From: Celejar on
On Mon, 21 Dec 2009 21:07:08 -0500
Paul Cartwright <ale(a)pcartwright.com> wrote:

> On Mon December 21 2009, Stan Hoeppner wrote:
> > I do:  stick with your homegrown kernel.
> >
> > (From the guy who only uses custom kernels)
>
> what would I gain from using a custom kernel, what would it take to
> make/install one, ( a how-to?).
> for a "regular" desktop user, web, email... what advantage is there??

Many argue, not much, but I can see the following:

1) Faster booting, since irrelevant drivers aren't loaded and won't
spend time probing.

2) Security - one of these null pointer dereferences that they keep
discovering can't hurt you if it's in code that hasn't been included.

3) Education - it's an unbeatable way to get a deeper knowledge of
your system.

4) Flexibility and control

Note that I'm not expert, and these are just my opinions, and may even
be factually incorrect.

Celejar
--
foffl.sourceforge.net - Feeds OFFLine, an offline RSS/Atom aggregator
mailmin.sourceforge.net - remote access via secure (OpenPGP) email
ssuds.sourceforge.net - A Simple Sudoku Solver and Generator


--
To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org
From: Stan Hoeppner on
Celejar put forth on 12/21/2009 8:22 PM:

> 1) Faster booting, since irrelevant drivers aren't loaded and won't
> spend time probing.

Correct. And not just drivers. Prebuilt kernels usually include netfilter
support (for iptables), which increases the size of the kernel substantially,
along with mdraid support, and some other capabilities most desktop users don't
need. Using a custom kernel allows you to eliminate the need for an initrd,
speeds up the boot process by compiling all the drivers your hardware needs
directly into the kernel, and cuts down the kernel's memory footprint. On
current systems with multiple gigs of ram and large CPU L2/L3 caches,
admittedly, the size of the kernel isn't a big issue for most desktop and server
class systems these days. It most certainly is critical for embedded
applications, where processors have relatively low performance, with tiny
caches, and small system memories.

> 2) Security - one of these null pointer dereferences that they keep
> discovering can't hurt you if it's in code that hasn't been included.

This is a valid point, though others would argue the opposite, that pre compiled
kernels lacking modules can't easily have the driver code updated with a
security fix, without compiling a new kernel. I personally will take my chances
with my precompiled kernel.

> 3) Education - it's an unbeatable way to get a deeper knowledge of
> your system.

In the big picture, this is probably the single greatest advantage to doing
one's own custom kernel.

> 4) Flexibility and control

Yes and no WRT flexibility. Yes because you an choose exactly what does and
does not go into your kernel. No, because once it's built, if you want to add a
new hardware device later, you might have to build a new kernel. With the
modular prebuilt kernels, you can plug in just about anything and it'll likely
be recognized. Then again, there's nothing keeping one from building his/her
own kernel and including drivers in anticipation of future needs. The downside
to this is kernel bloat for hardware you're not using "right now". I obviously
agree that you have more control doing your own kernel.

> Note that I'm not expert, and these are just my opinions, and may even
> be factually incorrect.

>From one non-expert to another, I agree with most of what you state. I've been
running only custom kernels for 5+ years now (servers only) with great success
and satisfaction.

--
Stan


--
To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org
From: Celejar on
On Mon, 21 Dec 2009 20:50:15 -0600
Stan Hoeppner <stan(a)hardwarefreak.com> wrote:

> Celejar put forth on 12/21/2009 8:22 PM:
>
> > 1) Faster booting, since irrelevant drivers aren't loaded and won't
> > spend time probing.
>
> Correct. And not just drivers. Prebuilt kernels usually include netfilter
> support (for iptables), which increases the size of the kernel substantially,
> along with mdraid support, and some other capabilities most desktop users don't
> need. Using a custom kernel allows you to eliminate the need for an initrd,

I run desktops / laptops, and I always build netfilter - I run
shorewall on all my boxes.

> speeds up the boot process by compiling all the drivers your hardware needs
> directly into the kernel, and cuts down the kernel's memory footprint. On

Hm, I tend to build everything that I possibly can (that I'm building
at all, that I plan to actually use) as modules. Perhaps I should try
building them into the kernel to see if there's a performance gain, but
one reason that I like modules is that it makes for easy resetting of a
driver - 'modprobe -r somemodule && modprobe somemodule'. Is there
generally a way to do this with built-in modules?

> current systems with multiple gigs of ram and large CPU L2/L3 caches,
> admittedly, the size of the kernel isn't a big issue for most desktop and server
> class systems these days. It most certainly is critical for embedded
> applications, where processors have relatively low performance, with tiny
> caches, and small system memories.
>
> > 2) Security - one of these null pointer dereferences that they keep
> > discovering can't hurt you if it's in code that hasn't been included.
>
> This is a valid point, though others would argue the opposite, that pre compiled
> kernels lacking modules can't easily have the driver code updated with a
> security fix, without compiling a new kernel. I personally will take my chances
> with my precompiled kernel.

