Alpine Linux - User contributions [en]

Ddclient

2023-04-02T22:02:18Z

Nabbi: update links

{{TOC right}}

== How to download and install the latest version of ddclient ==

[https://github.com/ddclient/ddclient DDclient] is a perl script to update accounts for Dynamic DNS Service Provider.

== Install ==

ddclient is available in testing/edge repository.

In order to use it, you need first to enable that [[Repositories|repository]] by adding to /etc/apk/repositories:

<code># echo http://dl-cdn.alpinelinux.org/alpine/edge/testing</code>

<code># apk update</code>

<code># apk add ddclient</code>

== Configuration ==

A sample configuration file is installed by default in <code>/etc/ddclient/ddclient.conf.sample.</code>

Rename it as <code>/etc/ddclient/ddclient.conf</code> and modify it according to your needs.

Then, start ddclient as usual:

<code># rc-service ddclient start</code>

If you want/need, configure the service to start automatically on boot:

<code># rc-update add ddclient default</code>

[[Category:Networking]]

Alpine Linux:Overview

2023-03-23T03:40:04Z

Nabbi: /* Efficient */ fix broken apk link

Alpine uses [https://musl.libc.org/ musl] as its libc, and [https://en.wikipedia.org/wiki/BusyBox BusyBox] as core utilities. These choices tend to make Alpine especially minimalist and secure.

== General overview ==

Alpine Linux has one of the '''fastest boot times''' of any operating system.

Famous because of its small size, it's '''heavily used in containers'''.

Also well know for '''wide use in embedded devices''' and as a '''base system for many enterprise routers'''.

The postmarketOS project which is designed to run on mobile devices is based on Alpine Linux.

=== Distinctive ===

Alpine Linux follows the principles of '''the SSS distro: Simple+Small+Secure''': due to usage of [http://musl-libc.org/ muslc] as the minimalist libc, BusyBox simple coreutils (with possibilities to alternate on inflated original packages of each coreutils tools also) and userland binaries compiled as Position Independent Executables (PIE) with stack smashing protection.

=== Efficient ===

Some main reasons:

# Usage of [https://musl.libc.org/ musl] as the minimalist libc
# Its own package manager called [[Alpine Package Keeper|apk]],
# The {{Pkg|openrc}} init system, script driven set-ups and that’s it!
# {{Pkg|busybox}}: simple coreutils (with possibilities to alternate on inflated original packages of each coreutils tools also)

This provides you with a simple, '''crystal-clear Linux environment without all the noise''', nothing else will get in the way.

=== Secure ===

All userland binaries are compiled as Position Independent Executables (PIE) with stack smashing protection.

== Technical overview ==

<ol>
</li><li>'''The OS design'''

Alpine uses '''Linux''' as [https://www.kernel.org/ OS kernel], and has a focus on '''SSS distribution, Simple Small and Secure'''

A variety of architectures are officially supports:
* '''x86_64''': The popular AMD64 compatible 64-bit x86 based machines, i386 are not recommended for newer/latest hardware.
* '''x86''': (i386 pc 32bit) and x86_64 (i686 pc 64bit and amd64)
* '''armhf''': The newer ARM hard-float for newer, more powerful 32-bit devices alongside 64-bit
* '''armv7''': The 32-bit ARM only execution state of the ARMv7 devices machines.
* '''aarch64''': The 64-bit ARM only execution state of the ARMv8 device machines.
* '''ppc64le''': For 64-bit PowerPC devices with pure little-endian mode, mostly for POWER8 and POWER9.
* '''s390x''': For IBM Z mainframes, especially IBM Z and IBM LinuxONE.

Alpine can be installed to a hard disk/SSD/other storage medium like any other distro; (sys mode). The storage medium in question can be any block device (USB, Flash, SDD, HDD). Always in start, the base Alpine system and all your changes will be unpacked into a memory-based filesystem. If run some install script process (data mode) will keep your setup on a hard disk/SSD/other storage medium, rather than unpacking into memory. The default setup here is to store your /var partition directly on the hard storage medium. But as in the diskless mode, your root system still comes from a static ISO image.


</li><li>'''The installation'''

In Alpine's case, '''the installer consists of the {{Path|/sbin/setup-*}} scripts''', which are also part of the {{Pkg|alpine-conf}} package.

'''A base Alpine install will include only needed packages''' such like {{Pkg|alpine-base}}, {{Pkg|syslinux}}, {{Pkg|linux-lts}} (or another kernel package), and depending of purpose some like {{Pkg|openssh}}/{{Pkg|chrony}}.

Alpine's boot loader case this is {{Pkg|syslinux}}, or its companions <code>isolinux</code> or <code>extlinux</code>. Latest releases have Grub and [[Alpine and UEFI|UEFI support]].

</li><li>'''The init system'''

An "init system" includes several different components. First, there is the initramfs, which is loaded by the bootloader. Alpine's tool for generating the initramfs is {{Path|/sbin/mkinitfs}}, part of the {{Pkg|mkinitfs}} package, which is required by Alpine's kernel packages and by its {{Pkg|syslinux}} package. This tool's settings are read from {{Path|/etc/mkinitfs/*}}, and it installs the initscript {{Path|/usr/share/mkinitfs/initramfs-init}} into the initramfs.

Second, Alpine uses [[Alpine Linux Init System|OpenRC]] to handle the rest of its initscripts. The base framework of this is in the {{Pkg|openrc}} package, which is required by {{Pkg|alpine-conf}}.


</li><li>'''The packaging and development system'''

The last important distinguishing feature of a Linux distro is its packaging and development systems.

