diff options
Diffstat (limited to 'init')
| -rw-r--r-- | init/Kconfig | 74 | ||||
| -rw-r--r-- | init/do_mounts.c | 1 | ||||
| -rw-r--r-- | init/init_task.c | 11 | ||||
| -rw-r--r-- | init/initramfs.c | 153 | ||||
| -rw-r--r-- | init/main.c | 69 | ||||
| -rw-r--r-- | init/noinitramfs.c | 14 | ||||
| -rw-r--r-- | init/version.c | 1 |
7 files changed, 213 insertions, 110 deletions
diff --git a/init/Kconfig b/init/Kconfig index c9386a365eea..0e2344389501 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: GPL-2.0-only config DEFCONFIG_LIST string depends on !UML @@ -13,7 +14,7 @@ config CC_IS_GCC config GCC_VERSION int - default $(shell,$(srctree)/scripts/gcc-version.sh -p $(CC) | sed 's/^0*//') if CC_IS_GCC + default $(shell,$(srctree)/scripts/gcc-version.sh $(CC)) if CC_IS_GCC default 0 config CC_IS_CLANG @@ -26,6 +27,22 @@ config CLANG_VERSION config CC_HAS_ASM_GOTO def_bool $(success,$(srctree)/scripts/gcc-goto.sh $(CC)) +config CC_HAS_WARN_MAYBE_UNINITIALIZED + def_bool $(cc-option,-Wmaybe-uninitialized) + help + GCC >= 4.7 supports this option. + +config CC_DISABLE_WARN_MAYBE_UNINITIALIZED + bool + depends on CC_HAS_WARN_MAYBE_UNINITIALIZED + default CC_IS_GCC && GCC_VERSION < 40900 # unreliable for GCC < 4.9 + help + GCC's -Wmaybe-uninitialized is not reliable by definition. + Lots of false positive warnings are produced in some cases. + + If this option is enabled, -Wno-maybe-uninitialzed is passed + to the compiler to suppress maybe-uninitialized warnings. + config CONSTRUCTORS bool depends on !UML @@ -382,6 +399,7 @@ config VIRT_CPU_ACCOUNTING_GEN bool "Full dynticks CPU time accounting" depends on HAVE_CONTEXT_TRACKING depends on HAVE_VIRT_CPU_ACCOUNTING_GEN + depends on GENERIC_CLOCKEVENTS select VIRT_CPU_ACCOUNTING select CONTEXT_TRACKING help @@ -545,7 +563,6 @@ config BUILD_BIN2C config IKCONFIG tristate "Kernel .config support" - select BUILD_BIN2C ---help--- This option enables the complete Linux kernel ".config" file contents to be saved in the kernel. It provides documentation @@ -563,6 +580,15 @@ config IKCONFIG_PROC This option enables access to the kernel configuration file through /proc/config.gz. +config IKHEADERS + tristate "Enable kernel headers through /sys/kernel/kheaders.tar.xz" + depends on SYSFS + help + This option enables access to the in-kernel headers that are generated during + the build process. These can be used to build eBPF tracing programs, + or similar programs. If you build the headers as a module, a module called + kheaders.ko is built which can be loaded on-demand to get access to headers. + config LOG_BUF_SHIFT int "Kernel log buffer size (16 => 64KB, 17 => 128KB)" range 12 25 @@ -1113,6 +1139,7 @@ config CC_OPTIMIZE_FOR_PERFORMANCE config CC_OPTIMIZE_FOR_SIZE bool "Optimize for size" + imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives help Enabling this option will pass "-Os" instead of "-O2" to your compiler resulting in a smaller kernel. @@ -1153,9 +1180,6 @@ config LD_DEAD_CODE_DATA_ELIMINATION config SYSCTL bool -config ANON_INODES - bool - config HAVE_UID16 bool @@ -1360,14 +1384,12 @@ config HAVE_FUTEX_CMPXCHG config EPOLL bool "Enable eventpoll support" if EXPERT default y - select ANON_INODES help Disabling this option will cause the kernel to be built without support for