User:Pietinger/Tutorials/Manual Configuring Kernel Version 6.6

From Gentoo Wiki
Jump to:navigation Jump to:search
Note
Even though this page is in the user namespace, corrections and additions are much appreciated! This is simply wiki policy, this page can be moved to the main wiki as soon as it achieves critical mass more.

I have outsourced configuration steps for kernel 6.6 here, so I can create a new page for the next LTS Kernel.

Manual Configuring Kernel Version 6.6

Please read User:Pietinger/Tutorials/Manual_kernel_configuration before you start here. Only our Gentoo default sources will be used.

I am not happy with the default configuration we have, after we have just emerged gentoo-sources (or after we did a "make defconfig"). Why ? Today everything must be "user-friendly" and therefore many options are enabled by default which are not necessary. Best example for this: All options for an Intel CPU and an AMD CPU are enabled ... but you can have only one of them in your machine ;-)

On the other side some options are not enabled by default which you MUST HAVE to be able to boot your machine. In this article I will describe a complete TOUR for your kernel configuration in three parts. I will explain only specific settings for an Intel and an AMD CPU. If you have an ARM or any other CPU please take this article only as an inspiration.

First we change some options to be able to reach all options we need. Then we disable all we really dont need. In part 3 we enable all we MUST HAVE. Here I will give you also a list of links you will need for your specific components in your computer.

Part 1 - Main Menu

If you have never done a make menuconfig it can be confusing what do and where to start. Let me say some general words about the main menu. But first we start with one important settings. Enable this:

KERNEL Kernels 6.6
General setup  --->
    [*] Configure standard kernel features (expert users)  --->

[*] Enable the block layer  --->

Sometimes our kernel configuration is funny. In the next step we must disable something depending if we have an AMD or an Intel CPU. If you have an Intel CPU you might be surprised you can not disable AMD ... Go into:

KERNEL Kernels 6.6
Processor type and features  --->
    [*] Supported processor vendors  --->

You will get this menu:

KERNEL Kernels 6.6
--- Supported processor vendors
[*]   Support Intel processors
-*-   Support AMD processors
[*]   Support Hygon processors
[*]   Support Centaur processors
[*]   Support Zhaoxin processors

The funny thing is, you must disable first "Hygon processors" to be able to disable "AMD processors". Of course you will not disable it if you have an AMD CPU. If you are finished here you have only one option enabled. This step is important to be able to disable some options later you dont need (e.g. Intel P-State).

The last line Gentoo Linux ---> exists only in our gentoo-sources. If you have other sources (e.g. vanilla) you will miss this option. If you are using OpenRC as init system you have nothing to do here. If you are using systemd you must enable one option - which is usually already enabled by your systemd-stage3. So we do only a check here if it is correct:

KERNEL Kernels 6.6
Gentoo Linux  --->
    Support for init systems, system and service managers  --->
        [*] OpenRC, runit and other script based systems and managers
        [ ] systemd

In the next last option Kernel hacking ---> you really should only change something with specific instructions ! Also you will never need Library routines ---> because all necessary modules here will be selected (=enabled) automatically by other options - with one exception: Here you can change the selected font. At the moment you are not able to do this because one other option is not enabled. If you press z in this menu you can see this is disabled at the moment:

KERNEL Kernels 6.6
Library routines  --->
    - - Select compiled-in fonts

Now look into the help of this option and you will see why it is not possible ->

Depends on: FONT_SUPPORT [=y] && (FRAMEBUFFER_CONSOLE [=n] || STI_CONSOLE [=n])

Now press z again and exit this menu. Yes, we really need FRAMEBUFFER_CONSOLE - it is a MUST HAVE - and we do this in part 3.

The same is true for Cryptographic API --->. Usually all necessary modules here will be selected automatically by enabling other kernel (*) modules (with one exception: dmcrypt; but you will find instructions in every description for dmcrypt). At the moment many options are enabled because some other options are still enabled (e.g. WLAN, IPSec). If we disable WLAN or IPv6 (or both) in the next part we can disable also some of these cryptogrphics modules later. In part 3 I will explain what you really need here.