In Alpine's case, these are something a hybrid between [https://www.archlinux.org/ ArchLinux]'s, on the one hand, and [http://www.gentoo.org/ Gentoo] and [http://www.freebsd.org/ FreeBSD]'s, on the other. Our package-management and build utilities work much like Arch's:

* {{Pkg|mkinitfs}}, mentioned above, rebuilds Alpine's initramfs, like Arch's "mkinitcpio"
* '''apk''' from {{Pkg|apk-tools}} is Alpine's package manager, like Arch's "pacman"; see [[Alpine Linux package management]]
* {{Pkg|abuild}} is Alpine's build utility, like Arch's "makepkg"; see [[Abuild and Helpers]]
* Alpine's package-building scripts are named APKBUILD, like Arch's "PKGBUILD"

What Alpine borrows from Gentoo and FreeBSD is a tree of all the package-building scripts. It is called the [[Aports tree]], and is kept as a single git repository. (Compare Gentoo's "Portage" and FreeBSD's "ports". Something similar can be set up with Arch's "abs", but it's not as tightly integrated with their package manager and build utilities.)

If you're only planning to install packages on a given system, and not do any development there, then the only pieces of this you'll need are {{Pkg|mkinitfs}} and {{Pkg|apk-tools}}, both included in a base Alpine install. If you do plan to do development, install {{Pkg|alpine-sdk}}, which includes gcc, git, abuild, and the like, and see [[Developer Documentation]].


</li></ol>

= See Also =

* [[Comparison with other distros]]
* [[Tutorials and Howtos]]

[[Category:Installation]]

Alpine Linux:Overview

2023-03-23T03:35:00Z

Nabbi: /* Technical overview */ grammer, add link

Alpine uses [https://musl.libc.org/ musl] as its libc, and [https://en.wikipedia.org/wiki/BusyBox BusyBox] as core utilities. These choices tend to make Alpine especially minimalist and secure.

== General overview ==

Alpine Linux has one of the '''fastest boot times''' of any operating system.

Famous because of its small size, it's '''heavily used in containers'''.

Also well know for '''wide use in embedded devices''' and as a '''base system for many enterprise routers'''.

The postmarketOS project which is designed to run on mobile devices is based on Alpine Linux.

=== Distinctive ===

Alpine Linux follows the principles of '''the SSS distro: Simple+Small+Secure''': due to usage of [http://musl-libc.org/ muslc] as the minimalist libc, BusyBox simple coreutils (with possibilities to alternate on inflated original packages of each coreutils tools also) and userland binaries compiled as Position Independent Executables (PIE) with stack smashing protection.

=== Efficient ===

Some main reasons:

# Usage of [https://musl.libc.org/ musl] as the minimalist libc
# Its own package manager called {{Pkg|apk}},
# The {{Pkg|openrc}} init system, script driven set-ups and that’s it!
# {{Pkg|busybox}}: simple coreutils (with possibilities to alternate on inflated original packages of each coreutils tools also)

This provides you with a simple, '''crystal-clear Linux environment without all the noise''', nothing else will get in the way.

=== Secure ===

All userland binaries are compiled as Position Independent Executables (PIE) with stack smashing protection.

== Technical overview ==

<ol>
</li><li>'''The OS design'''

Alpine uses '''Linux''' as [https://www.kernel.org/ OS kernel], and has a focus on '''SSS distribution, Simple Small and Secure'''

A variety of architectures are officially supports:
* '''x86_64''': The popular AMD64 compatible 64-bit x86 based machines, i386 are not recommended for newer/latest hardware.
* '''x86''': (i386 pc 32bit) and x86_64 (i686 pc 64bit and amd64)
* '''armhf''': The newer ARM hard-float for newer, more powerful 32-bit devices alongside 64-bit
* '''armv7''': The 32-bit ARM only execution state of the ARMv7 devices machines.
* '''aarch64''': The 64-bit ARM only execution state of the ARMv8 device machines.
* '''ppc64le''': For 64-bit PowerPC devices with pure little-endian mode, mostly for POWER8 and POWER9.
* '''s390x''': For IBM Z mainframes, especially IBM Z and IBM LinuxONE.

Alpine can be installed to a hard disk/SSD/other storage medium like any other distro; (sys mode). The storage medium in question can be any block device (USB, Flash, SDD, HDD). Always in start, the base Alpine system and all your changes will be unpacked into a memory-based filesystem. If run some install script process (data mode) will keep your setup on a hard disk/SSD/other storage medium, rather than unpacking into memory. The default setup here is to store your /var partition directly on the hard storage medium. But as in the diskless mode, your root system still comes from a static ISO image.


</li><li>'''The installation'''

In Alpine's case, '''the installer consists of the {{Path|/sbin/setup-*}} scripts''', which are also part of the {{Pkg|alpine-conf}} package.

'''A base Alpine install will include only needed packages''' such like {{Pkg|alpine-base}}, {{Pkg|syslinux}}, {{Pkg|linux-lts}} (or another kernel package), and depending of purpose some like {{Pkg|openssh}}/{{Pkg|chrony}}.

Alpine's boot loader case this is {{Pkg|syslinux}}, or its companions <code>isolinux</code> or <code>extlinux</code>. Latest releases have Grub and [[Alpine and UEFI|UEFI support]].

