source: chapter10/kernel.xml@ 098f4de

11.2 11.3 11.3-rc1 12.0 12.0-rc1 12.1 12.1-rc1 bdubbs/gcc13 multilib renodr/libudev-from-systemd trunk xry111/arm64 xry111/arm64-12.0 xry111/clfs-ng xry111/loongarch xry111/loongarch-12.0 xry111/loongarch-12.1 xry111/mips64el xry111/pip3 xry111/rust-wip-20221008 xry111/update-glibc
Last change on this file since 098f4de was 098f4de, checked in by Xi Ruoyao <xry111@…>, 20 months ago

linux kernel: disable CONFIG_USERFAULTFD to avoid CVE-2022-2590 for now
  • Property mode set to 100644
File size: 19.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../general.ent">
5 %general-entities;
6]>
7
8<sect1 id="ch-bootable-kernel" role="wrap">
9 <?dbhtml filename="kernel.html"?>
10
11 <sect1info condition="script">
12 <productname>kernel</productname>
13 <productnumber>&linux-version;</productnumber>
14 <address>&linux-url;</address>
15 </sect1info>
16
17 <title>Linux-&linux-version;</title>
18
19 <indexterm zone="ch-bootable-kernel">
20 <primary sortas="a-Linux">Linux</primary>
21 </indexterm>
22
23 <sect2 role="package">
24 <title/>
25
26 <para>The Linux package contains the Linux kernel.</para>
27
28 <segmentedlist>
29 <segtitle>&buildtime;</segtitle>
30 <segtitle>&diskspace;</segtitle>
31
32 <seglistitem>
33 <seg>&linux-knl-sbu;</seg>
34 <seg>&linux-knl-du;</seg>
35 </seglistitem>
36 </segmentedlist>
37
38 </sect2>
39
40 <sect2 role="installation">
41 <title>Installation of the kernel</title>
42
43 <para>Building the kernel involves a few steps&mdash;configuration,
44 compilation, and installation. Read the <filename>README</filename> file
45 in the kernel source tree for alternative methods to the way this book
46 configures the kernel.</para>
47
48 <para>Prepare for compilation by running the following command:</para>
49
50<screen><userinput remap="pre">make mrproper</userinput></screen>
51
52 <para>This ensures that the kernel tree is absolutely clean. The
53 kernel team recommends that this command be issued prior to each
54 kernel compilation. Do not rely on the source tree being clean after
55 un-tarring.</para>
56
57 <para>There are several ways to configure the kernel options. Usually,
58 This is done through a menu-driven interface, for example:</para>
59
60<screen role="nodump"><userinput>make menuconfig</userinput></screen>
61
62 <variablelist>
63 <title>The meaning of optional make environment variables:</title>
64
65 <varlistentry>
66 <term><parameter>LANG=&lt;host_LANG_value&gt; LC_ALL=</parameter></term>
67 <listitem>
68 <para>This establishes the locale setting to the one used on the
69 host. This may be needed for a proper menuconfig ncurses interface
70 line drawing on a UTF-8 linux text console.</para>
71
72 <para>If used, be sure to replace
73 <replaceable>&lt;host_LANG_value&gt;</replaceable> by the value of
74 the <envar>$LANG</envar> variable from your host. You can
75 alternatively use instead the host's value of <envar>$LC_ALL</envar>
76 or <envar>$LC_CTYPE</envar>.</para>
77 </listitem>
78 </varlistentry>
79
80 <varlistentry>
81 <term><command>make menuconfig</command></term>
82 <listitem>
83 <para>This launches an ncurses menu-driven interface. For other
84 (graphical) interfaces, type <command>make help</command>.</para>
85 </listitem>
86 </varlistentry>
87 </variablelist>
88
89 <!-- Support for compiling a keymap into the kernel is deliberately removed -->
90
91 <para>For general information on kernel configuration see <ulink
92 url="&hints-root;kernel-configuration.txt"/>. BLFS has some information
93 regarding particular kernel configuration requirements of packages outside
94 of LFS at <ulink
95 url="&blfs-book;longindex.html#kernel-config-index"/>. Additional
96 information about configuring and building the kernel can be found at
97 <ulink url="http://www.kroah.com/lkn/"/> </para>
98
99 <note>
100 <para>A good starting place for setting up the kernel configuration is to