(*) This is not true for user applications. If an user application - like iwd - needs some crypto modules you will always need a description which crypto modules you have to enable. In most cases, at least this is required:

KERNEL Kernels 6.6
-*- Cryptographic API  --->
    Crypto core or helper  --->
        -*- Cryptographic algorithm manager
        [*] Userspace cryptographic algorithm configuration
    Userspace interface  --->
        [*] Hash algorithms
        [*] Symmetric key cipher algorithms

One option we have in the main menu you should think about at last when all is done: [*] Enable loadable module support ---> Why ? I highly recommend to configure all necessary modules static into the kernel - because you will need your ethernet and graphics module always ... If we do this then we dont need a loadable module support anymore and we can disable this ... and have now a monolithic kernel. Why we want do this ? Because it is more secure. Also KSPP recommends to disable module support or work with signed modules. But for the moment we dont change it and you can think about later.

Tip
At the same time as configuring your kernel, you should also check off (or cross out) all activated modules in your two lists (lsmod and lspci-k). You will then have less work later because you only have to check the remaining ones.

Part 2 - Slim kernel

First of all we disable all we dont need (and enable a few). Some of these settings are also recommended by KSPP. Some other we disable because we have an Intel or AMD CPU. At last we disable some options only if we dont use it. If you already know you will use WLAN then - of course - you will not disable it.

KERNEL Kernels 6.6
General setup  --->
    [ ] Automatically append version information to the version string
    -*- Control Group support  --->
        [ ]   Debug controller
# We dont need initramfs when we configure our kernel self
    [ ] Initial RAM filesystem and RAM disk (initramfs/initrd) support
    [ ] Preserve cpio archive mtimes in initramfs
# If you need this, you would know it ;-)
    [ ] Profiling support
# In the next submenu you must disable first "kernel crash dumps" to be able to disable "Enable kexec system call". This is true until 6.6.6.
# Because this dependency is/was wrong it was corrected with 6.6.7. If you want a kernel crash dump you might enable it with 6.6.7+
    Kexec and crash features  --->
        [ ] Enable kexec system call
        [ ] Enable kexec file based system call
        [ ] kernel crash dumps

If you think about changing the default setting for Preempt ...

KERNEL Kernels 6.6
General setup  --->
    Preemption Model (Voluntary Kernel Preemption (Desktop))  --->

... and dont know what to do, then watch this "deep dive into the preemption models of the Linux Kernel" by kernel developer Thomas Gleixner: https://www.youtube.com/watch?v=Fwvj0442ub0

(dont stop at minute 20 because you think you are not interested in RT ... it is only a short passage)

In short: This setting determines about latencies versus throughput, and my recommendation is: Stay on the default PREEMPT_VOLUNTARY or choose PREEMPT_NONE for a server or a machine with a fast CPU. Change this only to FULL if you have a slow machine AND/OR problems (hickups) when watching a 4k-video. As long as you have never a problem when watching a video you dont need it ... and get a higher throughput !

Tip
It can be tedious to search for something in the output of cpuid. However, if you already know what to look for, just do a cpuid | grep X, e.g. cpuid | grep x2APIC
KERNEL Kernels 6.6
Processor type and features  --->
    [*] Symmetric multi-processing support
# If a query with "cpuid" gives you: "x2APIC: extended xAPIC support = true" then enable this:
    [*] Support x2apic
    [ ] Support for extended (non-PC) x86 platforms
# Enable only one of them:
    [?]   Intel MCE features
    [?]   AMD MCE features
# Go into this menu and enable Intel or AMD
    Performance monitoring  --->
    [ ] Enable support for 16-bit segments
    [ ] Enable vsyscall emulation
# Dangerous - this is the first KSPP recommendation:
    < > /dev/cpu/*/msr - Model-specific register support
# If a query with "cpuid" gives you: "LA57: 57-bit addrs & 5-level paging = false" OR you have less than 512 GB RAM then disable:
    [ ] Enable 5-level page tables support
# If you have an Intel CPU:
    [ ]   Old style AMD Opteron NUMA detection
# Next is only available if you have an Intel and enabled x2APIC
# If a query with "cpuid" gives you: "SGX: Software Guard Extensions supported = false" then let it disabled:
    [ ] Software Guard eXtensions (SGX)
# Only a very old machine needs this:
    [ ]     EFI mixed-mode support
# Next should be already disabled. We check it only because it is a security problem (also KSPP recommendation):
    [ ] Disable the 32-bit vDSO (needed for glibc 2.3.3)
# If a query with "cpuid" gives you: "LAM: linear address masking = false" then let it disabled:
    [ ] Linear Address Masking support
# Dangerous - KSPP recommendation:
    [ ] Enable the LDT (local descriptor table)