</li><li>'''The init system'''

An "init system" includes several different components. First, there is the initramfs, which is loaded by the bootloader. Alpine's tool for generating the initramfs is {{Path|/sbin/mkinitfs}}, part of the {{Pkg|mkinitfs}} package, which is required by Alpine's kernel packages and by its {{Pkg|syslinux}} package. This tool's settings are read from {{Path|/etc/mkinitfs/*}}, and it installs the initscript {{Path|/usr/share/mkinitfs/initramfs-init}} into the initramfs.

Second, Alpine uses [[Alpine Linux Init System|OpenRC]] to handle the rest of its initscripts. The base framework of this is in the {{Pkg|openrc}} package, which is required by {{Pkg|alpine-conf}}.


</li><li>'''The packaging and development system'''

The last important distinguishing feature of a Linux distro is its packaging and development systems.

In Alpine's case, these are something a hybrid between [https://www.archlinux.org/ ArchLinux]'s, on the one hand, and [http://www.gentoo.org/ Gentoo] and [http://www.freebsd.org/ FreeBSD]'s, on the other. Our package-management and build utilities work much like Arch's:

* {{Pkg|mkinitfs}}, mentioned above, rebuilds Alpine's initramfs, like Arch's "mkinitcpio"
* '''apk''' from {{Pkg|apk-tools}} is Alpine's package manager, like Arch's "pacman"; see [[Alpine Linux package management]]
* {{Pkg|abuild}} is Alpine's build utility, like Arch's "makepkg"; see [[Abuild and Helpers]]
* Alpine's package-building scripts are named APKBUILD, like Arch's "PKGBUILD"

What Alpine borrows from Gentoo and FreeBSD is a tree of all the package-building scripts. It is called the [[Aports tree]], and is kept as a single git repository. (Compare Gentoo's "Portage" and FreeBSD's "ports". Something similar can be set up with Arch's "abs", but it's not as tightly integrated with their package manager and build utilities.)

If you're only planning to install packages on a given system, and not do any development there, then the only pieces of this you'll need are {{Pkg|mkinitfs}} and {{Pkg|apk-tools}}, both included in a base Alpine install. If you do plan to do development, install {{Pkg|alpine-sdk}}, which includes gcc, git, abuild, and the like, and see [[Developer Documentation]].


</li></ol>

= See Also =

* [[Comparison with other distros]]
* [[Tutorials and Howtos]]

[[Category:Installation]]

Alpine Linux:Overview

2023-03-23T03:30:21Z

Nabbi: /* Efficient */ point musl at the current http link

Alpine uses [https://musl.libc.org/ musl] as its libc, and [https://en.wikipedia.org/wiki/BusyBox BusyBox] as core utilities. These choices tend to make Alpine especially minimalist and secure.

== General overview ==

Alpine Linux has one of the '''fastest boot times''' of any operating system.

Famous because of its small size, it's '''heavily used in containers'''.

Also well know for '''wide use in embedded devices''' and as a '''base system for many enterprise routers'''.

The postmarketOS project which is designed to run on mobile devices is based on Alpine Linux.

=== Distinctive ===

Alpine Linux follows the principles of '''the SSS distro: Simple+Small+Secure''': due to usage of [http://musl-libc.org/ muslc] as the minimalist libc, BusyBox simple coreutils (with possibilities to alternate on inflated original packages of each coreutils tools also) and userland binaries compiled as Position Independent Executables (PIE) with stack smashing protection.

=== Efficient ===

Some main reasons:

# Usage of [https://musl.libc.org/ musl] as the minimalist libc
# Its own package manager called {{Pkg|apk}},
# The {{Pkg|openrc}} init system, script driven set-ups and that’s it!
# {{Pkg|busybox}}: simple coreutils (with possibilities to alternate on inflated original packages of each coreutils tools also)

This provides you with a simple, '''crystal-clear Linux environment without all the noise''', nothing else will get in the way.

=== Secure ===

All userland binaries are compiled as Position Independent Executables (PIE) with stack smashing protection.

== Technical overview ==

<ol>
</li><li>'''The OS design'''

Alpine uses '''Linux''' as OS kernel, and has a focus on '''SSS distribution, Simple Small and Secure'''

A variety of architectures are officially supports:
* '''x86_64''': The popular AMD64 compatible 64-bit x86 based machines, i386 are not recommended for newer/latest hardware.
* '''x86''': (i386 pc 32bit) and x86_64 (i686 pc 64bit and amd64)
* '''armhf''': The newer ARM hard-float for newer, more powerful 32-bit devices alongside 64-bit
* '''armv7''': The 32-bit ARM only execution state of the ARMv7 devices machines.
* '''aarch64''': The 64-bit ARM only execution state of the ARMv8 device machines.
* '''ppc64le''': For 64-bit PowerPC devices with pure little-endian mode, mostly for POWER8 and POWER9.
* '''s390x''': For IBM Z mainframes, especially IBM Z and IBM LinuxONE.

Alpine can be installed to a hard disk/SSD/other storage medium like any other distro; (sys mode). The storage medium in question can be any block device (USB, Flash, SDD, HDD). Always in start, the base Alpine system and all your changes will be unpacked into a memory-based filesystem. If run some install script process (data mode) will keep your setup on a hard disk/SSD/other storage medium, rather than unpacking into memory. The default setup here is to store your /var partition directly on the hard storage medium. But as in the diskless mode, your root system still comes from a static ISO image.


</li><li>'''The installation'''

In Alpine's case, '''the installer consists of the {{Path|/sbin/setup-*}} scripts''', which are also part of the {{Pkg|alpine-conf}} package.

