ON_FTRACE 94 depends on DYNAMIC_FTRACE_WITH_REGS 95 help 96 If function tracer is enabled and the arch supports full 97 passing of pt_regs to function tracing, then kprobes can 98 optimize on top of function tracing. 99 100config UPROBES 101 def_bool n 102 depends on ARCH_SUPPORTS_UPROBES 103 help 104 Uprobes is the user-space counterpart to kprobes: they 105 enable instrumentation applications (such as 'perf probe') 106 to establish unintrusive probes in user-space binaries and 107 libraries, by executing handler functions when the probes 108 are hit by user-space applications. 109 110 ( These probes come in the form of single-byte breakpoints, 111 managed by the kernel and kept transparent to the probed 112 application. ) 113 114config HAVE_64BIT_ALIGNED_ACCESS 115 def_bool 64BIT && !HAVE_EFFICIENT_UNALIGNED_ACCESS 116 help 117 Some architectures require 64 bit accesses to be 64 bit 118 aligned, which also requires structs containing 64 bit values 119 to be 64 bit aligned too. This includes some 32 bit 120 architectures which can do 64 bit accesses, as well as 64 bit 121 architectures without unaligned access. 122 123 This symbol should be selected by an architecture if 64 bit 124 accesses are required to be 64 bit aligned in this way even 125 though it is not a 64 bit architecture. 126 127 See Documentation/unaligned-memory-access.txt for more 128 information on the topic of unaligned memory accesses. 129 130config HAVE_EFFICIENT_UNALIGNED_ACCESS 131 bool 132 help 133 Some architectures are unable to perform unaligned accesses 134 without the use of get_unaligned/put_unaligned. Others are 135 unable to perform such accesses efficiently (e.g. trap on 136 unaligned access and require fixing it up in the exception 137 handler.) 138 139 This symbol should be selected by an architecture if it can 140 perform unaligned accesses efficiently to allow different 141 code paths to be selected for these cases. Some network 142 drivers, for example, could opt to not fix up alignment 143 problems with received packets if doing so would not help 144 much. 145 146 See Documentation/unaligned-memory-access.txt for more 147 information on the topic of unaligned memory accesses. 148 149config ARCH_USE_BUILTIN_BSWAP 150 bool 151 help 152 Modern versions of GCC (since 4.4) have builtin functions 153 for handling byte-swapping. Using these, instead of the old 154 inline assembler that the architecture code provides in the 155 __arch_bswapXX() macros, allows the compiler to see what's 156 happening and offers more opportunity for optimisation. In 157 particular, the compiler will be able to combine the byteswap 158 with a nearby load or store and use load-and-swap or 159 store-and-swap instructions if the architecture has them. It 160 should almost *never* result in code which is worse than the 161 hand-coded assembler in <asm/swab.h>. But just in case it 162 does, the use of the builtins is optional. 163 164 Any architecture with load-and-swap or store-and-swap 165 instructions should set this. And it shouldn't hurt to set it 166 on architectures that don't have such instructions. 167 168config KRETPROBES 169 def_bool y 170 depends on KPROBES && HAVE_KRETPROBES 171 172config USER_RETURN_NOTIFIER 173 bool 174 depends on HAVE_USER_RETURN_NOTIFIER 175 help 176 Provide a kernel-internal notification when a cpu is about to 177 switch to user mode. 178 179config HAVE_IOREMAP_PROT 180 bool 181 182config HAVE_KPROBES 183 bool 184 185config HAVE_KRETPROBES 186 bool 187 188config HAVE_OPTPROBES 189 bool 190 191config HAVE_KPROBES_ON_FTRACE 192 bool 193 194config HAVE_NMI 195 bool 196 197config HAVE_NMI_WATCHDOG 198 depends on HAVE_NMI 199 bool 200# 201# An arch should select this if it provides all these things: 202# 203# task_pt_regs() in asm/processor.h or asm/ptrace.h 204# arch_has_single_step() if there is hardware single-step support 205# arch_has_block_step() if there is hardware block-step support 206# asm/syscall.h supplying asm-generic/syscall.h interface 207# linux/regset.h user_regset interfaces 208# CORE_DUMP_USE_REGSET #define'd in linux/elf.h 209# TIF_SYSCALL_TRACE calls