Power management and ACPI options  --->
# I dont use it. It is your decision.
    [ ] Suspend to RAM and standby
# KSPP recommendation: "Dangerous; enabling this allows replacement of running kernel."
    [ ] Hibernation (aka 'suspend to disk')
    [ ]   Power Management Debug Support
    [*] ACPI (Advanced Configuration and Power Interface) Support  --->
# I dont need it. It is your decision.
        [ ]   Boottime Graphics Resource Table support

[*] Enable the block layer  --->
    IO Schedulers  --->
# I dont need them. It is your decision
        < > MQ deadline I/O scheduler
        < > Kyber I/O scheduler

Executable file formats  --->
# KSPP recommendation: "Easily confused by misconfigured userspace, keep off."
    < > Kernel support for MISC binaries

File systems  --->
# I dont need it. It is your decision.
    [ ] Quota support
    < > Kernel automounter support (supports v3, v4 and v5)
    Pseudo filesystems  --->
# KSPP recommendation: "Dangerous; exposes kernel text image layout."
        [ ]   /proc/kcore support
    [ ] Miscellaneous filesystems
# If you have no network server (like me):
    [ ] Network File Systems

Kernel hacking  --->
    [ ] Remote debugging over FireWire early on boot
    [*] Tracers  --->
        [ ]   Support for tracing block IO actions
    Generic Kernel Debugging Instruments  --->
        [ ] Debug Filesystem

Before we do now the driver section we clean out SELinux and integrity. Let "Enable different security models" enabled ... you will need it later for KSPP.

KERNEL Kernels 6.6
Security options  --->
    [*] Enable different security models
    [ ] NSA SELinux Support
    [ ] Integrity subsystem
    [ ] Socket and Networking Security Hooks

Now we step to IOMMU: Change this for an AMD and an Intel System. It is a KSPP recommendation: "Force IOMMU TLB invalidation so devices will never be able to access stale data contents"

KERNEL Kernels 6.6
Device Drivers  --->
    [*] IOMMU Hardware Support  --->
        IOMMU default domain type (Translated - Strict)  --->

If you have an AMD system you can disable all Intel IOMMU settings and you are finished here (because all what you need is enabled by default):

KERNEL Kernels 6.6
Device Drivers  --->
    [*] IOMMU Hardware Support  --->
        [*]   AMD IOMMU support
        <*>     AMD IOMMU Version 2 driver
        [ ]   Support for Intel IOMMU using DMA Remapping Devices
        [*]   Support for Interrupt Remapping

For an Intel system comes now a tricky part: As soon as you disable AMD IOMMU, sometimes Intel IOMMU also disappears (haha). The reason is: AMD IOMMU selects PCI_MSI. After disabling AMD IOMMU also PCI_MSI is disabled ... but you need it also for Intel IOMMU. So you must disable and enable in this sequence:

KERNEL Kernels 6.6
Device Drivers  --->
    [*] IOMMU Hardware Support  --->
        [ ]   AMD IOMMU support

Device Drivers  --->
    [*] PCI support  --->
        [*]   Message Signaled Interrupts (MSI and MSI-X)

Device Drivers  --->
    [*] IOMMU Hardware Support  --->
        [ ]   AMD IOMMU support
        [*]   Support for Intel IOMMU using DMA Remapping Devices
        [*]     Support for Shared Virtual Memory with Intel IOMMU
        [*]     Enable Intel DMA Remapping Devices by default
        [*]     Enable Intel IOMMU scalable mode by default
        [*]     Intel IOMMU performance events
        < >   IOMMU Userspace API
        [*]   Support for Interrupt Remapping