'''A base Alpine install will include only needed packages''' such like {{Pkg|alpine-base}}, {{Pkg|syslinux}}, {{Pkg|linux-lts}} (or another kernel package), and depending of purpose some like {{Pkg|openssh}}/{{Pkg|chrony}}.

Alpine's boot loader case this is {{Pkg|syslinux}}, or its companions <code>isolinux</code> or <code>extlinux</code>. Latest releases have Grub and [[Alpine and UEFI|UEFI support]].

</li><li>'''The init system'''

An "init system" includes several different components. First, there is the initramfs, which is loaded by the bootloader. Alpine's tool for generating the initramfs is {{Path|/sbin/mkinitfs}}, part of the {{Pkg|mkinitfs}} package, which is required by Alpine's kernel packages and by its {{Pkg|syslinux}} package. This tool's settings are read from {{Path|/etc/mkinitfs/*}}, and it installs the initscript {{Path|/usr/share/mkinitfs/initramfs-init}} into the initramfs.

Second, Alpine uses [[Alpine Linux Init System|OpenRC]] to handle the rest of its initscripts. The base framework of this is in the {{Pkg|openrc}} package, which is required by {{Pkg|alpine-conf}}.


</li><li>'''The packaging and development system'''

The last important distinguishing feature of a Linux distro is its packaging and development systems.

In Alpine's case, these are something a hybrid between [https://www.archlinux.org/ ArchLinux]'s, on the one hand, and [http://www.gentoo.org/ Gentoo] and [http://www.freebsd.org/ FreeBSD]'s, on the other. Our package-management and build utilities work much like Arch's:

* {{Pkg|mkinitfs}}, mentioned above, rebuilds Alpine's initramfs, like Arch's "mkinitcpio"
* '''apk''' from {{Pkg|apk-tools}} is Alpine's package manager, like Arch's "pacman"; see [[Alpine Linux package management]]
* {{Pkg|abuild}} is Alpine's build utility, like Arch's "makepkg"; see [[Abuild and Helpers]]
* Alpine's package-building scripts are named APKBUILD, like Arch's "PKGBUILD"

What Alpine borrows from Gentoo and FreeBSD is a tree of all the package-building scripts. It is called the [[Aports tree]], and is kept keep it as a git repository. (Compare Gentoo's "Portage" and FreeBSD's "ports". Something similar can be set up with Arch's "abs", but it's not as tightly integrated with their package manager and build utilities.)

If you're only planning to install packages on a given system, and not do any development there, then the only pieces of this you'll need are {{Pkg|mkinitfs}} and {{Pkg|apk-tools}}, both included in a base Alpine install. If you do plan to do development, install {{Pkg|alpine-sdk}}, which includes gcc, git, abuild, and the like, and see [[Developer Documentation]].


</li></ol>

= See Also =

* [[Comparison with other distros]]
* [[Tutorials and Howtos]]

[[Category:Installation]]

Custom Kernel

2023-03-22T04:31:12Z

Nabbi: /* Creating your config */ 3.17 current stable

{{Draft}}

This process of building a '''custom configured kernel''' assumes you are running on Alpine Linux utilizing abuild & aports.

== But why? ==

You want to build a custom kernel to enable experimental hardware or features or outdated hardware, to reduce bloat further, to tune the kernel to the hardware.

The lts kernel for most Alpine ARCHs uses defaults to balance throughput at the expense of some responsiveness, and support for many devices. You can tweak the kernel for desktop use and low latency and responsiveness.

You should disable modules to increase security. By default, Alpine will install modules but not disable most of them. Disabling modules will reduce an DMA attack but not eliminate it completely. If you have a newer processor with VT-d, you can mitigate as long as you:

Leave CONFIG_INTEL_IOMMU_DEFAULT_ON=y or pass intel_iommu=on as a kernel parameter and disable kernel logging so the attacker doesn't gain DMAR address information through dmesg.[http://blog.frizk.net/2016/11/disable-virtualization-based-security.html] Also remove references to the kernel version to calculate the IOMMU addresses.[https://link.springer.com/content/pdf/10.1186/s13173-017-0066-7.pdf]

To increase the security of the boot process, if you have a TPM, you could set CONFIG_INTEL_TXT=y (Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)) (which is not enabled in the hardened kernel by default), then you would need the SINIT module (provided only by Intel)[https://software.intel.com/en-us/articles/intel-trusted-execution-technology], a possibly compiled TrustedGrub2[https://github.com/Rohde-Schwarz-Cybersecurity/TrustedGRUB2], trousers[https://sourceforge.net/projects/trousers/?source=navbar], tboot[https://sourceforge.net/projects/tboot/]. These packages are not in aports and it is unknown if these tools work on musl. It's not recommended for Edge. Also, there would be trigger packages to generate hashes for the kernel and the mkinitfs updates.

== Setting up the Alpine Build System ==

First, you need to follow the steps in [[Creating_an_Alpine_package#Setup_your_system_and_account|Setup your system and account for building packages]]. You also need to configure your /etc/apk/repositories so that they search locally for your apks. See [[Creating_an_Alpine_package#Testing_the_package_locally|Testing the package locally]] for details.

After setting up accounts and repos, change your shell's current working directory to '''aports''' that you just cloned.

cd aports

== Working with aports ==

We will try using an existing lts kernel just tweaking the lts.ARCH.config file.

=== Switching to the proper release version ===

You need to switch to the proper branch that matches the release so that the kernel compiles against the dependencies properly.

{| cellpadding="5" border="1" class="wikitable"
|-
! Alpine version
! Remote branch
|-
| Edge
| master
|-
| 3.17.0
| 3.17-stable
|-
|}

The following is required to get access to the APKBUILD released for that version of Alpine and which you will create a commit for.