epoll family of system calls. config SIGNALFD bool "Enable signalfd() system call" if EXPERT - select ANON_INODES default y help Enable the signalfd() system call that allows to receive signals @@ -1377,7 +1399,6 @@ config SIGNALFD config TIMERFD bool "Enable timerfd() system call" if EXPERT - select ANON_INODES default y help Enable the timerfd() system call that allows to receive timer @@ -1387,7 +1408,6 @@ config TIMERFD config EVENTFD bool "Enable eventfd() system call" if EXPERT - select ANON_INODES default y help Enable the eventfd() system call that allows to receive both @@ -1414,6 +1434,15 @@ config AIO by some high performance threaded applications. Disabling this option saves about 7k. +config IO_URING + bool "Enable IO uring support" if EXPERT + select ANON_INODES + default y + help + This option enables support for the io_uring interface, enabling + applications to submit and complete IO through submission and + completion rings that are shared between the kernel and application. + config ADVISE_SYSCALLS bool "Enable madvise/fadvise syscalls" if EXPERT default y @@ -1489,7 +1518,6 @@ config KALLSYMS_BASE_RELATIVE # syscall, maps, verifier config BPF_SYSCALL bool "Enable bpf() system call" - select ANON_INODES select BPF select IRQ_WORK default n @@ -1506,7 +1534,6 @@ config BPF_JIT_ALWAYS_ON config USERFAULTFD bool "Enable userfaultfd() system call" - select ANON_INODES depends on MMU help Enable the userfaultfd() system call that allows to intercept and @@ -1573,7 +1600,6 @@ config PERF_EVENTS bool "Kernel performance events and counters" default y if PROFILING depends on HAVE_PERF_EVENTS - select ANON_INODES select IRQ_WORK select SRCU help @@ -1726,6 +1752,30 @@ config SLAB_FREELIST_HARDENED sacrifies to harden the kernel slab allocator against common freelist exploit methods. +config SHUFFLE_PAGE_ALLOCATOR + bool "Page allocator randomization" + default SLAB_FREELIST_RANDOM && ACPI_NUMA + help + Randomization of the page allocator improves the average + utilization of a direct-mapped memory-side-cache. See section + 5.2.27 Heterogeneous Memory Attribute Table (HMAT) in the ACPI + 6.2a specification for an example of how a platform advertises + the presence of a memory-side-cache. There are also incidental + security benefits as it reduces the predictability of page + allocations to compliment SLAB_FREELIST_RANDOM, but the + default granularity of shuffling on the "MAX_ORDER - 1" i.e, + 10th order of pages is selected based on cache utilization + benefits on x86. + + While the randomization improves cache utilization it may + negatively impact workloads on platforms without a cache. For + this reason, by default, the randomization is enabled only + after runtime detection of a direct-mapped memory-side-cache. + Otherwise, the randomization may be force enabled with the + 'page_alloc.shuffle' kernel command line parameter. + + Say Y if unsure. + config SLUB_CPU_PARTIAL default y depends on SLUB && SMP diff --git a/init/do_mounts.c b/init/do_mounts.c index f8c230c77035..2d1ea3028454 100644 --- a/init/do_mounts.c +++ b/init/do_mounts.c @@ -1,3 +1,4 @@ +// SPDX-License-Identifier: GPL-2.0-only #include <linux/module.h> #include <linux/sched.h> #include <linux/ctype.h> diff --git a/init/init_task.c b/init/init_task.c index 