tracehook_report_syscall_{entry,exit} 210# TIF_NOTIFY_RESUME calls tracehook_notify_resume() 211# signal delivery calls tracehook_signal_handler() 212# 213config HAVE_ARCH_TRACEHOOK 214 bool 215 216config HAVE_DMA_CONTIGUOUS 217 bool 218 219config GENERIC_SMP_IDLE_THREAD 220 bool 221 222config GENERIC_IDLE_POLL_SETUP 223 bool 224 225# Select if arch has all set_memory_ro/rw/x/nx() functions in asm/cacheflush.h 226config ARCH_HAS_SET_MEMORY 227 bool 228 229# Select if arch init_task initializer is different to init/init_task.c 230config ARCH_INIT_TASK 231 bool 232 233# Select if arch has its private alloc_task_struct() function 234config ARCH_TASK_STRUCT_ALLOCATOR 235 bool 236 237# Select if arch has its private alloc_thread_stack() function 238config ARCH_THREAD_STACK_ALLOCATOR 239 bool 240 241# Select if arch wants to size task_struct dynamically via arch_task_struct_size: 242config ARCH_WANTS_DYNAMIC_TASK_STRUCT 243 bool 244 245config HAVE_REGS_AND_STACK_ACCESS_API 246 bool 247 help 248 This symbol should be selected by an architecure if it supports 249 the API needed to access registers and stack entries from pt_regs, 250 declared in asm/ptrace.h 251 For example the kprobes-based event tracer needs this API. 252 253config HAVE_CLK 254 bool 255 help 256 The <linux/clk.h> calls support software clock gating and 257 thus are a key power management tool on many systems. 258 259config HAVE_DMA_API_DEBUG 260 bool 261 262config HAVE_HW_BREAKPOINT 263 bool 264 depends on PERF_EVENTS 265 266config HAVE_MIXED_BREAKPOINTS_REGS 267 bool 268 depends on HAVE_HW_BREAKPOINT 269 help 270 Depending on the arch implementation of hardware breakpoints, 271 some of them have separate registers for data and instruction 272 breakpoints addresses, others have mixed registers to store 273 them but define the access type in a control register. 274 Select this option if your arch implements breakpoints under the 275 latter fashion. 276 277config HAVE_USER_RETURN_NOTIFIER 278 bool 279 280config HAVE_PERF_EVENTS_NMI 281 bool 282 help 283 System hardware can generate an NMI using the perf event 284 subsystem. Also has support for calculating CPU cycle events 285 to determine how many clock cycles in a given period. 286 287config HAVE_PERF_REGS 288 bool 289 help 290 Support selective register dumps for perf events. This includes 291 bit-mapping of each registers and a unique architecture id. 292 293config HAVE_PERF_USER_STACK_DUMP 294 bool 295 help 296 Support user stack dumps for perf event samples. This needs 297 access to the user stack pointer which is not unified across 298 architectures. 299 300config HAVE_ARCH_JUMP_LABEL 301 bool 302 303config HAVE_RCU_TABLE_FREE 304 bool 305 306config ARCH_HAVE_NMI_SAFE_CMPXCHG 307 bool 308 309config HAVE_ALIGNED_STRUCT_PAGE 310 bool 311 help 312 This makes sure that struct pages are double word aligned and that 313 e.g. the SLUB allocator can perform double word atomic operations 314 on a struct page for better performance. However selecting this 315 might increase the size of a struct page by a word. 316 317config HAVE_CMPXCHG_LOCAL 318 bool 319 320config HAVE_CMPXCHG_DOUBLE 321 bool 322 323config ARCH_WANT_IPC_PARSE_VERSION 324 bool 325 326config ARCH_WANT_COMPAT_IPC_PARSE_VERSION 327 bool 328 329config ARCH_WANT_OLD_COMPAT_IPC 330 select ARCH_WANT_COMPAT_IPC_PARSE_VERSION 331 bool 332 333config HAVE_ARCH_SECCOMP_FILTER 334 bool 335 help 336 An arch should select this symbol if it provides all of these things: 337 - syscall_get_arch() 338 - syscall_get_arguments() 339 - syscall_rollback() 340 - syscall_set_return_value() 341 - SIGSYS siginfo_t support 342 - secure_computing is called from a ptrace_event()-safe context 343 - secure_computing return value is checked and a return value of -1 344 results in the system call being skipped immediately. 345 - seccomp syscall wired up 346 347config SECCOMP_FILTER 348 def_bool y 349 depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET 350 help 351 Enable tasks to build secure computing environments defined 352 in terms of Berkeley Packet Filter programs which implement 353 task-defined system call filtering polices. 