If you are on 3.17 do:

git checkout -b 3.17-stable origin/3.17-stable

If you are on Edge do:

git checkout master

=== Creating your config ===

You can use linux-lts but what you should do is create a local branch by doing:

For Alpine Edge:

git checkout -b my-custom-kernel

For Alpine 3.17:

git checkout -b my-custom-kernel origin/3.17-stable

Doing it this way, you do less work in maintaining. All you need to do is keep ''master'' or ''3.17-stable'' in sync[https://help.github.com/articles/syncing-a-fork/][https://help.github.com/articles/configuring-a-remote-for-a-fork/] and merge any conflicts.

First switch to the branch by doing <code>git checkout my-custom-kernel</code>. Then, you need to navigate to the ''main/linux-lts'' folder where you should see a APKBUILD and some config- files. When you are done with your edits either by editing directly the APKBUILD and copying the lts.ARCH.config as .config in the linux-4.15 folder. You will then move the .config back overriding the lts.ARCH.config generated by <code>make menuconfig</code> (discussed below in the ''Configuring kernel'' section). After generating your config, you need to <code>abuild checksum</code>. Then, do <code>git add APKBUILD lts.ARCH.config</code> where ARCH is whatever architecture (x86, x86_64, ...) you use. Then, you need to do <code>git commit APKBUILD config-NAME.ARCH -m "Enabled these options ...."</code> for your customization the ARCHitecture of your system. You do this so that git can keep your code separate from Alpine's and so your changes float forward between kernel updates.

== Adding custom patches ==

Custom patches should be added to ''sources=''.

After you added the URL, you need to produce a checksum by doing <code>abuild checksum</code>.

The custom patches may not be autopatched, due to being distributed as an archive or different patch level, so you need to define what to do with it in the prepare().

== Configuring kernel ==

Attempt to build the kernel first. To do that, you do abuild -rK to install most of the dependencies. If it complains about a dependency like elfutils-dev use -rKd. Then, when it prompts for values for new found config options just hold enter till it starts compiling the kernel. There should be two sets one for -lts and the other for the -virt. Just Ctrl+C out of the compilation process after the second set so you can further customize the config. Then you go into the src/linux-VER and edit the config file. Copy the .config file overriding the lts.ARCH.config in the srcdir.

The alternative is to use the kernel configuration menu in the build-NAME folder, but before yo do that you need to <code>sudo apk add ncurses-dev</code>

After you are done using the menu in the build-NAME folder by doing <code>make menuconfig</code>, you want to remove <code>ncurses-dev</code>. When you are done, it will be stored in ''.config'' which you need to again override the lts.ARCH.config file. When you are done updating the config-NAME.ARCH, you need to do <code>abuild checksum</code>.

The options in the kernel config are typically defaults. If your device is old, it may be set to n by default.

=== Vanilla targets and tuning ===

{|cellpadding="5" border="1" class="wikitable"
!ARCH
!Processor Type / CPU Selection / System Type
!Code Generation / Instruction Extensions
!Timer Frequency
!Preemption Model
!Bitness
|-
|s390x
|IBM zEnterprise 114 and 196
|IBM zBC12 and zEC12 (<code>-march=zEC12 -mtune=zEC12</code>)
|100 Hz
|No Forced Preemption (Server)
|64
|-
|ppc64le
|Server processors
|POWER8 (<code>-mcpu=power8</code>), AltiVec (<code>-Wa,-maltivec</code> to assembler or <code>-maltivec -mabi=altivec</code>), VSX
|100 HZ
|No Forced Preemption (Server)
|64
|-
|ppc
|
512x/52xx/6xx/7xx/74xx/82xx/83xx/86xx
* Apple PowerMac based machines
|AltiVec (<code>-Wa,-maltivec</code> to assembler or <code>-maltivec -mabi=altivec</code>) on >=74xx
|250 HZ
|No Forced Preemption (Server)
|32
|-
|x86_64
|Generic-x86-64
|(-mtune=generic ; SIMD assembly modules enabled based on simple compile test and/or presence of CPU flag)
|300 HZ
|Voluntary Kernel Preemption (Desktop)
|32
|-
|x86
|586/K5/5x86/6x86/6x86MX
|(-mtune=generic ; SIMD assembly modules enabled based on simple compile test and/or presence of CPU flag)
|300 HZ
|Voluntary Kernel Preemption (Desktop)
|32
|-
|armhf
|
* ARMv7 based platforms (Cortex-A, PJ4, Scorpion, Krait)
* Freescale i.MX family -- Cortex A (i.MX51, i.MX53, i.MX6 Quad/DualLite, i.MX6 SoloLite, i.MX6 SoloX, i.MX6 UltraLite, i.MX7 Dual)
* Qualcomm -- (MSM8X60, MSM8960, MSM8974)
* Allwinner SoCs -- (A10 (sun4i), A10s / A13 (sun5i), A31 (sun6i), A20 (sun7i), sun8i Family, (sun9i))
* ARM Ldt Versatile Express family --
|Either <code>-march=armv7-a</code> or <code>-march=armv5t -Wa,-march=armv7-a</code> based on a compile test. <code>-mfpu=vfp</code>
|100 Hz
|Voluntary Kernel Preemption (Desktop)
|32
|-
|aarch64
|
* Allwinner sunxi 64-bit SoC Family
* Broadcom BCM2835 family
* Marvell Berlin SoC Family
* ARMv8 based Samsung Exynos SoC family
* ARMv8 based Freescale Layerscape SoC family
* Hisilicon SoC Family
* Mediatek MT65xx & MT81xx ARMv8 SoC
* Marvell EBU SoC Family
* Qualcomm Platforms
* Rockchip Platforms
* AMD Seattle SoC Family
* Altera's Stratix 10 SoCFPGA Family
* NVIDIA Tegra SoC Family
* Spreadtrum SoC platform
* Cavium Inc. Thunder SoC Family
* ARMv8 software model (Versatile Express)
* AppliedMicro X-Gene SOC Family
* Xilinx ZynqMP Family
|
|300 HZ
|Voluntary Kernel Preemption (Desktop)
|64
|-
|}
If you do desktop multitasking, you may want to switch to Voluntary Kernel Preemption (Desktop) or Preemptible Kernel (Low-Latency Desktop) and up the Timer Frequency. If you run a dedicated render farm node or a dedicated bitcoin miner use No Forced Preemption (Server) and decrease the Timer Frequency.