101 run <command>make defconfig</command>. This will set the base
102 configuration to a good state that takes your current system architecture
103 into account.</para>
104
105 <para>Be sure to enable/disable/set the following features or the system might
106 not work correctly or boot at all:</para>
107
108 <screen role="nodump" revision="sysv">General setup -->
109 [ ] Compile the kernel with warnings as errors [CONFIG_WERROR]
110 &lt; &gt; Enable kernel headers through /sys/kernel/kheaders.tar.xz [CONFIG_IKHEADERS]
111Device Drivers ---&gt;
112 Graphics support ---&gt;
113 Frame buffer Devices ---&gt;
114 [*] Support for frame buffer devices ----
115 Generic Driver Options ---&gt;
116 [ ] Support for uevent helper [CONFIG_UEVENT_HELPER]
117 [*] Maintain a devtmpfs filesystem to mount at /dev [CONFIG_DEVTMPFS]
118 [*] Automount devtmpfs at /dev, after the kernel mounted the rootfs [CONFIG_DEVTMPFS_MOUNT]</screen>
119
120 <screen role="nodump" revision="systemd">General setup -->
121 [ ] Compile the kernel with warnings as errors [CONFIG_WERROR]
122 [ ] Auditing Support [CONFIG_AUDIT]
123 CPU/Task time and stats accounting ---&gt;
124 [*] Pressure stall information tracking [CONFIG_PSI]
125 &lt; &gt; Enable kernel headers through /sys/kernel/kheaders.tar.xz [CONFIG_IKHEADERS]
126 [*] Control Group support [CONFIG_CGROUPS] ---&gt;
127 [*] Memory controller [CONFIG_MEMCG]
128 [ ] Enable deprecated sysfs features to support old userspace tools [CONFIG_SYSFS_DEPRECATED]
129 [*] Configure standard kernel features (expert users) [CONFIG_EXPERT] ---&gt;
130 [*] open by fhandle syscalls [CONFIG_FHANDLE]
131General architecture-dependent options ---&gt;
132 [*] Enable seccomp to safely compute untrusted bytecode [CONFIG_SECCOMP]
133Networking support ---&gt;
134 Networking options ---&gt;
135 &lt;*&gt; The IPv6 protocol [CONFIG_IPV6]
136Device Drivers ---&gt;
137 Generic Driver Options ---&gt;
138 [ ] Support for uevent helper [CONFIG_UEVENT_HELPER]
139 [*] Maintain a devtmpfs filesystem to mount at /dev [CONFIG_DEVTMPFS]
140 [*] Automount devtmpfs at /dev, after the kernel mounted the rootfs [CONFIG_DEVTMPFS_MOUNT]
141 Firmware Loader ---&gt;
142 [ ] Enable the firmware sysfs fallback mechanism [CONFIG_FW_LOADER_USER_HELPER]
143 Firmware Drivers ---&gt;
144 [*] Export DMI identification via sysfs to userspace [CONFIG_DMIID]
145 Graphics support ---&gt;
146 Frame buffer Devices ---&gt;
147 &lt;*&gt; Support for frame buffer devices ---&gt;
148File systems ---&gt;
149 [*] Inotify support for userspace [CONFIG_INOTIFY_USER]
150 Pseudo filesystems ---&gt;
151 [*] Tmpfs POSIX Access Control Lists [CONFIG_TMPFS_POSIX_ACL]</screen>
152
153 <para>Enable some additional features if you are building a 64-bit
154 system. If you are using menuconfig, enable them in the order of
155 <parameter>CONFIG_PCI_MSI</parameter> first, then
156 <parameter>CONFIG_IRQ_REMAP</parameter>, at last
157 <parameter>CONFIG_X86_X2APIC</parameter> because an option only
158 shows up after its dependencies are selected.</para>
159
160 <screen role="nodump">Processor type and features ---&gt;
161 [*] Support x2apic [CONFIG_X86_X2APIC]
162Memory Management options ---&gt;
163 [ ] Enable userfaultfd() system call [CONFIG_USERFAULTFD]
164Device Drivers ---&gt;
165 [*] PCI Support ---&gt; [CONFIG_PCI]
166 [*] Message Signaled Interrupts (MSI and MSI-X) [CONFIG_PCI_MSI]
167 [*] IOMMU Hardware Support ---&gt; [CONFIG_IOMMU_SUPPORT]
168 [*] Support for Interrupt Remapping [CONFIG_IRQ_REMAP]</screen>
169 </note>
170
171 <note revision="systemd">
172 <para>While "The IPv6 Protocol" is not strictly
173 required, it is highly recommended by the systemd developers.</para>
174 </note>
175
176 <para revision="sysv">There are several other options that may be desired
177 depending on the requirements for the system. For a list of options needed