I'm not sure that I understand this - how is it easier to provide a
security fix for a standard kernel than for a custom built one? In
both cases, one needs to obtain fixed code, build it, and replace the
bad code with the good. [I'm not arguing with you, just expressing my
confusion.] ...

> > 4) Flexibility and control
>
> Yes and no WRT flexibility. Yes because you an choose exactly what does and
> does not go into your kernel. No, because once it's built, if you want to add a
> new hardware device later, you might have to build a new kernel. With the
> modular prebuilt kernels, you can plug in just about anything and it'll likely
> be recognized. Then again, there's nothing keeping one from building his/her
> own kernel and including drivers in anticipation of future needs. The downside
> to this is kernel bloat for hardware you're not using "right now". I obviously
> agree that you have more control doing your own kernel.

Agreed, and I get bitten by this all the time. Worse, often I disable
some feature that I actually need, and then spend much time and
aggravation figuring out why something is suddenly broken ... Well, I
guess that's part of the valuable learning process that we discussed
earlier :/

Celejar
--
foffl.sourceforge.net - Feeds OFFLine, an offline RSS/Atom aggregator
mailmin.sourceforge.net - remote access via secure (OpenPGP) email
ssuds.sourceforge.net - A Simple Sudoku Solver and Generator


--
To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org
From: Stan Hoeppner on
Celejar put forth on 12/21/2009 9:13 PM:

> I run desktops / laptops, and I always build netfilter - I run
> shorewall on all my boxes.

For me, the firewall is always going to be upstream of desktops in a properly
configured infrastructure. WRT laptops, I guess it couldn't hurt to run a local
packet filter, dropping junk destined for listening daemons.

> Hm, I tend to build everything that I possibly can (that I'm building
> at all, that I plan to actually use) as modules. Perhaps I should try
> building them into the kernel to see if there's a performance gain, but
> one reason that I like modules is that it makes for easy resetting of a
> driver - 'modprobe -r somemodule && modprobe somemodule'. Is there
> generally a way to do this with built-in modules?

That's one reason most people like modules, and they make sense, driver modules
that is, for laptops and desktops where folks will be plugging and chugging
various hardware regularly, such as USB sticks, printers, cameras, eSATA drives,
PCMCIA cards, cardbus, etc. Drivers can be loaded and unloaded automatically as
needed. I build all drivers I'm likely going to need directly into my kernels.
I include module support strictly for iptables, not drivers. I hate initrd
kernels. I prefer LILO not grub. Running recent kernels with initrd and
modules can cause problems with LILO due to the initrd size. The Lenny release
notes strongly recommend against using LILO because of this.

> I'm not sure that I understand this - how is it easier to provide a
> security fix for a standard kernel than for a custom built one? In
> both cases, one needs to obtain fixed code, build it, and replace the
> bad code with the good. [I'm not arguing with you, just expressing my
> confusion.] ...

Assuming the flaw is in driver code, not core kernel code, if I have all my
drivers built into the kernel at compile time, I have to rebuild everything from
source files to get the security patch included in my new kernel. With a
prebuilt kernel or a custom kernel that uses driver modules, one should be able
to merely grab a binary only copy of the fixed driver module code, unload the
old driver module, and load the new one. As I said, I don't run such systems,
so maybe I'm wrong here, but it seems logical that one should be able to do this.

> Agreed, and I get bitten by this all the time. Worse, often I disable
> some feature that I actually need, and then spend much time and
> aggravation figuring out why something is suddenly broken ... Well, I
> guess that's part of the valuable learning process that we discussed
> earlier :/

I recently went through this on an old IDE only server that didn't have libata
or sata_sil in the kernel. So, I compiled a new kernel with libata and
sata_sil, but didn't read the help notes thoroughly for libata. Those notes
state that while libata enables the SCSI layer, one still needs to enable "SCSI
Disk Support" and/or "SCSI CD-ROM Support" for SATA devices to work. I
overlooked this. Long story short, I was very upset after installing the SATA
PCI card and new disk, the kernel enumerating them, but not assigning /dev/sdX.
Much troubleshooting later, I found the help notes for libata in the menu,
enabled SCSI Disk, recompiled, rebooted, and voilla, I had /dev/sda.

Every time this kind of thing happens, I learn something valuable about the
kernel, and a lesson that sticks. ;)

--
Stan


--
To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org
From: Paul Cartwright on
On Mon December 21 2009, Celejar wrote:
> 2)  From the appropriate directory, run make menuconfig (or xconfig or
> whatever you prefer) and configure appropriately

I think I have done this before, I think I tried it for a 64bit kernel, for my
Duo-Core processor, but it didn't turn out well. Seems to me the "configure'
part takes 2 days, or way too many options. I seem to remember it asked
whether i wanted support for every known piece of hardware out there, and I
don't know when to say Y or N..

--
Paul Cartwright
Registered Linux user # 367800
Registered Ubuntu User #12459


--
To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org