354 355 See Documentation/prctl/seccomp_filter.txt for details. 356 357config HAVE_GCC_PLUGINS 358 bool 359 help 360 An arch should select this symbol if it supports building with 361 GCC plugins. 362 363menuconfig GCC_PLUGINS 364 bool "GCC plugins" 365 depends on HAVE_GCC_PLUGINS 366 depends on !COMPILE_TEST 367 help 368 GCC plugins are loadable modules that provide extra features to the 369 compiler. They are useful for runtime instrumentation and static analysis. 370 371 See Documentation/gcc-plugins.txt for details. 372 373config GCC_PLUGIN_CYC_COMPLEXITY 374 bool "Compute the cyclomatic complexity of a function" if EXPERT 375 depends on GCC_PLUGINS 376 depends on !COMPILE_TEST 377 help 378 The complexity M of a function's control flow graph is defined as: 379 M = E - N + 2P 380 where 381 382 E = the number of edges 383 N = the number of nodes 384 P = the number of connected components (exit nodes). 385 386 Enabling this plugin reports the complexity to stderr during the 387 build. It mainly serves as a simple example of how to create a 388 gcc plugin for the kernel. 389 390config GCC_PLUGIN_SANCOV 391 bool 392 depends on GCC_PLUGINS 393 help 394 This plugin inserts a __sanitizer_cov_trace_pc() call at the start of 395 basic blocks. It supports all gcc versions with plugin support (from 396 gcc-4.5 on). It is based on the commit "Add fuzzing coverage support" 397 by Dmitry Vyukov <dvyukov@google.com>. 398 399config GCC_PLUGIN_LATENT_ENTROPY 400 bool "Generate some entropy during boot and runtime" 401 depends on GCC_PLUGINS 402 help 403 By saying Y here the kernel will instrument some kernel code to 404 extract some entropy from both original and artificially created 405 program state. This will help especially embedded systems where 406 there is little 'natural' source of entropy normally. The cost 407 is some slowdown of the boot process (about 0.5%) and fork and 408 irq processing. 409 410 Note that entropy extracted this way is not cryptographically 411 secure! 412 413 This plugin was ported from grsecurity/PaX. More information at: 414 * https://grsecurity.net/ 415 * https://pax.grsecurity.net/ 416 417config GCC_PLUGIN_STRUCTLEAK 418 bool "Force initialization of variables containing userspace addresses" 419 depends on GCC_PLUGINS 420 help 421 This plugin zero-initializes any structures that containing a 422 __user attribute. This can prevent some classes of information 423 exposures. 424 425 This plugin was ported from grsecurity/PaX. More information at: 426 * https://grsecurity.net/ 427 * https://pax.grsecurity.net/ 428 429config GCC_PLUGIN_STRUCTLEAK_VERBOSE 430 bool "Report forcefully initialized variables" 431 depends on GCC_PLUGIN_STRUCTLEAK 432 depends on !COMPILE_TEST 433 help 434 This option will cause a warning to be printed each time the 435 structleak plugin finds a variable it thinks needs to be 436 initialized. Since not all existing initializers are detected 437 by the plugin, this can produce false positive warnings. 438 439config HAVE_CC_STACKPROTECTOR 440 bool 441 help 442 An arch should select this symbol if: 443 - its compiler supports the -fstack-protector option 444 - it has implemented a stack canary (e.g. __stack_chk_guard) 445 446config CC_STACKPROTECTOR 447 def_bool n 448 help 449 Set when a stack-protector mode is enabled, so that the build 450 can enable kernel-side support for the GCC feature. 451 452choice 453 prompt "Stack Protector buffer overflow detection" 454 depends on HAVE_CC_STACKPROTECTOR 455 default CC_STACKPROTECTOR_NONE 456 help 457 This option turns on the "stack-protector" GCC feature. This 458 feature puts, at the beginning of functions, a canary value on 459 the stack just before the return address, and validates 460 the value just before actually returning. Stack based buffer 461 overflows (that need to overwrite this return address) now also 462 overwrite the canary, which gets detected and the attack is then 463 neutralized via a kernel panic. 464 465config CC_STACKPROTECTOR_NONE 466 bool "None" 467 help 468 Disable "stack-protector" GCC feature. 