178 for BLFS packages, see the <ulink
179 url="&lfs-root;blfs/view/&short-version;/longindex.html#kernel-config-index">BLFS
180 Index of Kernel Settings</ulink>
181 (&lfs-root;blfs/view/&short-version;/longindex.html#kernel-config-index).</para>
182
183 <note>
184 <para>If your host hardware is using UEFI and you wish to boot the
185 LFS system with it, you should adjust some kernel configuration
186 following <ulink url="&blfs-book;postlfs/grub-setup.html#uefi-kernel">
187 the BLFS page</ulink>.</para>
188 </note>
189
190 <variablelist>
191 <title>The rationale for the above configuration items:</title>
192
193 <varlistentry>
194 <term>
195 <parameter>
196 Compile the kernel with warnings as errors
197 </parameter>
198 </term>
199 <listitem>
200 <para>This may cause building failure if the compiler and/or
201 configuration are different from those of the kernel
202 developers.</para>
203 </listitem>
204 </varlistentry>
205
206 <varlistentry>
207 <term>
208 <parameter>
209 Enable kernel headers through /sys/kernel/kheaders.tar.xz
210 </parameter>
211 </term>
212 <listitem>
213 <para>This will require <command>cpio</command> building the kernel.
214 <command>cpio</command> is not installed by LFS.</para>
215 </listitem>
216 </varlistentry>
217
218 <varlistentry>
219 <term><parameter>Support for uevent helper</parameter></term>
220 <listitem>
221 <para>Having this option set may interfere with device
222 management when using Udev/Eudev. </para>
223 </listitem>
224 </varlistentry>
225
226 <varlistentry>
227 <term><parameter>Maintain a devtmpfs</parameter></term>
228 <listitem>
229 <para>This will create automated device nodes which are populated by the
230 kernel, even without Udev running. Udev then runs on top of this,
231 managing permissions and adding symlinks. This configuration
232 item is required for all users of Udev/Eudev.</para>
233 </listitem>
234 </varlistentry>
235
236 <varlistentry>
237 <term><parameter>Automount devtmpfs at /dev</parameter></term>
238 <listitem>
239 <para>This will mount the kernel view of the devices on /dev
240 upon switching to root filesystem just before starting
241 init.</para>
242 </listitem>
243 </varlistentry>
244
245 <varlistentry>
246 <term><parameter>Support x2apic</parameter></term>
247 <listitem>
248 <para>Avoid a kernel panic booting on a system with x2APIC enabled
249 by the BIOS. This option does no harm if x2APIC is not enabled
250 or not available, but it's recommended to enable x2APIC in the
251 BIOS setting for a modern 64-bit x86 system.</para>
252 </listitem>
253 </varlistentry>
254
255 <varlistentry>
256 <term><parameter>Enable userfaultfd() system call</parameter></term>
257 <listitem>
258 <para>If this option is enabled, a security vulnerability not
259 resolved in Linux-&linux-version; yet will be exploitable.
260 Disable this option to avoid the vulnerability. This system call
261 is not used by any part of LFS or BLFS.</para>
262 </listitem>
263 </varlistentry>
264
265 </variablelist>
266
267 <para>Alternatively, <command>make oldconfig</command> may be more
268 appropriate in some situations. See the <filename>README</filename>
269 file for more information.</para>
270
271 <para>If desired, skip kernel configuration by copying the kernel
272 config file, <filename>.config</filename>, from the host system
273 (assuming it is available) to the unpacked <filename
274 class="directory">linux-&linux-version;</filename> directory. However,
275 we do not recommend this option. It is often better to explore all the
276 configuration menus and create the kernel configuration from
277 scratch.</para>
278
279 <para>Compile the kernel image and modules:</para>
280
281<screen><userinput remap="make">make</userinput></screen>
282
283 <para>If using kernel modules, module configuration in <filename
284 class="directory">/etc/modprobe.d</filename> may be required.