Now we have a big task in our driver section:

KERNEL Kernels 6.6
Device Drivers  --->

# If you dont have a notebook with an old PCMCIA
    < > PCCard (PCMCIA/CardBus) support

    [*] Block devices  --->
# I dont run in a VM
        < >   Virtio block driver

    SCSI device support  --->
# I dont have a CD-ROM
        < > SCSI CDROM support
        [*] SCSI low-level drivers  --->
# I dont run in a VM
            < >   virtio-scsi support

    <*> Serial ATA and Parallel ATA drivers (libata)  --->
# If you have a modern machine and you had module "ahci" in your "lspci -k" then you need (MUSTHAVE) this
        <*>   AHCI SATA support
# ... and you can disable the whole section (if not in your "lspci -k"):
        [ ]   ATA SFF support (for legacy IDE and PATA)

# If you need one of them disable all other in this submenu; If you dont use DMcrypt or a RAID disable it completely:
    [ ] Multiple devices driver support (RAID and LVM)

# I dont have a Mac
    [ ] Macintosh device drivers

    [*] Network device support  --->
# I dont need / use it
        < >     Network console logging support
# I dont run in a VM
        < >     Virtio network driver
# In this submenu enable only your ethernet module (see your "lspci -k") and disable all other
        [*]   Ethernet driver support  --->
# I dont have such an adapter
        < >   USB Network Adapters
# I dont have WLAN; If you have it use our Wiki articles
        [ ]   Wireless LAN
        < >   Failover driver

    Input device support  --->
# If your keyboard and your mouse is connected with USB and you are using evdev module (<*> Event interface) you can disable all this:
        [ ]   Keyboards  --->
        [ ]   Mice  --->
        [ ]   Joysticks/Gamepads  --->
        [ ]   Tablets  --->
        [ ]   Touchscreens  --->
        [ ]   Miscellaneous devices  --->
        Hardware I/O ports  --->
            < > Serial I/O support

    Character devices  --->
# KSPP recommendation: "Make sure line disciplines can't be autoloaded"
        [ ]   Automatically load TTY Line Disciplines
# If your machine has no serial port (like mine) you dont need this
        Serial drivers  --->
            < > 8250/16550 and compatible serial support
# I dont have it
        [ ]   Non-standard serial port support
# I dont run in a VM
        < > Virtio console
# I dont have it
        < > Hardware Random Number Generator Core support
# KSPP recommendation: "Do not allow direct physical memory access"
        [ ] /dev/mem virtual device support

# Here you will need your list from "lsmod"; disable and enable what you need:
    I2C support  --->
        I2C Hardware Bus support  --->
# Most Intel Machines use this
            <*> Intel 82801 (ICH/PCH)
# Many AMD machines use this (or one of the AMD drivers; look in your lsmod-list)
            <*> Intel PIIX4 and compatible (ATI/AMD/Serverworks/Broadcom/SMSC)

# You wont see in your lsmod-list which driver you will need; so you have to find out !
-*- Pin controllers  --->
# for AMD enable this:
    [*]   AMD GPIO pin control
# for Intel enable one (or all if you are unsure) in this submenu:
# Note: If you have a machine with a 12th generation Intel CPU,
# you may need TigerLake instead of AlderLake (so check both).
# This was previously the case with:
# Dell XPS 9520, System76 Darter Pro 8 and MSI Katana GF66
    Intel pinctrl drivers  --->

# I dont need / use it. It is your decision:
    [ ] Watchdog Timer Support

# I dont run in a VM; We have to do here more - important - changes I will explain in the part 3
    Graphics support  --->
        < > Virtio GPU driver