Optimized modules (most are already compiled as modules):
* raid6 -- altivec, avx512, ssse3, avx2, mmx, sse, sse2, neon
* some operations of raid5 -- mmx (32 bit), sse (64 bit), avx
For Kernel API:
* 32-bit memcpy -- 3dnow
* 32-bit memory page clearing and copying -- sse (Athlon/K7 only), mmx
From x86/crypto, arm/crypto, powerpc/crypto:
* CAMELLIA -- avx2, avx, aes-ni
* CHACHA20 -- avx2, neon
* CAST5 -- avx
* CAST6 -- avx
* TWOFISH -- avx
* SERPENT -- avx2, avx, sse2
* SHA1 -- avx2, ssse3, neon, spe
* SHA2 -- avx2
* SHA256 -- ssse3, neon, spe
* SHA512 -- avx2, ssse3, neon
* POLY1305 -- avx2
* GHASH -- pclmulqdq (part of aes-ni), vmx (power8)
* AES -- aes-ni, neon, vmx (power8), spe
* CRC32 -- pclmulqdq, sse, neon, vmx (power8)
* CRCT10DIF -- pclmulqdq, sse, neon, vmx (power8)

=== Fast reboots with kexec ===

If you want to reboot the kernel fast avoiding the POST test, you need <code>sudo apk add kexec-tools</code> and enable kexec in the kernel:

Processor type and features
[*] kexec system call

=== Hibernation to prevent data loss ===

Power management and ACPI options
[*] Hibernation (aka 'suspend to disk')

Hibernation should be used if you have a laptop. You don't want the laptop to suddenly shut off resulting in data loss, you want it to save your work based on a percentage of battery life (this requires special script). When you do hibernation and when it restores back, it should lock down the computer and ask for prompt. Depending on your needs, the hibernated image can be encrypted/decrypted which again requires additional customization to scripts.

Hibernation with an unsanitized swap file is generally insecure because data and unlocked memory pages is swapped out in plaintext. To increase the security either disable swap (Alpine default) or use an encrypted swap. The swap file/partition is typically used as a dump of the hibernated image.

== Building ==

Before building, you may want to remove as many modules as possible. This will reduce the time to compile greatly. Also, you may want to use [https://github.com/ccache/ccache/ ccache] for faster recompiles especially if you are searching for the minimal set of options or modules to use or include.

You should then do an <code>abuild -r</code> to attempt to build it.

== Installing ==

To install it you do a <code>sudo apk add linux-NAME</code> where NAME is your custom kernel name.

== Testing ==

Before you test, you should install the lts kernel too, using <code>sudo apk add linux-hardened</code>. You may be missing a module and can't boot, so you use the other kernel as the fallback boot kernel. Don't forget to update your bootloader configuration.

To test, first you should make a bootable Alpine USB image. Then, when you have your rescue USB done, you <code>doas reboot</code> the computer.

To test it, you basically do trial and error. Sometimes your config is missing something if you want to have a bare minimum setting.

If you are curious about correctness testing, some kernel modules or components do preform self tests at the beginning of the boot process. The tools may have test suites that you run with the make command.

[[Category:Kernel]]

Custom Kernel

2023-03-22T04:30:07Z

Nabbi: /* Switching to the proper release version */ 3.17 current stable

{{Draft}}

This process of building a '''custom configured kernel''' assumes you are running on Alpine Linux utilizing abuild & aports.

== But why? ==

You want to build a custom kernel to enable experimental hardware or features or outdated hardware, to reduce bloat further, to tune the kernel to the hardware.

The lts kernel for most Alpine ARCHs uses defaults to balance throughput at the expense of some responsiveness, and support for many devices. You can tweak the kernel for desktop use and low latency and responsiveness.

You should disable modules to increase security. By default, Alpine will install modules but not disable most of them. Disabling modules will reduce an DMA attack but not eliminate it completely. If you have a newer processor with VT-d, you can mitigate as long as you:

Leave CONFIG_INTEL_IOMMU_DEFAULT_ON=y or pass intel_iommu=on as a kernel parameter and disable kernel logging so the attacker doesn't gain DMAR address information through dmesg.[http://blog.frizk.net/2016/11/disable-virtualization-based-security.html] Also remove references to the kernel version to calculate the IOMMU addresses.[https://link.springer.com/content/pdf/10.1186/s13173-017-0066-7.pdf]

To increase the security of the boot process, if you have a TPM, you could set CONFIG_INTEL_TXT=y (Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)) (which is not enabled in the hardened kernel by default), then you would need the SINIT module (provided only by Intel)[https://software.intel.com/en-us/articles/intel-trusted-execution-technology], a possibly compiled TrustedGrub2[https://github.com/Rohde-Schwarz-Cybersecurity/TrustedGRUB2], trousers[https://sourceforge.net/projects/trousers/?source=navbar], tboot[https://sourceforge.net/projects/tboot/]. These packages are not in aports and it is unknown if these tools work on musl. It's not recommended for Edge. Also, there would be trigger packages to generate hashes for the kernel and the mkinitfs updates.