469 470config CC_STACKPROTECTOR_REGULAR 471 bool "Regular" 472 select CC_STACKPROTECTOR 473 help 474 Functions will have the stack-protector canary logic added if they 475 have an 8-byte or larger character array on the stack. 476 477 This feature requires gcc version 4.2 or above, or a distribution 478 gcc with the feature backported ("-fstack-protector"). 479 480 On an x86 "defconfig" build, this feature adds canary checks to 481 about 3% of all kernel functions, which increases kernel code size 482 by about 0.3%. 483 484config CC_STACKPROTECTOR_STRONG 485 bool "Strong" 486 select CC_STACKPROTECTOR 487 help 488 Functions will have the stack-protector canary logic added in any 489 of the following conditions: 490 491 - local variable's address used as part of the right hand side of an 492 assignment or function argument 493 - local variable is an array (or union containing an array), 494 regardless of array type or length 495 - uses register local variables 496 497 This feature requires gcc version 4.9 or above, or a distribution 498 gcc with the feature backported ("-fstack-protector-strong"). 499 500 On an x86 "defconfig" build, this feature adds canary checks to 501 about 20% of all kernel functions, which increases the kernel code 502 size by about 2%. 503 504endchoice 505 506config THIN_ARCHIVES 507 bool 508 help 509 Select this if the architecture wants to use thin archives 510 instead of ld -r to create the built-in.o files. 511 512config LD_DEAD_CODE_DATA_ELIMINATION 513 bool 514 help 515 Select this if the architecture wants to do dead code and 516 data elimination with the linker by compiling with 517 -ffunction-sections -fdata-sections and linking with 518 --gc-sections. 519 520 This requires that the arch annotates or otherwise protects 521 its external entry points from being discarded. Linker scripts 522 must also merge .text.*, .data.*, and .bss.* correctly into 523 output sections. Care must be taken not to pull in unrelated 524 sections (e.g., '.text.init'). Typically '.' in section names 525 is used to distinguish them from label names / C identifiers. 526 527config HAVE_ARCH_WITHIN_STACK_FRAMES 528 bool 529 help 530 An architecture should select this if it can walk the kernel stack 531 frames to determine if an object is part of either the arguments 532 or local variables (i.e. that it excludes saved return addresses, 533 and similar) by implementing an inline arch_within_stack_frames(), 534 which is used by CONFIG_HARDENED_USERCOPY. 535 536config HAVE_CONTEXT_TRACKING 537 bool 538 help 539 Provide kernel/user boundaries probes necessary for subsystems 540 that need it, such as userspace RCU extended quiescent state. 541 Syscalls need to be wrapped inside user_exit()-user_enter() through 542 the slow path using TIF_NOHZ flag. Exceptions handlers must be 543 wrapped as well. Irqs are already protected inside 544 rcu_irq_enter/rcu_irq_exit() but preemption or signal handling on 545 irq exit still need to be protected. 546 547config HAVE_VIRT_CPU_ACCOUNTING 548 bool 549 550config ARCH_HAS_SCALED_CPUTIME 551 bool 552 553config HAVE_VIRT_CPU_ACCOUNTING_GEN 554 bool 555 default y if 64BIT 556 help 557 With VIRT_CPU_ACCOUNTING_GEN, cputime_t becomes 64-bit. 558 Before enabling this option, arch code must be audited 559 to ensure there are no races in concurrent read/write of 560 cputime_t. For example, reading/writing 64-bit cputime_t on 561 some 32-bit arches may require multiple accesses, so proper 562 locking is needed to protect against concurrent accesses. 563 564 565config HAVE_IRQ_TIME_ACCOUNTING 566 bool 567 help 568 Archs need to ensure they use a high enough resolution clock to 569 support irq time accounting and then call enable_sched_clock_irqtime(). 570 571config HAVE_ARCH_TRANSPARENT_HUGEPAGE 572 bool 573 574config HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD 575 bool 576 577config HAVE_ARCH_HUGE_VMAP 578 bool 579 580config HAVE_ARCH_SOFT_DIRTY 581 bool 582 583config HAVE_MOD_ARCH_SPECIFIC 584 bool 585 help 586 The arch uses struct mod_arch_specific to store data. Many arches 587 just need a simple module loader without arch specific data - those 588 should not enable this. 589 590config MODULES_USE_ELF_RELA 591 bool 592 help 593 Modules only use ELF RELA relocations. Modules with ELF REL 594 relocations will give an error. 