2024-08-14
This aims to be a guide for configuring a Linux kernel for a modern x86_64
machine containing hardware commonly found in laptops, desktops, and other
consumer computers. Note, this guide will sway more minimally, meaning
some features that are not strictly required will not be enabled. All
features will be built directly into kernel, no modules. This article will
not attempt to cover all possible configuration options, as it omits
entire sections that are not relevant on such systems, as well as some
hardware-specific configuration. Please also refer to the kernel's help
text for further information on respective options. I'm not a kernel
developer and comments here are not guaranteed to be functionally
accurate. If you feel anything mentioned is wrong or should be switched
around, reach out. This article assumes some prior knowledge of your
system (eg. lspci, lscpu, lsusb, dmidecode, /proc/devices,
etc.) and general kernel configuration/installation, such as obtaining
sources, generating and maintaining .config, methods of
configuration, compilation, and installation. Throughout, the following
acronyms will be used:
CONFIG_64BIT): Y, STDCONFIG_SPECULATION_MITIGATIONS): Y, STD
CONFIG_VIRTUALIZATION): N, VIRT, unless
needed
CONFIG_MODULES): N,
everything built into kernel
CONFIG_BLOCK): Y, STD, need to
mount disks
CONFIG_NET): Y, unless no need for
network
CONFIG_CRYPTO): Y, SECCONFIG_COMPILE_TEST): N, DEV
CONFIG_WERROR): Y, STD
CONFIG_LOCALVERSION): empty, useful for
git bisect
CONFIG_LOCALVERSION_AUTO): N, DEV
CONFIG_BUILD_SALT): empty, SECCONFIG_DEFAULT_INIT): empty, EMB
CONFIG_DEFAULT_HOSTNAME): empty, entre
your machine's name if you'd like
CONFIG_SYSVIPC): Y, STDCONFIG_POSIX_MQUEUE): N, not
strictly necessary
CONFIG_WATCH_QUEUE): N, not
strictly necessary
CONFIG_CROSS_MEMORY_ATTACH): N, not strictly necessary
CONFIG_USELIB): N, OLDCONFIG_AUDIT): N, not strictly
necessary
CONFIG_NO_HZ): N, OLD
CONFIG_HIGH_RES_TIMERS): Y, STD
CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US): 100
CONFIG_BPF_SYSCALL): N, not
necessary if you do not have any programs that utilise
CONFIG_PREEMPT_DYNAMIC): N
CONFIG_SCHED_CORE): Y, STD
CONFIG_IRQ_TIME_ACCOUNTING): N, DEV
CONFIG_BSD_PROCESS_ACCT): N
CONFIG_TASKSTATS): N
CONFIG_PSI): N
CONFIG_CPU_ISOLATION): N, EMBCONFIG_RCU_EXPERT): N, DEV
CONFIG_IKCONFIG): Y, STDCONFIG_IKCONFIG_PROC): Y, STD
CONFIG_IKHEADERS): N
CONFIG_LOG_BUF_SHIFT): 18CONFIG_LOG_CPU_MAX_BUF_SHIFT): 12
CONFIG_UCLAMP_TASK): N, DEV
CONFIG_CGROUPS): Y, STD
CONFIG_CGROUP_FAVOR_DYNMODS): N
CONFIG_MEMCG): Y, STDCONFIG_BLK_CGROUP): Y, STDCONFIG_CGROUP_SCHED): Y, STD
FAIR_GROUP_SCHED): Y, STD
CONFIG_CFS_BANDWIDTH): N
CONFIG_RT_GROUP_SCHED): N
CONFIG_CGROUP_PIDS): NCONFIG_CGROUP_RDMA): NCONFIG_CGROUP_FREEZER): NCONFIG_CPUSETS): N, only useful on
NUMA machine
CONFIG_CGROUP_DEVICE): NCONFIG_CGROUP_CPUACCT): Y, STD
CONFIG_CGROUP_PERF): NCONFIG_CGROUP_MISC): Y
CONFIG_CGROUP_DEBUG): N, DEVCONFIG_NAMESPACES): Y, STD, used
heavily by web browsers
CONFIG_UTS_NS): YCONFIG_TIME_NS): YCONFIG_IPC_NS): YCONFIG_USER_NS): YCONFIG_PID_NS): YCONFIG_NET_NS): YCONFIG_CHECKPOINT_RESTORE):
N, VIRT
CONFIG_SCHED_AUTOGROUP): N, OLD, Systemd/OpenRC handle
this
CONFIG_RELAY): Y, STD
CONFIG_BLK_DEV_INITRD): N, not strictly necessary
CONFIG_BOOT_CONFIG): N, EMBCONFIG_INITRAMFS_PRESERVE_MTIME): N, without
initramfs...