285 Information pertaining to modules and kernel configuration is
286 located in <xref linkend="ch-config-udev"/> and in the kernel
287 documentation in the <filename
288 class="directory">linux-&linux-version;/Documentation</filename> directory.
289 Also, <filename>modprobe.d(5)</filename> may be of interest.</para>
290
291 <para>Unless module support has been disabled in the kernel configuration,
292 install the modules with:</para>
293
294<screen><userinput remap="install">make modules_install</userinput></screen>
295
296 <para>After kernel compilation is complete, additional steps are
297 required to complete the installation. Some files need to be copied to
298 the <filename class="directory">/boot</filename> directory.</para>
299
300 <caution>
301 <para>If the host system has a separate /boot partition, the files copied
302 below should go there. The easiest way to do that is to bind /boot on the
303 host (outside chroot) to /mnt/lfs/boot before proceeding. As the
304 &root; user in the <emphasis>host system</emphasis>:</para>
305
306<screen role="nodump"><userinput>mount --bind /boot /mnt/lfs/boot</userinput></screen>
307 </caution>
308
309 <para>The path to the kernel image may vary depending on the platform being
310 used. The filename below can be changed to suit your taste, but the stem of
311 the filename should be <emphasis>vmlinuz</emphasis> to be compatible with
312 the automatic setup of the boot process described in the next section. The
313 following command assumes an x86 architecture:</para>
314
315<screen><userinput remap="install">cp -iv arch/x86/boot/bzImage /boot/vmlinuz-&linux-version;-lfs-&version;</userinput></screen>
316
317 <para><filename>System.map</filename> is a symbol file for the kernel.
318 It maps the function entry points of every function in the kernel API,
319 as well as the addresses of the kernel data structures for the running
320 kernel. It is used as a resource when investigating kernel problems.
321 Issue the following command to install the map file:</para>
322
323<screen><userinput remap="install">cp -iv System.map /boot/System.map-&linux-version;</userinput></screen>
324
325 <para>The kernel configuration file <filename>.config</filename>
326 produced by the <command>make menuconfig</command> step
327 above contains all the configuration selections for the kernel
328 that was just compiled. It is a good idea to keep this file for future
329 reference:</para>
330
331<screen><userinput remap="install">cp -iv .config /boot/config-&linux-version;</userinput></screen>
332
333 <para>Install the documentation for the Linux kernel:</para>
334
335<screen><userinput remap="install">install -d /usr/share/doc/linux-&linux-version;
336cp -r Documentation/* /usr/share/doc/linux-&linux-version;</userinput></screen>
337
338 <para>It is important to note that the files in the kernel source
339 directory are not owned by <emphasis>root</emphasis>. Whenever a
340 package is unpacked as user <emphasis>root</emphasis> (like we did
341 inside chroot), the files have the user and group IDs of whatever
342 they were on the packager's computer. This is usually not a problem
343 for any other package to be installed because the source tree is
344 removed after the installation. However, the Linux source tree is
345 often retained for a long time. Because of this, there is a chance
346 that whatever user ID the packager used will be assigned to somebody
347 on the machine. That person would then have write access to the kernel
348 source.</para>
349
350 <note>
351 <para>In many cases, the configuration of the kernel will need to be
352 updated for packages that will be installed later in BLFS. Unlike
353 other packages, it is not necessary to remove the kernel source tree
354 after the newly built kernel is installed.</para>
355
356 <para>If the kernel source tree is going to be retained, run
357 <command>chown -R 0:0</command> on the <filename
358 class="directory">linux-&linux-version;</filename> directory to ensure
359 all files are owned by user <emphasis>root</emphasis>.</para>
360 </note>
361
362 <warning>
363 <para>Some kernel documentation recommends creating a symlink from
364 <filename class="symlink">/usr/src/linux</filename> pointing to the kernel
365 source directory. This is specific to kernels prior to the 2.6 series and