595 596config MODULES_USE_ELF_REL 597 bool 598 help 599 Modules only use ELF REL relocations. Modules with ELF RELA 600 relocations will give an error. 601 602config HAVE_UNDERSCORE_SYMBOL_PREFIX 603 bool 604 help 605 Some architectures generate an _ in front of C symbols; things like 606 module loading and assembly files need to know about this. 607 608config HAVE_IRQ_EXIT_ON_IRQ_STACK 609 bool 610 help 611 Architecture doesn't only execute the irq handler on the irq stack 612 but also irq_exit(). This way we can process softirqs on this irq 613 stack instead of switching to a new one when we call __do_softirq() 614 in the end of an hardirq. 615 This spares a stack switch and improves cache usage on softirq 616 processing. 617 618config PGTABLE_LEVELS 619 int 620 default 2 621 622config ARCH_HAS_ELF_RANDOMIZE 623 bool 624 help 625 An architecture supports choosing randomized locations for 626 stack, mmap, brk, and ET_DYN. Defined functions: 627 - arch_mmap_rnd() 628 - arch_randomize_brk() 629 630config HAVE_ARCH_MMAP_RND_BITS 631 bool 632 help 633 An arch should select this symbol if it supports setting a variable 634 number of bits for use in establishing the base address for mmap 635 allocations, has MMU enabled and provides values for both: 636 - ARCH_MMAP_RND_BITS_MIN 637 - ARCH_MMAP_RND_BITS_MAX 638 639config HAVE_EXIT_THREAD 640 bool 641 help 642 An architecture implements exit_thread. 643 644config ARCH_MMAP_RND_BITS_MIN 645 int 646 647config ARCH_MMAP_RND_BITS_MAX 648 int 649 650config ARCH_MMAP_RND_BITS_DEFAULT 651 int 652 653config ARCH_MMAP_RND_BITS 654 int "Number of bits to use for ASLR of mmap base address" if EXPERT 655 range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX 656 default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT 657 default ARCH_MMAP_RND_BITS_MIN 658 depends on HAVE_ARCH_MMAP_RND_BITS 659 help 660 This value can be used to select the number of bits to use to 661 determine the random offset to the base address of vma regions 662 resulting from mmap allocations. This value will be bounded 663 by the architecture's minimum and maximum supported values. 664 665 This value can be changed after boot using the 666 /proc/sys/vm/mmap_rnd_bits tunable 667 668config HAVE_ARCH_MMAP_RND_COMPAT_BITS 669 bool 670 help 671 An arch should select this symbol if it supports running applications 672 in compatibility mode, supports setting a variable number of bits for 673 use in establishing the base address for mmap allocations, has MMU 674 enabled and provides values for both: 675 - ARCH_MMAP_RND_COMPAT_BITS_MIN 676 - ARCH_MMAP_RND_COMPAT_BITS_MAX 677 678config ARCH_MMAP_RND_COMPAT_BITS_MIN 679 int 680 681config ARCH_MMAP_RND_COMPAT_BITS_MAX 682 int 683 684config ARCH_MMAP_RND_COMPAT_BITS_DEFAULT 685 int 686 687config ARCH_MMAP_RND_COMPAT_BITS 688 int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT 689 range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX 690 default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT 691 default ARCH_MMAP_RND_COMPAT_BITS_MIN 692 depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS 693 help 694 This value can be used to select the number of bits to use to 695 determine the random offset to the base address of vma regions 696 resulting from mmap allocations for compatible applications This 697 value will be bounded by the architecture's minimum and maximum 698 supported values. 699 700 This value can be changed after boot using the 701 /proc/sys/vm/mmap_rnd_compat_bits tunable 702 703config HAVE_COPY_THREAD_TLS 704 bool 705 help 706 Architecture provides copy_thread_tls to accept tls argument via 707 normal C parameter passing, rather than extracting the syscall 708 argument from pt_regs. 709 710config HAVE_STACK_VALIDATION 711 bool 712 help 713 Architecture supports the 'objtool check' host tool command, which 714 performs compile-time stack metadata validation. 