CONFIG_EXPERT): N,
DEV/EMB, mostly syscalls
CONFIG_KCMP): YCONFIG_RSEQ): YCONFIG_CACHESTAT_SYSCALL): Y
CONFIG_DEBUG_RSEQ): N, DEV
CONFIG_PC104): N, EMBCONFIG_PERF_EVENTS): Y, STD
CONFIG_DEBUG_PERF_USE_VMALLOC): N, DEV
CONFIG_PROFILING): N, DEVCONFIG_SMP): Y, STD,
all modern CPUs are multi-core
CONFIG_X86_MPARSE): N, OLDCONFIG_X86_CPU_RESCTRL): N, VIRT
CONFIG_X86_EXTENDED_PLATFORM): N, EMB
CONFIG_X86_INTEL_LPSS): Y, if you have Haswell and later
CPU
CONFIG_X86_AMD_PLATFORM_DEVICE): N
CONFIG_IOSF_MBI): Y, STD
CONFIG_SCHED_OMIT_FRAME_POINTER): Y, STD
CONFIG_HYPERVISOR_GUEST): N, VIRT
CONFIG_PROCESSOR_SELECT): N,
EMB
CONFIG_DMI): Y, STDCONFIG_GART_IOMMU): N, OLD
CONFIG_MAXSMP): N, DEV
CONFIG_NR_CPUS): sockets * cores
* threads
CONFIG_SCHED_CLUSTER): Y, STD
CONFIG_SCHED_MC): Y, STD
CONFIG_SCHED_MC_PRIO): Y, STD
CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS): N, OLD
CONFIG_X86_MCE):
Y, STD
CONFIG_X86_MCELOG_LEGACY): N, OLD
CONFIG_X86_MCE_INTEL/AMD): Y,
STD, choose based on your processor
CONFIG_PERF_EVENTS_INTEL_UNCORE): Y, STD, for Intel
CONFIG_PERF_EVENTS_INTEL_RAPL): Y, STD
CONFIG_PERF_EVENTS_INTEL_CSTATE): Y, STD, for Intel
CONFIG_PERF_EVENTS_AMD_POWER): Y, STD, for AMD
CONFIG_PERF_EVENTS_AMD_POWER): Y, STD, for AMD
CONFIG_X86_VSYSCALL_EMULATION): N
CONFIG_X86_IOPL_IOPERM): N,
SEC, not strictly necessary
CONFIG_MICROCODE_LATE_LOADING): N
CONFIG_X86_MSR): Y, STD
CONFIG_X86_CPUID): Y, STD
CONFIG_X86_5LEVEL):
N, for machines with large (TBs) amounts of memory
CONFIG_AMD_MEM_ENCRYPT): Y, for AMD
CONFIG_NUMA): N, unless you have multi socket CPU
CONFIG_X86_CHECK_BIOS_CORRUPTION): N
CONFIG_MTRR):
Y, STD
CONFIG_MTRR_SANITIZER): Y, STD
CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT): 1, for true
CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT): 1
CONFIG_X86_PAT): Y, STDCONFIG_X86_UMIP): Y
CONFIG_X86_KERNEL_IBT): N, SEC
CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS): Y, STD
CONFIG_X86_USER_SHADOW_STACK): N, SEC
CONFIG_EFI): Y, STDCONFIG_EFI_STUB): N, only if you boot
kernel directly
CONFIG_EFI_HANDOVER_PROTOCOL): N,
OLD
CONFIG_EFI_MIXED): N, only
relevant (but still unneeded) on Apple hardware
CONFIG_EFI_FAKE_MEMMAP): N
CONFIG_EFI_RUNTIME_MAP): N
CONFIG_PHYSICAL_START): 0x1000000
CONFIG_RELOCATABLE): Y, STD
CONFIG_RANDOMIZE_BASE): Y, SEC
CONFIG_PHYSICAL_ALIGN): 0x200000
CONFIG_RANDOMIZE_BASE): Y, SEC
CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING): 0x00
CONFIG_ADDRESS_MASKING):
N
CONFIG_CMDLINE_BOOL): N,
unless booting kernel directly
CONFIG_MODIFY_LDT_SYSCALL): N, EMB
CONFIG_STRICT_SIGALSTACK_SIZE): N, DEV
CONFIG_PAGE_TABLE_ISOLATION): Y