    [*] USB support  --->
# Disable this only if you really dont have a modern machine using USB 3.0
        [*]   xHCI HCD (USB 3.0) support
# If you have old USB 2.0 or 1.1; look into your output from: "lspci -k"
# If you dont find any module named ehci, ohci or uhci in your "lspci -k" you dont have it !
        [?]   EHCI HCD (USB 2.0) support
        [?]   OHCI HCD (USB 1.1) support
        [?]   UHCI HCD (most Intel and VIA) support
        [*]   USB Mass Storage support
        [*]     USB Attached SCSI
# If you have a USB Type-C (it is almost at the end of the USB menu):
        [*]   USB Type-C Support  --->
            [*]   USB Type-C Port Controller Manager
# and if you want connect a DisplayPort display to it:
        USB Type-C Alternate Mode drivers  --->
            [*] DisplayPort Alternate Mode driver
# Usually you will need also PCI Hotplugging for Type-C. See: [[USB/Guide#USB_Type-C_and_Thunderbolt]]

# I dont run in a VM
    [ ] Virtio drivers

    -*- X86 Platform Specific Device Drivers  --->
# I dont need / use it. It is your decision:
        < >     WMI embedded Binary MOF driver
# I dont have an Eee PC
        < >   Eee PC Hotkey Driver

# I dont need / use it. It is your decision:
    -*- NVMEM Support  --->
        [ ]   /sys/bus/nvmem/devices/*/nvmem (sysfs interface)

Finally we can disable some options for our network stack, before we switch to part 3. If you have your machine in a modern network environment with high-end switches and enterprise routers you surely know what you will need for fancy things like QoS (Quality of Service) and you will not disable it. If you dont know what it is and your machine is only connected to your DSL-Modem you can disable all this without fear ... if necessary you can enable it again later ;-)

KERNEL Kernels 6.6
[*] Networking support  --->
    Networking options  --->
        < > Transformation user configuration interface
# If you do some p2p file transmissions you need multicasting; try disabling it and check if you really need it
        [ ]   IP: multicasting
        [ ]   IP: advanced router
        [ ]   IP: kernel level autoconfiguration
        [ ]   TCP: advanced congestion control
        [ ]   TCP: MD5 Signature Option support (RFC2385)
# I am not a fan of IPv6 (because of privacy problems); If you need it you will not disable it
        < >   The IPv6 protocol
        [ ]   NetLabel subsystem support
        [ ] Security Marking
# Here you can do a FireWall. Please read my recommendation below.
        [*] Network packet filtering framework (Netfilter)  --->
        [ ] QoS and/or fair queueing
        < > DNS Resolver support

    [ ]   Wireless
    < >   RF switch subsystem support
    < >   Plan 9 Resource Sharing Support (9P2000)
    < >   Generic failover module

If you want configure a firewall with iptables or nftables I recommend to do: Enable ALL options in this submenu as <M>odule. Later you will make your firewall; after this is finished check with "lsmod" which modules you really need for your firewall configuration. After all you can enable all needed modules static (if you want) and disable all other you dont need. If you dont want a firewall (I dont recommend) then you can disable the complete submenu.

After all this is done you may now go into every submenu of Cryptographic API ---> and disable every module which is not hard enabled with -*- (we will enable something in part 4).

Before we switch to part 3 we take care about two main menus:

32-bit support

KSPP recommends to disable 32-bit support. But you can do this only if you have a No-Multilib system.

KERNEL Kernels 6.6
Binary Emulations  --->
    [ ] IA32 Emulation

Virtualization

If you dont use it disable also:

KERNEL Kernels 6.6
[ ] Virtualization  ----

Part 3 - Must Haves

... no discussion ... just do it ;-) Enable all these static (<*>) into your kernel ! One part of these settings is described also in Framebuffer. I think nobody needs VGA anymore; to be on a safe side you can enable also the "simple framebuffer"; actually you will need only one of "VESA" or "EFI-based"; with both enabled you are on a safe side and should not run into the problem of having a black screen (or stuck at "Loading Linux ..." when using grub as bootmanager).