5aebe3be4d7c..c70ef656d0f4 100644 --- a/init/init_task.c +++ b/init/init_task.c @@ -10,6 +10,7 @@ #include <linux/fs.h> #include <linux/mm.h> #include <linux/audit.h> +#include <linux/numa.h> #include <asm/pgtable.h> #include <linux/uaccess.h> @@ -44,7 +45,7 @@ static struct signal_struct init_signals = { }; static struct sighand_struct init_sighand = { - .count = ATOMIC_INIT(1), + .count = REFCOUNT_INIT(1), .action = { { { .sa_handler = SIG_DFL, } }, }, .siglock = __SPIN_LOCK_UNLOCKED(init_sighand.siglock), .signalfd_wqh = __WAIT_QUEUE_HEAD_INITIALIZER(init_sighand.signalfd_wqh), @@ -61,11 +62,11 @@ struct task_struct init_task = { #ifdef CONFIG_THREAD_INFO_IN_TASK .thread_info = INIT_THREAD_INFO(init_task), - .stack_refcount = ATOMIC_INIT(1), + .stack_refcount = REFCOUNT_INIT(1), #endif .state = 0, .stack = init_stack, - .usage = ATOMIC_INIT(2), + .usage = REFCOUNT_INIT(2), .flags = PF_KTHREAD, .prio = MAX_PRIO - 20, .static_prio = MAX_PRIO - 20, @@ -121,7 +122,7 @@ struct task_struct init_task .thread_pid = &init_struct_pid, .thread_group = LIST_HEAD_INIT(init_task.thread_group), .thread_node = LIST_HEAD_INIT(init_signals.thread_head), -#ifdef CONFIG_AUDITSYSCALL +#ifdef CONFIG_AUDIT .loginuid = INVALID_UID, .sessionid = AUDIT_SID_UNSET, #endif @@ -154,7 +155,7 @@ struct task_struct init_task .vtime.state = VTIME_SYS, #endif #ifdef CONFIG_NUMA_BALANCING - .numa_preferred_nid = -1, + .numa_preferred_nid = NUMA_NO_NODE, .numa_group = NULL, .numa_faults = NULL, #endif diff --git a/init/initramfs.c b/init/initramfs.c index fca899622937..c47dad0884f7 100644 --- a/init/initramfs.c +++ b/init/initramfs.c @@ -431,7 +431,7 @@ static long __init flush_buffer(void *bufv, unsigned long len) len -= written; state = Reset; } else - error("junk in compressed archive"); + error("junk within compressed archive"); } return origLen; } @@ -488,9 +488,9 @@ static char * __init unpack_to_rootfs(char *buf, unsigned long len) message = msg_buf; } } else - error("junk in compressed archive"); + error("invalid magic at start of compressed archive"); if (state != Reset) - error("junk in compressed archive"); + error("junk at the end of compressed archive"); this_header = saved_offset + my_inptr; buf += my_inptr; len -= my_inptr; @@ -513,42 +513,55 @@ static int __init retain_initrd_param(char *str) } __setup("retain_initrd", retain_initrd_param); +#ifdef CONFIG_ARCH_HAS_KEEPINITRD +static int __init keepinitrd_setup(char *__unused) +{ + do_retain_initrd = 1; + return 1; +} +__setup("keepinitrd", keepinitrd_setup); +#endif + extern char __initramfs_start[]; extern unsigned long __initramfs_size; #include <linux/initrd.h> #include <linux/kexec.h> -static void __init free_initrd(void) +void __weak free_initrd_mem(unsigned long start, unsigned long end) { + free_reserved_area((void *)start, (void *)end, POISON_FREE_INITMEM, + "initrd"); +} + #ifdef CONFIG_KEXEC_CORE +static bool kexec_free_initrd(void) +{ unsigned long crashk_start = (unsigned long)__va(crashk_res.start); unsigned long crashk_end = (unsigned long)__va(crashk_res.end); -#endif - if (do_retain_initrd) - goto skip; -#ifdef CONFIG_KEXEC_CORE /* * If the initrd region is overlapped with crashkernel reserved region, * free only memory that is not part of crashkernel region. */ - if (initrd_start < crashk_end && initrd_end > crashk_start) { - /* - * Initialize initrd memory region since the kexec boot does - * not do. - */ - memset((void *)initrd_start, 0, initrd_end - initrd_start); - if (initrd_start < crashk_start) - free_initrd_mem(initrd_start, crashk_start); - if (initrd_end > crashk_end) - free_initrd_mem(crashk_end, initrd_end); - } else -#endif - free_initrd_mem(initrd_start, initrd_end); -skip: - initrd_start = 0; - initrd_end = 0; + if (initrd_start >= crashk_end || initrd_end <= crashk_start) + return false; + + /* + * Initialize initrd memory region since the kexec boot does not do. + */ + memset((void *)initrd_start, 0, initrd_end - initrd_start); + if (initrd_start < crashk_start) + free_initrd_mem(initrd_start, crashk_start); + if (initrd_end > crashk_end) + free_initrd_mem(crashk_end, initrd_end); + return true; +} +#else +static inline bool kexec_free_initrd(void) +{ + return false; } +#endif /* CONFIG_KEXEC_CORE */ #ifdef CONFIG_BLK_DEV_RAM #define BUF_SIZE 1024 @@ -597,7 +610,38 @@ static void __init clean_rootfs(void) ksys_close(fd); kfree(buf); } -#endif +#else +static inline void clean_rootfs(void) +{ +} +#endif /* CONFIG_BLK_DEV_RAM */ + +#ifdef CONFIG_BLK_DEV_RAM +static void __init populate_initrd_image(char *err) +{ + ssize_t written; + int fd; + + unpack_to_rootfs(__initramfs_start, __initramfs_size); + + printk(KERN_INFO "rootfs image is not initramfs (%s); looks like an initrd\n", + err); + fd = ksys_open("/initrd.image", O_WRONLY | O_CREAT, 0700); + if (fd < 0) + return; + + written = xwrite(fd, (char *)initrd_start, initrd_end - initrd_start); + if (written != initrd_end - initrd_start) + pr_err("/initrd.image: incomplete write (%zd != %ld)\n", + written, initrd_end - initrd_start); + ksys_close(fd); +} +#else +static void __init populate_initrd_image(char *err) +{ + printk(KERN_EMERG "Initramfs unpacking failed: %s\n", err); +} +#endif /* CONFIG_BLK_DEV_RAM */ static int __init populate_rootfs(void) { @@ -605,46 +649,31 @@ static int __init populate_rootfs(void) char *err = unpack_to_rootfs(__initramfs_start, __initramfs_size); if (err) panic("%s", err); /* Failed to decompress INTERNAL initramfs */ - /* If available load the bootloader supplied initrd */ - if (initrd_start && !IS_ENABLED(CONFIG_INITRAMFS_FORCE)) { -#ifdef CONFIG_BLK_DEV_RAM - int fd; + + if (!initrd_start || IS_ENABLED(CONFIG_INITRAMFS_FORCE)) + goto done; + + if (IS_ENABLED(CONFIG_BLK_DEV_RAM)) printk(KERN_INFO "Trying to unpack rootfs image as initramfs...\n"); - err = unpack_to_rootfs((char *)initrd_start, - initrd_end - initrd_start); - if (!err) { - free_initrd(); - goto done; - } else { - clean_rootfs(); - unpack_to_rootfs(__initramfs_start, __initramfs_size); - } - printk(KERN_INFO "rootfs image is not initramfs (%s)" - "; looks like an initrd\n", err); - fd = ksys_open("/initrd.image", - O_WRONLY|O_CREAT, 0700); - if (fd >= 0) { - ssize_t written = xwrite(fd, (char *)initrd_start, - initrd_end - initrd_start); - - if (written != initrd_end - initrd_start) - pr_err("/initrd.image: incomplete write (%zd != %ld)\n", - written, initrd_end - initrd_start); - - ksys_close(fd); - free_initrd(); - } - done: - /* empty statement */; -#else + else printk(KERN_INFO "Unpacking initramfs...