CONFIG_RETPOLINE): Y
CONFIG_RETHUNK): YCONFIG_CPU_UNRET_ENTRY): Y
CONFIG_CALL_DEPTH_TRACKING): Y
CONFIG_CALL_RETHUNKS_DEBUG): N, DEV
CONFIG_CPU_IBPB_ENTRY): Y
CONFIG_CPU_IBRS_ENTRY): Y
CONFIG_CPU_SRSO): Y,
on AMD processors
CONFIG_SLS): NCONFIG_GDS_FORCE_MITIGATION): N
CONFIG_SUSPEND): Y, N for
servers
CONFIG_SUSPEND_SKIP_SYNC): N
CONFIG_HIBERNATION):
Y, if desired. N for servers
CONFIG_PM_SLEEP): N, EMBCONFIG_PM_USERSPACE_AUTOSLEEP): N, EMB
CONFIG_PM_WAKELOCKS): N, EMB
CONFIG_PM):
Y, STD
CONFIG_PM_DEBUG): N, DEV
CONFIG_WQ_POWER_EFFICIENT_DEFAULT): N
CONFIG_ENERGY_MODEL):
N
CONFIG_ACPI): Y, STD
CONFIG_ACPI_DEBUGGER): N DEV
CONFIG_ACPI_SPCR_TABLE): N, DEV
CONFIG_ACPI_FPDT): Y, STD
CONFIG_ACPI_REV_OVERRIDE_POSSIBLE): N
CONFIG_ACPI_EC_DEBUGFS): N, DEV
CONFIG_ACPI_AC): Y, if presentCONFIG_ACPI_BATTERY): Y, on laptopsCONFIG_ACPI_BUTTON): YCONFIG_ACPI_VIDEO): YCONFIG_ACPI_FAN): YCONFIG_ACPI_TAD): Y
CONFIG_ACPI_DOCK): Y, if using docking station
CONFIG_ACPI_PROCESSOR): YCONFIG_ACPI_PROCESSOR_AGGREGATOR): Y
CONFIG_ACPI_THERMAL): YCONFIG_ACPI_CUSTOM_DSDT_FILE): empty
CONFIG_ACPI_DEBUG): N, DEVCONFIG_ACPI_PCI_SLOT): N,
DEV
CONFIG_ACPI_CONTAINER):
Y
CONFIG_ACPI_SBS): Y, on laptops
CONFIG_ACPI_HED): YCONFIG_ACPI_BGRT): N
CONFIG_ACPI_REDUCED_HARDWWARE_ONLY): N
CONFIG_ACPI_APEI): Y
CONFIG_ACPI_APEI_GHES): Y
CONFIG_ACPI_APEI_ERST_DEBUG): N, DEV
CONFIG_ACPI_DPTF): Y, on Intel processors
CONFIG_ACPI_CONFIGFS): N
CONFIG_ACPI_PFRUT): N
CONFIG_ACPI_PCC): Y, STD, for
UEFI
CONFIG_ACPI_FFH): NCONFIG_PMIC_OPREGION): N
CONFIG_ACPI_PRMT): Y
CONFIG_X86_PM_TIMER): Y,
STD
CONFIG_CPU_FREQ_STAT): N, DEV
CONFIG_CPU_FREQ_GOV_PERFORMANCE): Y
CONFIG_CPU_FREQ_GOV_POWERSAVE):
N, not strictly necessary
CONFIG_CPU_FREQ_GOV_USERSPACE): N, not strictly
necessary
CONFIG_CPU_FREQ_GOV_ONDEMAND): N
CONFIG_CPU_FREQ_GOV_CONSERVATIVE): N
CONFIG_CPU_FREQ_GOV_SCHEDUTIL): Y
CONFIG_X86_INTEL_PSTATE): Y,
on Intel processors
CONFIG_X86_PCC_CPUFREQ): N, OLD
CONFIG_X86_AMD_PSTATE):
Y, on AMD processors
CONFIG_X86_AMD_PSTATE_UT): N, DEV
CONFIG_X86_ACPI_CPUFREQ): Y, STD
CONFIG_X86_SPEEDSTEP_CENTRINO): N, OLD
CONFIG_X86_P4_CLOCKMOD): N, OLD
CONFIG_CPU_IDLE): Y, STDCPU_IDLE_GOV_LADDER): N
CPU_IDLE_GOV_MENU): Y
CONFIG_CPU_IDLE_GOV_TEO): N
CONFIG_INTEL_IDLE):
Y, on Intel processors
PCI_MMCONFIG): Y, STD
CONFIG_PCI_CNB20LE_QUIRK): N
CONFIG_ISA_BUS): N
CONFIG_ISA_DMA_API): NCONFIG_IA32_EMULATION): N, unless using
32-bit applications
CONFIG_JUMP_LABEL):
Y
CONFIG_STATIC_KEYS_SELFTEST): N, DEV
CONFIG_STATIC_CALL_SELFTEST): N, DEV
CONFIG_SECCOMP): Y, STD
CONFIG_SECCOMP_CACHE_DEBUG): N, DEV
CONFIG_STACKPROTECTOR): Y, SEC
CONFIG_STACKPROTECTOR_STRONG): Y,