KERNEL Kernels 6.6
# If you have an AMD or Intel NOTEBOOK, or if you have seen module "intel_lpss" in your output from "lspci -k"
# (It is not wrong to enable it always)
Processor type and features  --->
    [?] Intel Low Power Subsystem Support
    [?] AMD ACPI2Platform devices support

Device Drivers  --->
    Firmware Drivers  --->
        EFI (Extensible Firmware Interface) Support  --->
# We need EFI runtime services for "efibootmgr" and disable the "Disable", so it is enabled ;-)
            [ ] Disable EFI runtime services support by default
    Graphics support  --->
# Normally this is already enabled. If not then ...
        [*] Enable legacy fbdev support for your modesetting driver
        Frame buffer Devices  --->
            <*> Support for frame buffer devices  --->
                [*]   VESA VGA graphics support
                [*]   EFI-based Framebuffer Support
        Console display driver support  --->
            [*] Framebuffer Console support

File systems  --->
    Pseudo filesystems  --->
        <*> EFI Variable filesystem

Excursus: If you want an answer to the question ‘Why did you add “Framebuffer Console support” even though it is already enabled by default?’ AND you are willing to dive into the depths of the kernel configuration, then read this thread: https://forums.gentoo.org/viewtopic-t-1168856.html

The next change is not necessary for a successful system start, but you really should change it, because it cause a big performance impact (your cpu would be stuck at lowest frequency with the default 'userspace' governor). If you have a server you can choose "performance"; for a notebook "powersave" is also possible:

KERNEL Kernels 6.6
Power management and ACPI options  --->
    CPU Frequency scaling  --->
        [*]   CPU frequency transition statistics
# Change this to:
        Default CPUFreq governor (schedutil)  --->
# And now we are able to disable:
        < >   'userspace' governor for userspace frequency scaling
# If you have an Intel CPU then this is enabled automatically (see part 1):
        -*-   Intel P state control
# If you have a newer Intel CPU (generation 4 or better) you dont need:
        < >   ACPI Processor P-States driver
# If you have an AMD CPU disable above Intel P state and enable
        [*]   AMD Processor P-State driver

If you have an AMD CPU maybe you are interested in Kernel version 6.8: [[1]] ... or in 6.10: [[2]] ... (it seems to be a never ending story) ... also Intel's P-State seems to be not quite okay for very new CPUs...

Are we now ready to boot this kernel ? Maybe ... maybe not. It depends:

1. Which filesystem has your root partition ? If it is EXT4 you are fine; it is enabled by default. Until today EXT4 was the recommended filesystem for your root partition. Now our developers recommend XFS. If you use it (or any other filesystem) then you must go back into File systems ---> and enable these (static). I am using EXT4 for my root and my /home because I also use fscrypt.

2. If you have a NVMe or a special harddisk controller you must enable it also. Look again into your output of lspci -k and proof it there is an unknown module. Search for it with /. If you miss a module kernel needs to find its root partition you will get a kernel panic and kernel cannot boot. For example: If you find a module named "vmd" you must enable it also:

KERNEL
Device Drivers  --->
    [*] PCI support  --->
        PCI controller drivers  --->
            [*] Intel Volume Management Device Driver

(was a problem here: https://forums.gentoo.org/viewtopic-t-1156306-highlight-.html )

To be on a safe side, read these links and double check if you have enabled all what your kernel needs to be able to access your harddisk:

Part 4 - My recommendations

1. Additional settings:

KERNEL Kernels 6.6
General setup  --->
    [*] Core Scheduling for SMT
    CPU/Task time and stats accounting  --->
        [*]   BSD Process Accounting version 3 file format
# Checkpoint/restore is not absolutely necessary anymore; but it is not wrong to enable it for the future
    [*] Checkpoint/restore support

Processor type and features  --->
    [*] x86 CPU resource control support
    [ ] Linux guest support
# If you have an modern Intel CPU switch to Core2
    Processor family (Core 2/newer Xeon)  --->
    [ ] Enable Maximum number of SMP Processors and NUMA Nodes
# Adjust this to the number of your LOGICAL cores of your CPU (I have 32)
# If you have an AMD CPU check your dmesg later for this message:
# smpboot: 32 Processors exceeds NR_CPUS limit of 16
# Yes, it was a Ryzen 7 5700x with 8 cores (16 logical cores) but it need 32 instead of 16 (please dont ask me why)
    (32) Maximum number of CPUs
    [*]   MTRR cleanup support
    (1)     MTRR cleanup enable value (0-1)
# If a query with "cpuid" gives you: "IBRS/IBPB: indirect branch restrictions  = true" then enable this:
    [*] Indirect Branch Tracking
    Timer frequency (300 HZ)  --->