\n"); - err = unpack_to_rootfs((char *)initrd_start, - initrd_end - initrd_start); - if (err) - printk(KERN_EMERG "Initramfs unpacking failed: %s\n", err); - free_initrd(); -#endif + + err = unpack_to_rootfs((char *)initrd_start, initrd_end - initrd_start); + if (err) { + clean_rootfs(); + populate_initrd_image(err); } + +done: + /* + * If the initrd region is overlapped with crashkernel reserved region, + * free only memory that is not part of crashkernel region. + */ + if (!do_retain_initrd && initrd_start && !kexec_free_initrd()) + free_initrd_mem(initrd_start, initrd_end); + initrd_start = 0; + initrd_end = 0; + flush_delayed_fput(); return 0; } diff --git a/init/main.c b/init/main.c index c86a1c8f19f4..66a196c5e4c3 100644 --- a/init/main.c +++ b/init/main.c @@ -1,3 +1,4 @@ +// SPDX-License-Identifier: GPL-2.0-only /* * linux/init/main.c * @@ -373,12 +374,20 @@ static inline void smp_prepare_cpus(unsigned int maxcpus) { } */ static void __init setup_command_line(char *command_line) { - saved_command_line = - memblock_alloc(strlen(boot_command_line) + 1, SMP_CACHE_BYTES); - initcall_command_line = - memblock_alloc(strlen(boot_command_line) + 1, SMP_CACHE_BYTES); - static_command_line = memblock_alloc(strlen(command_line) + 1, - SMP_CACHE_BYTES); + size_t len = strlen(boot_command_line) + 1; + + saved_command_line = memblock_alloc(len, SMP_CACHE_BYTES); + if (!saved_command_line) + panic("%s: Failed to allocate %zu bytes\n", __func__, len); + + initcall_command_line = memblock_alloc(len, SMP_CACHE_BYTES); + if (!initcall_command_line) + panic("%s: Failed to allocate %zu bytes\n", __func__, len); + + static_command_line = memblock_alloc(len, SMP_CACHE_BYTES); + if (!static_command_line) + panic("%s: Failed to allocate %zu bytes\n", __func__, len); + strcpy(saved_command_line, boot_command_line); strcpy(static_command_line, command_line); } @@ -496,6 +505,10 @@ void __init __weak thread_stack_cache_init(void) void __init __weak mem_encrypt_init(void) { } +void __init __weak poking_init(void) { } + +void __init __weak pgd_cache_init(void) { } + bool initcall_debug; core_param(initcall_debug, initcall_debug, bool, 0644); @@ -527,6 +540,7 @@ static void __init mm_init(void) init_espfix_bsp(); /* Should be run after espfix64 is set up. */ pti_init(); + pgd_cache_init(); } void __init __weak arch_call_rest_init(void) @@ -556,13 +570,6 @@ asmlinkage __visible void __init start_kernel(void) page_address_init(); pr_notice("%s", linux_banner); setup_arch(&command_line); - /* - * Set up the the initial canary and entropy after arch - * and after adding latent and command line entropy. - */ - add_latent_entropy(); - add_device_randomness(command_line, strlen(command_line)); - boot_init_stack_canary(); mm_init_cpumask(&init_mm); setup_command_line(command_line); setup_nr_cpu_ids(); @@ -574,6 +581,8 @@ asmlinkage __visible void __init start_kernel(void) page_alloc_init(); pr_notice("Kernel command line: %s\n", boot_command_line); + /* parameters may set static keys */ + jump_label_init(); parse_early_param(); after_dashes = parse_args("Booting kernel", static_command_line, __start___param, @@ -583,8 +592,6 @@ asmlinkage __visible void __init start_kernel(void) parse_args("Setting init args", after_dashes, NULL, 0, -1, -1, NULL, set_init_arg); - jump_label_init(); - /* * These use large bootmem