document/TranslateProject
2
0
Fork 0
mirror of https://github.com/LCTT/TranslateProject.git synced 2025-02-22 00:40:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

Translated by qhwdw

Browse Source
This commit is contained in:
qhwdw 2018-10-10 15:48:04 +08:00
parent 1af6fbeb0b
commit 5357f94d58
2 changed files with 139 additions and 140 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

140
sources/tech/20180824 What Stable Kernel Should I Use.md
View File

@ -1,140 +0,0 @@
Translating by qhwdw
What Stable Kernel Should I Use?
======
I get a lot of questions about people asking me about what stable kernel should they be using for their product/device/laptop/server/etc. all the time. Especially given the now-extended length of time that some kernels are being supported by me and others, this isn’t always a very obvious thing to determine. So this post is an attempt to write down my opinions on the matter. Of course, you are free to use what ever kernel version you want, but here’s what I recommend.
As always, the opinions written here are my own, I speak for no one but myself.
### What kernel to pick
Here’s the my short list of what kernel you should use, raked from best to worst options. I’ll go into the details of all of these below, but if you just want the summary of all of this, here it is:
Hierarchy of what kernel to use, from best solution to worst:
* Supported kernel from your favorite Linux distribution
* Latest stable release
* Latest LTS release
* Older LTS release that is still being maintained
What kernel to never use:
* Unmaintained kernel release
To give numbers to the above, today, as of August 24, 2018, the front page of kernel.org looks like this:
![][1]
So, based on the above list that would mean that:
* 4.18.5 is the latest stable release
* 4.14.67 is the latest LTS release
* 4.9.124, 4.4.152, and 3.16.57 are the older LTS releases that are still being maintained
* 4.17.19 and 3.18.119 are “End of Life” kernels that have had a release in the past 60 days, and as such stick around on the kernel.org site for those who still might want to use them.
Quite easy, right?
Ok, now for some justification for all of this:
### Distribution kernels
The best solution for almost all Linux users is to just use the kernel from your favorite Linux distribution. Personally, I prefer the community based Linux distributions that constantly roll along with the latest updated kernel and it is supported by that developer community. Distributions in this category are Fedora, openSUSE, Arch, Gentoo, CoreOS, and others.
All of these distributions use the latest stable upstream kernel release and make sure that any needed bugfixes are applied on a regular basis. That is the one of the most solid and best kernel that you can use when it comes to having the latest fixes ([remember all fixes are security fixes][2]) in it.
There are some community distributions that take a bit longer to move to a new kernel release, but eventually get there and support the kernel they currently have quite well. Those are also great to use, and examples of these are Debian and Ubuntu.
Just because I did not list your favorite distro here does not mean its kernel is not good. Look on the web site for the distro and make sure that the kernel package is constantly updated with the latest security patches, and all should be well.
Lots of people seem to like the old, “traditional” model of a distribution and use RHEL, SLES, CentOS or the “LTS” Ubuntu release. Those distros pick a specific kernel version and then camp out on it for years, if not decades. They do loads of work backporting the latest bugfixes and sometimes new features to these kernels, all in a Quixote quest to keep the version number from never being changed, despite having many thousands of changes on top of that older kernel version. This work is a truly thankless job, and the developers assigned to these tasks do some wonderful work in order to achieve these goals. If you like never seeing your kernel version number change, then use these distributions. They usually cost some money to use, but the support you get from these companies is worth it when something goes wrong.
So again, the best kernel you can use is one that someone else supports, and you can turn to for help. Use that support, usually you are already paying for it (for the enterprise distributions), and those companies know what they are doing.
But, if you do not want to trust someone else to manage your kernel for you, or you have hardware that a distribution does not support, then you want to run the Latest stable release:
### Latest stable release
This kernel is the latest one from the Linux kernel developer community that they declare as “stable”. About every three months, the community releases a new stable kernel that contains all of the newest hardware support, the latest performance improvements, as well as the latest bugfixes for all parts of the kernel. Over the next 3 months, bugfixes that go into the next kernel release to be made are backported into this stable release, so that any users of this kernel are sure to get them as soon as possible.
This is usually the kernel that most community distributions use as well, so you can be sure it is tested and has a large audience of users. Also, the kernel community (all 4000+ developers) are willing to help support users of this release, as it is the latest one that they made.
After 3 months, a new kernel is released and you should move to it to ensure that you stay up to date, as support for this kernel is usually dropped a few weeks after the newer release happens.
If you have new hardware that is purchased after the last LTS release came out, you almost are guaranteed to have to run this kernel in order to have it supported. So for desktops or new servers, this is usually the recommended kernel to be running.
### Latest LTS release
If your hardware relies on a vendors out-of-tree patch in order to make it work properly (like almost all embedded devices these days), then the next best kernel to be using is the latest LTS release. That release gets all of the latest kernel fixes that goes into the stable releases where applicable, and lots of users test and use it.
Note, no new features and almost no new hardware support is ever added to these kernels, so if you need to use a new device, it is better to use the latest stable release, not this release.