# If you have an Intel CPU
Power management and ACPI options  --->
    [*] Cpuidle Driver for Intel Processors

General architecture-dependent options  --->
    [*] Optimize very unlikely/likely branches

Memory Management options  --->
    (65536) Low address space to protect from user allocation
    [*] Transparent Hugepage Support  --->
        Transparent Hugepage Support sysfs defaults (madvise)  --->
    [*] Multi-Gen LRU
    [*]   Enable by default

Device Drivers --->
    [*] Hardware Monitoring support  --->
        [*]   Hard disk drives with temperature sensors
# If you have an Intel CPU:
        [*]   Intel Core/Core2/Atom temperature sensor
# Enable this if you have an Intel 14. Generation CPU (Meteor Lake) OR
# if you have a PCIe card driver for Habana's AI Processors (AIP)
# and read the <Help>
    [*] Compute Acceleration Framework  --->
        [*]   Intel VPU for Meteor Lake and newer

File systems  --->
    [*] Filesystem wide access notification

# This is a requirement for enabling Gentoo KSPP (see below nr. 5)
Security options  --->
    Kernel hardening options  --->
        Randomize layout of sensitive kernel structures (Limit randomization of structure layout to cache-lines)  --->

# If you have a modern CPU ("lscpu" shows "pclmulqdq" and "sse4_2") then enable also:
Cryptographic API  --->
    Accelerated Cryptographic Algorithms for CPU (x86)  --->
        [*] CRC32c (SSE4.2/PCLMULQDQ)
        [*] CRC32 (PCLMULQDQ)
# Enable in this submenu also more accelerated algorithms IF you use one of them.

Kernel hacking  --->
    Memory Debugging  --->
# I dont work with sysrq-T and sysrq-P
        [ ] Stack utilization instrumentation
# This option was a default in 6.1 Now it is no default anymore ... but if you did a "make oldconfig" you still have it. Time to disable.
    [ ] Debug preemptible kernel

2. I highly recommend to add your microcode for your CPU. Read (and do) this:

3. If you have Thunderbolt and you search with / for module thunderbolt you will find only "INTEL_WMI_THUNDERBOLT". But this is the wrong driver; you will need instead:

KERNEL Kernels 6.6
Device Drivers  --->
    [*] Unified support for USB4 and Thunderbolt  --->

Enable only this option - dont enable write by debugfs in this submenu ! Maybe you want read this: https://docs.kernel.org/admin-guide/thunderbolt.html

Usually you will need also PCI Hotplugging. See: USB/Guide#USB_Type-C_and_Thunderbolt

4. If you have a 4K-monitor and your font is too small you can - NOW (see part 1) - change it with:

KERNEL Kernels 6.6
Library routines  --->
    [*] Select compiled-in fonts
        [*] Terminus 16x32 font (not supported by all drivers)

5. Harden your kernel: User:Pietinger/Tutorials/Kernel_Hardening_with_KSPP !! (All disabling for it we have just done).

6. After your first boot with this kernel configuration you may check which HID drivers you use with:

root #dmesg | grep input

Now you can disable all other which you dont need in this submenu:

KERNEL Kernels 6.6
Device Drivers  --->
    [*] HID bus support  --->
        Special HID drivers  --->

7. If you have a notebook with a touchpad connected via i2c you will need in most cases this:

KERNEL Kernels 6.6
Device Drivers  --->
    [*] HID bus support  --->
        Special HID drivers  --->
            <*> HID Multitouch panels

        <*>   I2C HID support  --->
            <*>   HID over I2C transport layer ACPI driver

Of course i2c AND pinctrl must be configured correctly (you must know: i2c needs pinctrl !). If you have a special PCI controller (e.g. Designware) you must enable it also. I wrote a (german) article in our Gentoo forum for all settings you will need for such a touchpad: [[4]]


Now go back to User:Pietinger/Tutorials/Manual_kernel_configuration and check all other links for e.g. your graphics card and sound ;-)