allocations and must precede * kmem_cache_init() @@ -647,6 +654,20 @@ asmlinkage __visible void __init start_kernel(void) hrtimers_init(); softirq_init(); timekeeping_init(); + + /* + * For best initial stack canary entropy, prepare it after: + * - setup_arch() for any UEFI RNG entropy and boot cmdline access + * - timekeeping_init() for ktime entropy used in rand_initialize() + * - rand_initialize() to get any arch-specific entropy like RDRAND + * - add_latent_entropy() to get any latent entropy + * - adding command line entropy + */ + rand_initialize(); + add_latent_entropy(); + add_device_randomness(command_line, strlen(command_line)); + boot_init_stack_canary(); + time_init(); printk_safe_init(); perf_event_init(); @@ -729,6 +750,7 @@ asmlinkage __visible void __init start_kernel(void) taskstats_init_early(); delayacct_init(); + poking_init(); check_bugs(); acpi_subsystem_init(); @@ -770,8 +792,14 @@ static int __init initcall_blacklist(char *str) pr_debug("blacklisting initcall %s\n", str_entry); entry = memblock_alloc(sizeof(*entry), SMP_CACHE_BYTES); + if (!entry) + panic("%s: Failed to allocate %zu bytes\n", + __func__, sizeof(*entry)); entry->buf = memblock_alloc(strlen(str_entry) + 1, SMP_CACHE_BYTES); + if (!entry->buf) + panic("%s: Failed to allocate %zu bytes\n", + __func__, strlen(str_entry) + 1); strcpy(entry->buf, str_entry); list_add(&entry->next, &blacklisted_initcalls); } @@ -826,7 +854,7 @@ trace_initcall_start_cb(void *data, initcall_t fn) { ktime_t *calltime = (ktime_t *)data; - printk(KERN_DEBUG "calling %pF @ %i\n", fn, task_pid_nr(current)); + printk(KERN_DEBUG "calling %pS @ %i\n", fn, task_pid_nr(current)); *calltime = ktime_get(); } @@ -840,7 +868,7 @@ trace_initcall_finish_cb(void *data, initcall_t fn, int ret) rettime = ktime_get(); delta = ktime_sub(rettime, *calltime); duration = (unsigned long long) ktime_to_ns(delta) >> 10; - printk(KERN_DEBUG "initcall %pF returned %d after %lld usecs\n", + printk(KERN_DEBUG "initcall %pS returned %d after %lld usecs\n", fn, ret, duration); } @@ -897,7 +925,7 @@ int __init_or_module do_one_initcall(initcall_t fn) strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf)); local_irq_enable(); } - WARN(msgbuf[0], "initcall %pF returned with %s\n", fn, msgbuf); + WARN(msgbuf[0], "initcall %pS returned with %s\n", fn, msgbuf); add_latent_entropy(); return ret; @@ -1047,6 +1075,11 @@ static inline void mark_readonly(void) } #endif +void __weak free_initmem(void) +{ + free_initmem_default(POISON_FREE_INITMEM); +} + static int __ref kernel_init(void *unused) { int ret; diff --git a/init/noinitramfs.c b/init/noinitramfs.c index f4bad8436c93..fa9cdfa7101d 100644 --- a/init/noinitramfs.c +++ b/init/noinitramfs.c @@ -1,21 +1,9 @@ +// SPDX-License-Identifier: GPL-2.0-only /* * init/noinitramfs.c * * Copyright (C) 2006, NXP Semiconductors, All Rights Reserved * Author: Jean-Paul Saman <jean-paul.saman@nxp.com> - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; version 2 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include <linux/init.h> #include <linux/stat.h> diff --git a/init/version.c b/init/version.c index ef4012ec4375..cba341161b58 100644 --- a/init/version.c +++ b/init/version.c @@ -1,3 +1,4 @@ +// SPDX-License-Identifier: GPL-2.0-only /* * linux/init/version.c * |