SEC
CONFIG_ARCH_MMAP_RND_BITS): 28
CONFIG_COMPAT_32BIT_TIME): Y, STD
CONFIG_VMAP_STACK): Y, SEC
CONFIG_RANDOMIZE_KSTACK_OFFSET): Y, SEC
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT): Y, SEC
CONFIG_BLOCK_LEGACY_AUTOLOAD):
N, OLD
CONFIG_BLK_DEV_BSGLIB): N, auto enabled if needed
CONFIG_BLK_DEV_INTEGRITY): N
CONFIG_BLK_DEV_WRITE_MOUNTED): Y, STD
CONFIG_BLK_DEV_ZONED): NCONFIG_BLK_DEV_THROTTLING): N, VIRT
CONFIG_BLK_WBT): Y
CONFIG_BLK_WBT_MQ):
N
CONFIG_BLK_CGROUP_IOLATENCY): N, VIRT
CONFIG_BLK_CGROUP_IOCOST): N, VIRT
CONFIG_BLK_CGROUP_IOPRIO): N, VIRT
CONFIG_BLK_SED_OPAL): N
CONFIG_BLK_INLINE_ENCRYPTION): N
CONFIG_PARTITION_ADVANCED):
Y
CONFIG_MSDOS_PARTITION): Y
CONFIG_EFI_PARTITION): Y
CONFIG_MQ_IOSCHED_DEADLINE):
N, if using cgroups
CONFIG_MQ_IOSCHED_KYBER): NCONFIG_IOSCHED_BFQ): YCONFIG_BFQ_GROUP_IOSCHED): Y, if using cgroups
CONFIG_BFQ_CGROUP_DEBUG): N,
DEV
CONFIG_BINFMT_ELF): Y, STD
CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS): Y
CONFIG_BINFMT_SCRIPT): Y, STD
CONFIG_BINFMT_MISC): N,
SEC
CONFIG_COREDUMP): YCONFIG_SWAP): Y, STD
CONFIG_SLUB_TINY): N, EMB
CONFIG_SLAB_MERGE_DEFAULT): Y
CONFIG_SLAB_FREELIST_RANDOM): Y,
SEC
CONFIG_SLAB_FREELIST_HARDENED): Y, SEC
CONFIG_SLUB_STATS): N, DEV
CONFIG_SLUB_CPU_PARTIAL):
Y, on multicore systems...
CONFIG_RANDOM_KMALLOC_CACHES): N, SEC
CONFIG_SHUFFLE_PAGE_ALLOCATOR): Y, SEC
CONFIG_COMPAT_BRK): N, OLD
CONFIG_SPARSE_VMEMMAP): Y,
STD
MEMORY_HOTPLUG): N, VIRTCONFIG_COMPACTION): Y, STD
CONFIG_PAGE_REPORTING): N, VIRTCONFIG_MIGRATION): Y, auto enabled if
needed
CONFIG_PCP_BATCH_SCALE_MAX): 5
CONFIG_KSM): N, VIRTCONFIG_DEFAULT_MMAP_ADDR): 65536
CONFIG_MEMORY_FAILURE): N, unless you have ECC memory
CONFIG_TRANSPARENT_HUGEPAGE):
N, unless you have large amounts of memory
CONFIG_CMA): NCONFIG_DEFERRED_PAGE_INIT): N
CONFIG_IDLE_PAGE_TRACKING): N
ZONE_DMA): YZONE_DMA32): YCONFIG_VM_EVENT_COUNTERS): Y
CONFIG_PERCPU_STATS): N,
DEV
CONFIG_DMAPOOL_TEST): N, DEV
MEMFD_CREATE): YCONFIG_SECRETMEM): Y
CONFIG_ANON_VMA_NAME): N, SEC
CONFIG_USERFAULTFD): N,
VIRT
CONFIG_LRU_GEN): NCONFIG_DAMON): N
CONFIG_PACKET): Y, STDCONFIG_PACKET_DIAG): Y, STD
CONFIG_UNIX): YCONFIG_UNIX_DIAG)
CONFIG_TLS): NCONFIG_XFRM_USER): N, not strictly necessary
CONFIG_XFRM_INTERFACE):
N
CONFIG_XFRM_SUB_POLICY): N, DEV
CONFIG_XFRM_MIGRATE): N,
unless on mobile
CONFIG_XFRM_STATISTICS):N, DEV
CONFIG_NET_KEY): NCONFIG_INET): Y, STDCONFIG_IP_MULTICAST): NCONFIG_IP_ADVANCED_ROUTER): N,
unless acting as router
CONFIG_IP_PNP): N,
unless using PXE
CONFIG_INET_IPIP): NCONFIG_NET_IPGRE_DEMUX): NCONFIG_SYN_COOKIES): N, SEC
CONFIG_NET_IPVTI): N
CONFIG_NET_FOU): N
CONFIG_NET_FOU_IP_TUNNELS): N