715 716config HAVE_ARCH_HASH 717 bool 718 default n 719 help 720 If this is set, the architecture provides an <asm/hash.h> 721 file which provides platform-specific implementations of some 722 functions in <linux/hash.h> or fs/namei.c. 723 724config ISA_BUS_API 725 def_bool ISA 726 727# 728# ABI hall of shame 729# 730config CLONE_BACKWARDS 731 bool 732 help 733 Architecture has tls passed as the 4th argument of clone(2), 734 not the 5th one. 735 736config CLONE_BACKWARDS2 737 bool 738 help 739 Architecture has the first two arguments of clone(2) swapped. 740 741config CLONE_BACKWARDS3 742 bool 743 help 744 Architecture has tls passed as the 3rd argument of clone(2), 745 not the 5th one. 746 747config ODD_RT_SIGACTION 748 bool 749 help 750 Architecture has unusual rt_sigaction(2) arguments 751 752config OLD_SIGSUSPEND 753 bool 754 help 755 Architecture has old sigsuspend(2) syscall, of one-argument variety 756 757config OLD_SIGSUSPEND3 758 bool 759 help 760 Even weirder antique ABI - three-argument sigsuspend(2) 761 762config OLD_SIGACTION 763 bool 764 help 765 Architecture has old sigaction(2) syscall. Nope, not the same 766 as OLD_SIGSUSPEND | OLD_SIGSUSPEND3 - alpha has sigsuspend(2), 767 but fairly different variant of sigaction(2), thanks to OSF/1 768 compatibility... 769 770config COMPAT_OLD_SIGACTION 771 bool 772 773config ARCH_NO_COHERENT_DMA_MMAP 774 bool 775 776config CPU_NO_EFFICIENT_FFS 777 def_bool n 778 779config HAVE_ARCH_VMAP_STACK 780 def_bool n 781 help 782 An arch should select this symbol if it can support kernel stacks 783 in vmalloc space. This means: 784 785 - vmalloc space must be large enough to hold many kernel stacks. 786 This may rule out many 32-bit architectures. 787 788 - Stacks in vmalloc space need to work reliably. For example, if 789 vmap page tables are created on demand, either this mechanism 790 needs to work while the stack points to a virtual address with 791 unpopulated page tables or arch code (switch_to() and switch_mm(), 792 most likely) needs to ensure that the stack's page table entries 793 are populated before running on a possibly unpopulated stack. 794 795 - If the stack overflows into a guard page, something reasonable 796 should happen. The definition of "reasonable" is flexible, but 797 instantly rebooting without logging anything would be unfriendly. 798 799config VMAP_STACK 800 default y 801 bool "Use a virtually-mapped stack" 802 depends on HAVE_ARCH_VMAP_STACK && !KASAN 803 ---help--- 804 Enable this if you want the use virtually-mapped kernel stacks 805 with guard pages. This causes kernel stack overflows to be 806 caught immediately rather than causing difficult-to-diagnose 807 corruption. 808 809 This is presently incompatible with KASAN because KASAN expects 810 the stack to map directly to the KASAN shadow map using a formula 811 that is incorrect if the stack is in vmalloc space. 812 813config ARCH_OPTIONAL_KERNEL_RWX 814 def_bool n 815 816config ARCH_OPTIONAL_KERNEL_RWX_DEFAULT 817 def_bool n 818 819config ARCH_HAS_STRICT_KERNEL_RWX 820 def_bool n 821 822config STRICT_KERNEL_RWX 823 bool "Make kernel text and rodata read-only" if ARCH_OPTIONAL_KERNEL_RWX 824 depends on ARCH_HAS_STRICT_KERNEL_RWX 825 default !ARCH_OPTIONAL_KERNEL_RWX || ARCH_OPTIONAL_KERNEL_RWX_DEFAULT 826 help 827 If this is set, kernel text and rodata memory will be made read-only, 828 and non-text memory will be made non-executable. This provides 829 protection against certain security exploits (e.g. executing the heap 830 or modifying text) 831 832 These features are considered standard security practice these days. 833 You should say Y here in almost all cases. 834 835config ARCH_HAS_STRICT_MODULE_RWX 836 def_bool n 837 838config STRICT_MODULE_RWX 839 bool "Set loadable kernel module data as NX and text as RO" if ARCH_OPTIONAL_KERNEL_RWX 840 depends on ARCH_HAS_STRICT_MODULE_RWX && MODULES 841 default !ARCH_OPTIONAL_KERNEL_RWX || ARCH_OPTIONAL_KERNEL_RWX_DEFAULT 842 help 843 If this is set, module text and rodata memory will be made read-only, 844 and non-text memory will be made non-executable. This provides 845 protection against certain security exploits (e.g. writing to text) 846 847config ARCH_WANT_RELAX_ORDER 848 bool 849 850source "kernel/gcov/Kconfig" 851