Also this release is common for users that do not like to worry about “major” upgrades happening on them every 3 months. So they stick to this release and upgrade every year instead, which is a fine practice to follow.
The downsides of using this release is that you do not get the performance improvements that happen in newer kernels, except when you update to the next LTS kernel, potentially a year in the future. That could be significant for some workloads, so be very aware of this.
Also, if you have problems with this kernel release, the first thing that any developer whom you report the issue to is going to ask you to do is, “does the latest stable release have this problem?” So you will need to be aware that support might not be as easy to get as with the latest stable releases.
Now if you are stuck with a large patchset and can not update to a new LTS kernel once a year, perhaps you want the older LTS releases:
### Older LTS release
These releases have traditionally been supported by the community for 2 years, sometimes longer for when a major distribution relies on this (like Debian or SLES). However in the past year, thanks to a lot of suport and investment in testing and infrastructure from Google, Linaro, Linaro member companies, [kernelci.org][3], and others, these kernels are starting to be supported for much longer.
Here’s the latest LTS releases and how long they will be supported for, as shown at [kernel.org/category/releases.html][4] on August 24, 2018:
![][5]
The reason that Google and other companies want to have these kernels live longer is due to the crazy (some will say broken) development model of almost all SoC chips these days. Those devices start their development lifecycle a few years before the chip is released, however that code is never merged upstream, resulting in a brand new chip being released based on a 2 year old kernel. These SoC trees usually have over 2 million lines added to them, making them something that I have started calling “Linux-like” kernels.
If the LTS releases stop happening after 2 years, then support from the community instantly stops, and no one ends up doing bugfixes for them. This results in millions of very insecure devices floating around in the world, not something that is good for any ecosystem.
Because of this dependency, these companies now require new devices to constantly update to the latest LTS releases as they happen for their specific release version (i.e. every 4.9.y release that happens). An example of this is the Android kernel requirements for new devices shipping for the “O” and now “P” releases specified the minimum kernel version allowed, and Android security releases might start to require those “.y” releases to happen more frequently on devices.
I will note that some manufacturers are already doing this today. Sony is one great example of this, updating to the latest 4.4.y release on many of their new phones for their quarterly security release. Another good example is the small company Essential which has been tracking the 4.4.y releases faster than anyone that I know of.
There is one huge caveat when using a kernel like this. The number of security fixes that get backported are not as great as with the latest LTS release, because the traditional model of the devices that use these older LTS kernels is a much more reduced user model. These kernels are not to be used in any type of “general computing” model where you have untrusted users or virtual machines, as the ability to do some of the recent Spectre-type fixes for older releases is greatly reduced, if present at all in some branches.
So again, only use older LTS releases in a device that you fully control, or lock down with a very strong security model (like Android enforces using SELinux and application isolation). Never use these releases on a server with untrusted users, programs, or virtual machines.
Also, support from the community for these older LTS releases is greatly reduced even from the normal LTS releases, if available at all. If you use these kernels, you really are on your own, and need to be able to support the kernel yourself, or rely on you SoC vendor to provide that support for you (note that almost none of them do provide that support, so beware…)
### Unmaintained kernel release
Surprisingly, many companies do just grab a random kernel release, slap it into their product and proceed to ship it in hundreds of thousands of units without a second thought. One crazy example of this would be the Lego Mindstorm systems that shipped a random -rc release of a kernel in their device for some unknown reason. A -rc release is a development release that not even the Linux kernel developers feel is ready for everyone to use just yet, let alone millions of users.
You are of course free to do this if you want, but note that you really are on your own here. The community can not support you as no one is watching all kernel versions for specific issues, so you will have to rely on in-house support for everything that could go wrong. Which for some companies and systems, could be just fine, but be aware of the “hidden” cost this might cause if you do not plan for this up front.
### Summary
So, here’s a short list of different types of devices, and what I would recommend for their kernels:
* Laptop / Desktop: Latest stable release
* Server: Latest stable release or latest LTS release
* Embedded device: Latest LTS release or older LTS release if the security model used is very strong and tight.
And as for me, what do I run on my machines? My laptops run the latest development kernel (i.e. Linus’s development tree) plus whatever kernel changes I am currently working on and my servers run the latest stable release. So despite being in charge of the LTS releases, I don’t run them myself, except in testing systems. I rely on the development and latest stable releases to ensure that my machines are running the fastest and most secure releases that we know how to create at this point in time.
--------------------------------------------------------------------------------
via: http://kroah.com/log/blog/2018/08/24/what-stable-kernel-should-i-use/
作者：[Greg Kroah-Hartman][a]
选题：[lujun9972](https://github.com/lujun9972)
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://kroah.com
[1]:https://s3.amazonaws.com/kroah.com/images/kernel.org_2018_08_24.png
[2]:http://kroah.com/log/blog/2018/02/05/linux-kernel-release-model/
[3]:https://kernelci.org/
[4]:https://www.kernel.org/category/releases.html
[5]:https://s3.amazonaws.com/kroah.com/images/kernel.org_releases_2018_08_24.png