== Setting up the Alpine Build System ==

First, you need to follow the steps in [[Creating_an_Alpine_package#Setup_your_system_and_account|Setup your system and account for building packages]]. You also need to configure your /etc/apk/repositories so that they search locally for your apks. See [[Creating_an_Alpine_package#Testing_the_package_locally|Testing the package locally]] for details.

After setting up accounts and repos, change your shell's current working directory to '''aports''' that you just cloned.

cd aports

== Working with aports ==

We will try using an existing lts kernel just tweaking the lts.ARCH.config file.

=== Switching to the proper release version ===

You need to switch to the proper branch that matches the release so that the kernel compiles against the dependencies properly.

{| cellpadding="5" border="1" class="wikitable"
|-
! Alpine version
! Remote branch
|-
| Edge
| master
|-
| 3.17.0
| 3.17-stable
|-
|}

The following is required to get access to the APKBUILD released for that version of Alpine and which you will create a commit for.

If you are on 3.17 do:

git checkout -b 3.17-stable origin/3.17-stable

If you are on Edge do:

git checkout master

=== Creating your config ===

You can use linux-lts but what you should do is create a local branch by doing:

For Alpine Edge:

git checkout -b my-custom-kernel

For Alpine 3.7:

git checkout -b my-custom-kernel origin/3.7-stable

Doing it this way, you do less work in maintaining. All you need to do is keep ''master'' or ''3.7-stable'' in sync[https://help.github.com/articles/syncing-a-fork/][https://help.github.com/articles/configuring-a-remote-for-a-fork/] and merge any conflicts.

First switch to the branch by doing <code>git checkout my-custom-kernel</code>. Then, you need to navigate to the ''main/linux-lts'' folder where you should see a APKBUILD and some config- files. When you are done with your edits either by editing directly the APKBUILD and copying the lts.ARCH.config as .config in the linux-4.15 folder. You will then move the .config back overriding the lts.ARCH.config generated by <code>make menuconfig</code> (discussed below in the ''Configuring kernel'' section). After generating your config, you need to <code>abuild checksum</code>. Then, do <code>git add APKBUILD lts.ARCH.config</code> where ARCH is whatever architecture (x86, x86_64, ...) you use. Then, you need to do <code>git commit APKBUILD config-NAME.ARCH -m "Enabled these options ...."</code> for your customization the ARCHitecture of your system. You do this so that git can keep your code separate from Alpine's and so your changes float forward between kernel updates.

== Adding custom patches ==

Custom patches should be added to ''sources=''.

After you added the URL, you need to produce a checksum by doing <code>abuild checksum</code>.

The custom patches may not be autopatched, due to being distributed as an archive or different patch level, so you need to define what to do with it in the prepare().

== Configuring kernel ==

Attempt to build the kernel first. To do that, you do abuild -rK to install most of the dependencies. If it complains about a dependency like elfutils-dev use -rKd. Then, when it prompts for values for new found config options just hold enter till it starts compiling the kernel. There should be two sets one for -lts and the other for the -virt. Just Ctrl+C out of the compilation process after the second set so you can further customize the config. Then you go into the src/linux-VER and edit the config file. Copy the .config file overriding the lts.ARCH.config in the srcdir.

The alternative is to use the kernel configuration menu in the build-NAME folder, but before yo do that you need to <code>sudo apk add ncurses-dev</code>

After you are done using the menu in the build-NAME folder by doing <code>make menuconfig</code>, you want to remove <code>ncurses-dev</code>. When you are done, it will be stored in ''.config'' which you need to again override the lts.ARCH.config file. When you are done updating the config-NAME.ARCH, you need to do <code>abuild checksum</code>.

The options in the kernel config are typically defaults. If your device is old, it may be set to n by default.