CONFIG_INET_AH): Y, STDCONFIG_INET_ESP): Y, STDCONFIG_INET_ESP_OFFLOAD):
N
CONFIG_INET_ESPINTCP): N
CONFIG_INET_IPCOMP): NCONFIG_INET_TABLE_PERTUB_ORDER): 16
CONFIG_INET_DIAG): N
CONFIG_TCP_CONG_ADVANCED): N
CONFIG_TCP_AO): N
CONFIG_TCP_MD5SIG): N
CONFIG_IPV6): YCONFIG_IPV6_ROUTER_PREF): N
CONFIG_IPV6_OPTIMISTIC_DAD): N
CONFIG_IPV6_AH): Y, STDCONFIG_INET6_ESP): Y, STD
CONFIG_INET6_ESP_OFFLOAD): N
CONFIG_INET6_ESPINTCP): N
CONFIG_INET6_IPCOMP): N
CONFIG_IPV6_MIP6): NCONFIG_IPV6_ILA): N
CONFIG_IPV6_VTI): N
CONFIG_IPV6_SIT): Y, STD
CONFIG_IPV6_SIT_6RD): N
CONFIG_IPV6_TUNNEL):
N
CONFIG_IPV6_MULTIPLE_TABLES): N
CONFIG_IPV6_MROUTE): NCONFIG_IPV6_SEG6_LWTUNNEL): N
CONFIG_IPV6_SEG6_HMAC): N
CONFIG_IPV6_RPL_LWTUNNEL): N
CONFIG_IPV6_IOAM6_LWTUNNEL): N
CONFIG_MPTCP): NCONFIG_NETWORK_SECMARK): N, auto
enabled if needed
CONFIG_NETWORK_PHY_TIMESTAMPING): N
CONFIG_NETFILTER): Y, this is firewall
CONFIG_NETFILTER_ADVANCED): Y
CONFIG_NETFILTER_INGRESS):
Y
CONFIG_NETFILTER_EGRESS): Y
CONFIG_NETFILTER_NETLINK_OSF): Y
CONFIG_NF_LOG_SYSLOG): Y
CONFIG_NETFILTER_XTABLES):
Y
CONFIG_NETFILTER_XT_MARK): Y
CONFIG_IP_SET): NCONFIG_IP_VS): NCONFIG_NF_SOCKET_IPV4): Y
NF_TPROXY_IPV4): YCONFIG_NF_DUP_IPV4): Y
CONFIG_NF_LOG_ARP): YCONFIG_NF_LOG_IPV4): YNF_REJECT_IPV4): YCONFIG_IP_NF_IPTABLES): NCONFIG_IP_NF_ARPTABLES): NCONFIG_NF_SOCKET_IPV6): Y
NF_TPROXY_IPV6): YCONFIG_NF_DUP_IPV6): Y
NF_REJECT_IPV6): YCONFIG_NF_LOG_IPV6): YCONFIG_IP6_NF_IPTABLES): NCONFIG_IP_DCCP): NCONFIG_IP_SCTP): N, used by Telcos
CONFIG_RDS): N
CONFIG_TIPC): NCONFIG_ATM): N, used by
DSL modems
CONFIG_L2TP): N,
unless using a VPN
CONFIG_BRIDGE): N, VIRTCONFIG_NET_DSA): N
CONFIG_VLAN_8021Q): NCONFIG_LLC2): N
CONFIG_ATALK): N, OLDCONFIG_X25): NCONFIG_LAPB): NCONFIG_PHONET): NCONFIG_6LOWPAN): NCONFIG_IEEE802154): N
CONFIG_NET_SCHED): YCONFIG_DCB): NCONFIG_DNS_RESOLVER): NCONFIG_BATMAN_ADV): N
CONFIG_OPENVSWITCH): NCONFIG_VSOCKETS): N, VIRTCONFIG_NETLINK_DIAG): N
CONFIG_MPLS): NCONFIG_NET_NSH): N
CONFIG_HSR): N
CONFIG_NET_SWITCHDEV): N
CONFIG_NET_L3_MASTER_DEV): N
CONFIG_QRTR): NCONFIG_NET_NCSI): NCONFIG_PCPU_DEV_REFCNT): Y
CONFIG_MAX_SKB_FRAGS): 17
CONFIG_CGROUP_NET_PRIO): N
CONFIG_CGROUP_NET_CLASSID): N
CONIG_HAMRADIO): NCONFIG_CAN): N, used in vehicles
CONFIG_BT): Y, if desired
CONFIG_BT_BREDR): Y
CONFIG_BT_RFCOMM): YCONFIG_BT_RFCOMM_TTY): NCONFIG_BT_BNEP): NCONFIG_BT_HIDP): Y, for input
devices
CONFIG_BT_HS): Y
CONFIG_BT_LE): Y
CONFIG_BT_LE_L2CAP_ECRED): Y
CONFIG_BT_LEDS): NCONFIG_BT_MSFTEXT): NCONFIG_BT_AOSPEXT): N
CONFIG_BT_SELFTEST): N,
DEV
CONFIG_BT_FEATURE_DEBUG): N, DEV
CONFIG_BT_HCIBTUSB): Y, most bt cards
are attached via usb