366 <emphasis>must not</emphasis> be created on an LFS system as it can cause
367 problems for packages you may wish to build once your base LFS system is
368 complete.</para>
369 </warning>
370
371 <warning>
372 <para>The headers in the system's <filename
373 class="directory">include</filename> directory (<filename
374 class="directory">/usr/include</filename>) should
375 <emphasis>always</emphasis> be the ones against which Glibc was compiled,
376 that is, the sanitised headers installed in <xref
377 linkend="ch-tools-linux-headers"/>. Therefore, they should
378 <emphasis>never</emphasis> be replaced by either the raw kernel headers
379 or any other kernel sanitized headers.</para>
380 </warning>
381
382 </sect2>
383
384 <sect2 id="conf-modprobe" role="configuration">
385 <title>Configuring Linux Module Load Order</title>
386
387 <indexterm zone="conf-modprobe">
388 <primary sortas="e-/etc/modprobe.d/usb.conf">/etc/modprobe.d/usb.conf</primary>
389 </indexterm>
390
391 <para>Most of the time Linux modules are loaded automatically, but
392 sometimes it needs some specific direction. The program that loads
393 modules, <command>modprobe</command> or <command>insmod</command>, uses
394 <filename>/etc/modprobe.d/usb.conf</filename> for this purpose. This file
395 needs to be created so that if the USB drivers (ehci_hcd, ohci_hcd and
396 uhci_hcd) have been built as modules, they will be loaded in the correct
397 order; ehci_hcd needs to be loaded prior to ohci_hcd and uhci_hcd in order
398 to avoid a warning being output at boot time.</para>
399
400 <para>Create a new file <filename>/etc/modprobe.d/usb.conf</filename> by running
401 the following:</para>
402
403<screen><userinput>install -v -m755 -d /etc/modprobe.d
404cat &gt; /etc/modprobe.d/usb.conf &lt;&lt; "EOF"
405<literal># Begin /etc/modprobe.d/usb.conf
406
407install ohci_hcd /sbin/modprobe ehci_hcd ; /sbin/modprobe -i ohci_hcd ; true
408install uhci_hcd /sbin/modprobe ehci_hcd ; /sbin/modprobe -i uhci_hcd ; true
409
410# End /etc/modprobe.d/usb.conf</literal>
411EOF</userinput></screen>
412
413 </sect2>
414
415 <sect2 id="contents-kernel" role="content">
416 <title>Contents of Linux</title>
417
418 <segmentedlist>
419 <segtitle>Installed files</segtitle>
420 <segtitle>Installed directories</segtitle>
421
422 <seglistitem>
423 <seg>config-&linux-version;,
424 vmlinuz-&linux-version;-lfs-&version;,
425 and System.map-&linux-version;</seg>
426 <seg>/lib/modules, /usr/share/doc/linux-&linux-version;</seg>
427 </seglistitem>
428 </segmentedlist>
429
430 <variablelist>
431 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
432 <?dbfo list-presentation="list"?>
433 <?dbhtml list-presentation="table"?>
434
435 <varlistentry id="config">
436 <term><filename>config-&linux-version;</filename></term>
437 <listitem>
438 <para>Contains all the configuration selections for the kernel</para>
439 <indexterm zone="ch-bootable-kernel config">
440 <primary sortas="e-/boot/config">/boot/config-&linux-version;</primary>
441 </indexterm>
442 </listitem>
443 </varlistentry>
444
445 <varlistentry id="lfskernel">
446 <term><filename>vmlinuz-&linux-version;-lfs-&version;</filename></term>
447 <listitem>
448 <para>The engine of the Linux system. When turning on the computer,
449 the kernel is the first part of the operating system that gets loaded.
450 It detects and initializes all components of the computer's hardware,
451 then makes these components available as a tree of files to the
452 software and turns a single CPU into a multitasking machine capable
453 of running scores of programs seemingly at the same time</para>
454 <indexterm zone="ch-bootable-kernel lfskernel">
455 <primary sortas="b-lfskernel">lfskernel-&linux-version;</primary>
456 </indexterm>
457 </listitem>
458 </varlistentry>
459
460 <varlistentry id="System.map">
461 <term><filename>System.map-&linux-version;</filename></term>
462 <listitem>
463 <para>A list of addresses and symbols; it maps the entry points and
464 addresses of all the functions and data structures in the
465 kernel</para>
466 <indexterm zone="ch-bootable-kernel System.map">
467 <primary sortas="e-/boot/System.map">/boot/System.map-&linux-version;</primary>
468 </indexterm>
469 </listitem>
470 </varlistentry>
471
472 </variablelist>
473
474 </sect2>
475
476</sect1>
Note: See TracBrowser for help on using the repository browser.