=== Vanilla targets and tuning ===

{|cellpadding="5" border="1" class="wikitable"
!ARCH
!Processor Type / CPU Selection / System Type
!Code Generation / Instruction Extensions
!Timer Frequency
!Preemption Model
!Bitness
|-
|s390x
|IBM zEnterprise 114 and 196
|IBM zBC12 and zEC12 (<code>-march=zEC12 -mtune=zEC12</code>)
|100 Hz
|No Forced Preemption (Server)
|64
|-
|ppc64le
|Server processors
|POWER8 (<code>-mcpu=power8</code>), AltiVec (<code>-Wa,-maltivec</code> to assembler or <code>-maltivec -mabi=altivec</code>), VSX
|100 HZ
|No Forced Preemption (Server)
|64
|-
|ppc
|
512x/52xx/6xx/7xx/74xx/82xx/83xx/86xx
* Apple PowerMac based machines
|AltiVec (<code>-Wa,-maltivec</code> to assembler or <code>-maltivec -mabi=altivec</code>) on >=74xx
|250 HZ
|No Forced Preemption (Server)
|32
|-
|x86_64
|Generic-x86-64
|(-mtune=generic ; SIMD assembly modules enabled based on simple compile test and/or presence of CPU flag)
|300 HZ
|Voluntary Kernel Preemption (Desktop)
|32
|-
|x86
|586/K5/5x86/6x86/6x86MX
|(-mtune=generic ; SIMD assembly modules enabled based on simple compile test and/or presence of CPU flag)
|300 HZ
|Voluntary Kernel Preemption (Desktop)
|32
|-
|armhf
|
* ARMv7 based platforms (Cortex-A, PJ4, Scorpion, Krait)
* Freescale i.MX family -- Cortex A (i.MX51, i.MX53, i.MX6 Quad/DualLite, i.MX6 SoloLite, i.MX6 SoloX, i.MX6 UltraLite, i.MX7 Dual)
* Qualcomm -- (MSM8X60, MSM8960, MSM8974)
* Allwinner SoCs -- (A10 (sun4i), A10s / A13 (sun5i), A31 (sun6i), A20 (sun7i), sun8i Family, (sun9i))
* ARM Ldt Versatile Express family --
|Either <code>-march=armv7-a</code> or <code>-march=armv5t -Wa,-march=armv7-a</code> based on a compile test. <code>-mfpu=vfp</code>
|100 Hz
|Voluntary Kernel Preemption (Desktop)
|32
|-
|aarch64
|
* Allwinner sunxi 64-bit SoC Family
* Broadcom BCM2835 family
* Marvell Berlin SoC Family
* ARMv8 based Samsung Exynos SoC family
* ARMv8 based Freescale Layerscape SoC family
* Hisilicon SoC Family
* Mediatek MT65xx & MT81xx ARMv8 SoC
* Marvell EBU SoC Family
* Qualcomm Platforms
* Rockchip Platforms
* AMD Seattle SoC Family
* Altera's Stratix 10 SoCFPGA Family
* NVIDIA Tegra SoC Family
* Spreadtrum SoC platform
* Cavium Inc. Thunder SoC Family
* ARMv8 software model (Versatile Express)
* AppliedMicro X-Gene SOC Family
* Xilinx ZynqMP Family
|
|300 HZ
|Voluntary Kernel Preemption (Desktop)
|64
|-
|}
If you do desktop multitasking, you may want to switch to Voluntary Kernel Preemption (Desktop) or Preemptible Kernel (Low-Latency Desktop) and up the Timer Frequency. If you run a dedicated render farm node or a dedicated bitcoin miner use No Forced Preemption (Server) and decrease the Timer Frequency.

Optimized modules (most are already compiled as modules):
* raid6 -- altivec, avx512, ssse3, avx2, mmx, sse, sse2, neon
* some operations of raid5 -- mmx (32 bit), sse (64 bit), avx
For Kernel API:
* 32-bit memcpy -- 3dnow
* 32-bit memory page clearing and copying -- sse (Athlon/K7 only), mmx
From x86/crypto, arm/crypto, powerpc/crypto:
* CAMELLIA -- avx2, avx, aes-ni
* CHACHA20 -- avx2, neon
* CAST5 -- avx
* CAST6 -- avx
* TWOFISH -- avx
* SERPENT -- avx2, avx, sse2
* SHA1 -- avx2, ssse3, neon, spe
* SHA2 -- avx2
* SHA256 -- ssse3, neon, spe
* SHA512 -- avx2, ssse3, neon
* POLY1305 -- avx2
* GHASH -- pclmulqdq (part of aes-ni), vmx (power8)
* AES -- aes-ni, neon, vmx (power8), spe
* CRC32 -- pclmulqdq, sse, neon, vmx (power8)
* CRCT10DIF -- pclmulqdq, sse, neon, vmx (power8)

=== Fast reboots with kexec ===

If you want to reboot the kernel fast avoiding the POST test, you need <code>sudo apk add kexec-tools</code> and enable kexec in the kernel:

Processor type and features
[*] kexec system call

=== Hibernation to prevent data loss ===

Power management and ACPI options
[*] Hibernation (aka 'suspend to disk')

Hibernation should be used if you have a laptop. You don't want the laptop to suddenly shut off resulting in data loss, you want it to save your work based on a percentage of battery life (this requires special script). When you do hibernation and when it restores back, it should lock down the computer and ask for prompt. Depending on your needs, the hibernated image can be encrypted/decrypted which again requires additional customization to scripts.

Hibernation with an unsanitized swap file is generally insecure because data and unlocked memory pages is swapped out in plaintext. To increase the security either disable swap (Alpine default) or use an encrypted swap. The swap file/partition is typically used as a dump of the hibernated image.

== Building ==

Before building, you may want to remove as many modules as possible. This will reduce the time to compile greatly. Also, you may want to use [https://github.com/ccache/ccache/ ccache] for faster recompiles especially if you are searching for the minimal set of options or modules to use or include.

You should then do an <code>abuild -r</code> to attempt to build it.

== Installing ==

To install it you do a <code>sudo apk add linux-NAME</code> where NAME is your custom kernel name.

== Testing ==

Before you test, you should install the lts kernel too, using <code>sudo apk add linux-hardened</code>. You may be missing a module and can't boot, so you use the other kernel as the fallback boot kernel. Don't forget to update your bootloader configuration.

To test, first you should make a bootable Alpine USB image. Then, when you have your rescue USB done, you <code>doas reboot</code> the computer.

To test it, you basically do trial and error. Sometimes your config is missing something if you want to have a bare minimum setting.

If you are curious about correctness testing, some kernel modules or components do preform self tests at the beginning of the boot process. The tools may have test suites that you run with the make command.

[[Category:Kernel]]