CONFIG_BT_HCIBTUSB_POLL_SYNC): Y, STD
CONFIG_AF_RXRPC): NCONFIG_AF_KCM): NCONFIG_MCTP): NWIRELESS): Y, if neededCONFIG_CFG80211):
Y, STD
CONFIG_NL80211_TESTMODE): N,
DEV
CONFIG_CFG80211_DEVELOPER_WARNINGS): N, DEV
CONFIG_CFG80211_CERTIFICATION_ONUS): N
CONFIG_CFG80211_DEFAULT_PS):
Y
CONFIG_CFG80211_CRDA_SUPPORT): YCONFIG_CFG80211_WEXT): N
CONFIG_MAC80211): Y, STD
CONFIG_MAC80211_RC_MINSTREL): YCONFIG_MAC80211_MESH): N, OLD
CONFIG_MAC80211_LEDS): NCONFIG_MAC80211_MESSAGE_TRACING): N, DEV
CONFIG_MAC80211_DEBUG_MENU): N, DEV
CONFIG_RFKILL): N, may be
needed for some network/bt cards
CONFIG_NET_9P):
N, VIRT
CONFIG_CAIF): NCONFIG_CEPH_LIB): NCONFIG_NFC): N, EMBCONFIG_PSAMPLE): NCONFIG_NET_IFE):
N
CONFIG_LWTUNNEL): NCONFIG_FAILOVER): N, VIRTCONFIG_ETHTOOL_NETLINK): N
CONFIG_VALIDATE_FS_PARSER): N
CONFIG_EXT2_FS): N, covered
by ext4
CONFIG_EXT3_FS): N,
covered by ext4
CONFIG_EXT4_FS): Y,
assuming ext4 is used
CONFIG_EXT4_USE_FOR_EXT2): Y, STD
CONFIG_EXT4_FS_POSIX_ACL): N
CONFIG_EXT4_FS_SECURITY): Y, SEC
CONFIG_EXT4_DEBUG): N, DEVCONFIG_JBD2_DEBUG): N, DEV
CONFIG_REISERFS_FS): N, OLDCONFIG_JFS_FS): NCONFIG_XFS_FS): N, for server
CONFIG_GFS2_FS): NCONFIG_BTRFS_FS): N,
unreliable...
CONFIG_NILFS2_FS): NCONFIG_F2FS_FS): NCONFIG_BCACHEFS_FS): N
CONFIG_EXPORTFS_BLOCK_OPS): N
CONFIG_FILE_LOCKING): Y
CONFIG_FS_ENCRYPTION): N
CONFIG_FS_VERITY): N
CONFIG_DNOTIFY): Y, STDCONFIG_INOTIFY_USER): Y,
STD
CONFIG_FANOTIFY): Y,
STD
CONFIG_QUOTA): NCONFIG_AUTOFS_FS): Y, if
using systemd
CONFIG_FUSE_FS):
Y
CONFIG_CUSE): N
CONFIG_VIRTIO_FS): N, VIRTCONFIG_OVERLAY_FS): NCONFIG_ISO9660_FS):
N, unless you intend to mount ISO images
CONFIG_UDF_FS): N, unless DVD
hardware is present
CONFIG_MSDOS_FS): N, OLDCONFIG_VFAT_FS): Y,
commonly used by USB storage
CONFIG_FAT_DEFAULT_CODEPAGE):
437, unless in Russia/Asia
CONFIG_FAT_DEFAULT_IOCHARSET): ios8859-1
CONFIG_FAT_DEFAULT_UTF8): N
CONFIG_EXFAT_FS): NCONFIG_NTFS_FS): N, Windows
disks
CONFIG_NTFS_DEBUG): N, DEV
CONFIG_NTFS_RW): NCONFIG_NTFS3_FS):
N
CONFIG_PROC_FS): Y, STD
CONFIG_PROC_KCORE): N, SECCONFIG_PROC_SYSCTL): Y
CONFIG_PROC_PAGE_MONITOR): Y
CONFIG_SYSFS): YCONFIG_TMPFS): Y, STD
CONFIG_TMPFS_POSIX_ACL): Y
CONFIG_TMPFS_XATTR): Y, STD
CONFIG_TMPFS_INODE64): N
CONFIG_TMPFS_QUOTA): NCONFIG_HUGETLBFS): N,
irrelevant due to THP
CONFIG_CONFIGFS_FS): N
CONFIG_EFIVAR_FS): Y, STD
CONFIG_MISC_FILESYSTEMS): N
CONFIG_NETWORK_FILESYSTEMS): N,
unless needed
CONFIG_NLS): YCONFIG_NLS_DEFAULT): utf8CONFIG_NLS_CODEPAGE_437): Y
CONFIG_NLS_ASCII): YCONFIG_NLS_UTF8): YCONFIG_UNICODE): N
CONFIG_KEYS): Y
CONFIG_KEYS_REQUEST_CACHE): N
CONFIG_PERSISTENT_KEYRINGS): N
CONFIG_TRUSTED_KEYS): N, SECCONFIG_ENCRYPTED_KEYS): N, SECCONFIG_KEY_DH_OPERATIONS): N
CONFIG_SECURITY_DMESG_RESTRICT): N, unless you limit
dmesg access
CONFIG_SECURITY): N,
SEC
CONFIG_SECURITYFS): N
CONFIG_INTEL_TXT): N
CONFIG_HARDENED_USERCOPY): Y, SEC
CONFIG_FORTIFY_SOURCE): Y, SEC
CONFIG_STATIC_USERMODEHELPER): N
DEFAULT_SECURITY_DAC)
LSM):
yama,loadpin,safesetid,integrity
CONFIG_LIST_HARDENED): Y
CONFIG_BUG_ON_DATA_CORRUPTION): Y
RANDSTRUCT_NONE)
CONFIG_CRYPTO_MANAGER): Y, STD
CONFIG_CRYPTO_USER): N
CONFIG_CRYPTO_MANAGER_DISABLE_TESTS): Y
CONFIG_CRYPTO_NULL): YCONFIG_CRYPTO_PCRYPT): NCONFIG_CRYPTO_CRYPTD): N
CONFIG_CRYPTO_AUTHENC): YCONFIG_CRYPTO_TEST): N, DEVCONFIG_CRYPTO_RSA): Y, STD
CONFIG_CRYPTO_DH): NCONFIG_CRYPTO_ECDH): Y
CONFIG_CRYPTO_ECDSA): N
CONFIG_CRYPTO_ECRDSA): N
CONFIG_CRYPTO_SM2): NCONFIG_CRYPTO_CURVE25519): NCONFIG_CRYPTO_AES):
Y, STD
CONFIG_CRYPTO_AES_TI): N
CONFIG_CRYPTO_ARIA): NCONFIG_CRYPTO_BLOWFISH): NCONFIG_CRYPTO_CAMELLIA): NCONFIG_CRYPTO_CAST5): NCONFIG_CRYPTO_CAST6): NCONFIG_CRYPTO_DES): NCONFIG_CRYPTO_FCRYPT): NCONFIG_CRYPTO_SEPRENT): NCONFIG_CRYPTO_SM4_GENERIC): NCONFIG_CRYPTO_TWOFISH): NCONFIG_CRYPTO_ADIANTUM): NCONFIG_CRYPTO_CHACHA20): NCONFIG_CRYPTO_CBC): Y, STD
CONFIG_CRYPTO_CTR): Y, STDCONFIG_CRYPTO_CTS): N
CONFIG_CRYPTO_ECB): Y, STD
CONFIG_CRYPTO_HCTR2): NCONFIG_CRYPTO_KEYWRAP): NCONFIG_CRYPTO_PCBC): N
CONFIG_CRYPTO_XTS): N
CONFIG_CRYPTO_AEGIS128): NCONFIG_CRYPTO_CHACHA20POLY1305): N
CONFIG_CRYPTO_CCM): Y
CONFIG_CRYPTO_GCM): Y
CONFIG_CRYPTO_SEQIV): Y
CONFIG_CRYPTO_ECHAINIV):
Y
CONFIG_CRYPTO_ESSIV): N
CONFIG_CRYPTO_BLAKE2B): N, unless using btrfs
CONFIG_CRYPTO_CMAC): YCONFIG_CRYPTO_GHASH): YCONFIG_CRYPTO_HMAC): YCONFIG_CRYPTO_MD4): N, OLDCONFIG_CRYPTO_MD5): YCONFIG_CRYPTO_MICHAEL_MIC): NCONFIG_CRYPTO_POLY1305): NCONFIG_CRYPTO_RMD160): NCONFIG_CRYPTO_SHA1): NCONFIG_CRYPTO_SHA256): YCONFIG_CRYPTO_SHA512): YCONFIG_CRYPTO_SHA3): YCONFIG_CRYPTO_SM3_GENERIC): NCONFIG_CRYPTO_STREEBOG): NCONFIG_CRYPTO_VMAC): NCONFIG_CRYPTO_WP512): NCONFIG_CRYPTO_XCBC): N
CONFIG_CRYPTO_XXHASH): N, unless using btrfs
CONFIG_CRYPTO_CRC32C): Y, used by many
filesystems
CONFIG_CRYPTO_CRC32): NCONFIG_CRYPTO_CRCT10DIF): NCONFIG_CRYPTO_CRC64_ROCKSOFT): Y
CONFIG_CRYPTO_DEFLATE): NCONFIG_CRYPTO_LZO): NCONFIG_CRYPTO_842): NCONFIG_CRYPTO_LZ4): NCONFIG_CRYPTO_LZ4HC): NCONFIG_CRYPTO_ZSTD): YCONFIG_CRYPTO_ANSI_CPRNG): N
CONFIG_CRYPTO_DRBG_MENU): Y
CONFIG_CRYPTO_JITTERENTROPY): Y
CONFIG_CRYPTO_HW): N, unless
present
CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE): Y
CONFIG_X509_CERTIFICATE_PARSER): Y
CONFIG_PKCS8_PRIVATE_KEY_PARSER): N
CONFIG_PKCS7_MESSAGE_PARSER): Y
CONFIG_PKCS7_TEST_KEY): N
CONFG_SIGNED_PE_FILE_VERIFICATION): N
CONFIG_FIPS_SIGNATURE_SELFTEST): N
CONFIG_SYSTEM_TRUSTED_KEYRING): Y
CONFIG_SYSTEM_TRUSTED_KEYS): N
CONFIG_SYSTEM_EXTRA_CERTIFICATE): N
CONFIG_SECONDARY_TRUSTED_KEYRING): N
CONFIG_SYSTEM_BLACKLIST_KEYRING): N
CONFIG_CORDIC): YCONFIG_CRC16): YCONFIG_CRC64_ROCKSOFT): Y
CONFIG_CRC32): YCONFIG_CRC64): YCONFIG_PRINTK_TIME): Y
CONFIG_PRINTK_CALLER): N
CONFIG_STACKTRACE_BUILD_ID): N
CONFIG_CONSOLE_LOGLEVEL_DEFAULT): 7, can be lowered to
silence chatty programs
CONFIG_CONSOLE_LOGLEVEL_QUIET): 4
CONFIG_MESSAGE_LOGLEVEL_DEFAULT): 4
CONFIG_BOOT_PRINTK_DELAY): N, unless slow booting
system
CONFIG_DYNAMIC_DEBUG):
N
CONFIG_DYNAMIC_DEBUG_CORE): N
CONFIG_SYMBOLIC_ERRNAME): Y
CONFIG_DEBUG_BUGVERBOSE): N
CONFIG_DEBUG_KERNEL): YCONFIG_DEBUG_MISC): NCONFIG_DEBUG_INFO_NONE)
CONFIG_FRAME_WARN):
2048
CONFIG_STRIP_ASM_SYMS): N
CONFIG_HEADERS_INSTALL): N
CONFIG_SECTION_MISMATCH_WARN_ONLY): Y
CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B): N
CONFIG_VMLINUX_MAP): N
CONFIG_DEBUG_FORCE_WEAK_PER_CPU): N
CONFIG_PAGE_EXTENSION): N
CONFIG_DEBUG_PAGEALLOC):
N
CONFIG_SLUB_DEBUG): N
CONFIG_PAGE_OWNER): NCONFIG_PAGE_TABLE_CHECK): N
CONFIG_PAGE_POISONING): N
CONFIG_DEBUG_RODATA_TEST): N
CONFIG_DEBUG_WX): Y
CONFIG_DEBUG_KMEMLEAK): N
CONFIG_PER_VMA_LOCK_STATS): N
CONFIG_DEBUG_OBJECTS): N
CONFIG_DEBUG_STACK_USAGE): N
CONFIG_SCHED_STACK_END_CHECK): N
CONFIG_DEBUG_VM): NCONFIG_DEBUG_VM_PGTABLE): N
CONFIG_DEBUG_VIRTUAL): NCONFIG_DEBUG_MEMORY_INIT):
N
CONFIG_DEBUG_PER_CPU_MAPS): N
CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP): N
CONFIG_KASAN): N
CONFIG_KFENCE): N
CONFIG_KMSAN): N
CONFIG_DEBUG_SHIRQ): NCONFIG_PANIC_ON_OOPS): Y, SECCONFIG_PANIC_TIMEOUT): -1, SECCONFIG_SOFTLOCKUP_DETECTOR): N
CONFIG_HARDLOCKUP_DETECTOR): N
CONFIG_DETECT_HUNG_TASKS): NCONFIG_WQ_WATCHDOG): NCONFIG_WQ_CPU_INTENSIVE_REPORT): N
CONFIG_DEBUG_TIMEKEEPING): N
CONFIG_DEBUG_PREEMPT): NCONFIG_NMI_CHECK_CPU): N
CONFIG_DEBUG_IRQFLAGS): N
CONFIG_STACKTRACE): Y, SEC
CONFIG_WARN_ALL_UNSEEDED_RANDOM): N
CONFIG_DEBUG_KOBJECT): NCONFIG_DEBUG_LIST): Y,
SEC
CONFIG_DEBUG_PLIST): Y, SEC
CONFIG_DEBUG_SG): NCONFIG_DEBUG_NOTIFIERS): Y,
SEC
CONFIG_DEBUG_MAPLE_TREE): NCONFIG_DEBUG_WQ_FORCE_RR_CPU): N
CONFIG_CPU_HOTPLUG_STATE_CONTROL): N
CONFIG_LATENCYTOP): N
CONFIG_FTRACE): NCONFIG_PROVIDE_OHCI1394_DMA_INIT): N
CONFIG_SAMPLES): NCONFIG_X86_VERBOSE_BOOTUP): Y
CONFIG_EARLY_PRINTK): NCONFIG_EFI_PGT_DUMP): NCONFIG_DEBUG_TLBFLUSH): N
CONFIG_X86_DECODER_SELFTEST): N
CONFIG_IO_DELAY_0X80)
CONFIG_CPA_DEBUG): NCONFIG_DEBUG_ENTRY): N
CONFIG_DEBUG_NMI_SELFTEST): NCONFIG_X86_DEBUG_FPU): NCONFIG_PUNIT_ATOM_DEBUG): N
CONFIG_UNWINDER_ORC)