139
translated/tech/20180824 What Stable Kernel Should I Use.md Normal file
View File

@ -0,0 +1,139 @@
我应该使用哪些稳定版内核？
======
很多人都问我这样的问题，在他们的产品/设备/笔记本/服务器等上面应该使用什么样的稳定版内核。一直以来，尤其是那些现在已经延长支持时间的内核，都是由我和其他人提供支持，因此，给出这个问题的答案并不是件容易的事情。因此这篇文章我将尝试去给出我在这个问题上的看法。当然，你可以任意选用任何一个你想去使用的内核版本，这里只是我的建议。
和以前一样，在这里给出的这些看法只代表我个人的意见。
### 可选择的内核有哪些
下面列出了我建议你应该去使用的内核的列表，从最好的到最差的都有。我在下面将详细介绍，但是如果你只想得到一个结论，它就是你想要的：
建议你使用的内核的分级，从最佳的方案到最差的方案如下：
* 你最喜欢的 Linux 发行版支持的内核
* 最新的稳定版
* 最新的 LTS 发行版
* 仍然处于维护状态的老的 LTS 发行版
绝对不要去使用的内核：
* 不再维护的内核发行版
给上面的列表给出具体的数字，今天是 2018 年 8 月 24 日，kernel.org 页面上可以看到是这样：
![][1]
因此，基于上面的列表，那它应该是：
* 4.18.5 是最新的稳定版
* 4.14.67 是最新的 LTS 发行版
* 4.9.124、4.4.152、以及 3.16.57 是仍然处于维护状态的老的 LTS 发行版
* 4.17.19 和 3.18.119 是过去 60 天内 “生命周期终止” 的内核版本，它们仍然保留在 kernel.org 站点上，是为了仍然想去使用它们的那些人。
非常容易，对吗？
Ok，现在我给出这样选择的一些理由：
### Linux 发行版内核
对于大多数 Linux 用户来说，最好的方案就是使用你喜欢的 Linux 发行版的内核。就我本人而言，我比较喜欢基于社区的、内核不断滚动升级的用最新内核的 Linux 发行版，并且它也是由开发者社区来支持的。这种类型的发行版有 Fedora、openSUSE、Arch、Gentoo、CoreOS、以及其它的。
所有这些发行版都使用了上游的最新的稳定版内核，并且确保定期打了需要的 bug 修复补丁。当它拥有了最新的修复之后（[记住所有的修复都是安全修复][2])，这就是你可以使用的最安全、最好的内核之一。
有些社区的 Linux 发行版需要很长的时间才发行一个新内核的发行版，但是最终发行的版本和所支持的内核都是非常好的。这些也都非常好用，Debian 和 Ubuntu 就是这样的例子。
我没有在这里列出你所喜欢的发行版，并不是意味着它们的内核不够好。查看这些发行版的网站，确保它们的内核包是不断应用最新的安全补丁进行升级过的，那么它就应该是很好的。
许多人好像喜欢旧的、“传统” 模式的发行版，以及使用 RHEL、SLES、CentOS 或者 “LTS” Ubuntu 发行版。这些发行版挑选一个特定的内核版本，然后使用好几年，而不是几十年。他们移植了最新的 bug 修复，有时也有一些内核的新特性，所有的只是追求堂吉诃德式的保持版本号不变而已，尽管他们已经在那个旧的内核版本上做了成千上万的变更。这其实是一个吃力不讨好的工作，开发者分配去做这些任务，看上去做的很不错，其实就是为了实现这些目标。如果你从来没有看到你的内核版本号发生过变化，而仍然在使用这些发行版。他们通常会为使用而付出一些成本，当发生错误时能够从这些公司得到一些支持，那就是值得的。
所以，你能使用的最好的内核是你可以求助于别人，而别人可以为你提供支持的内核。使用那些支持，你通常都已经为它支付过费用了（对于企业发行版），而这些公司也知道他们职责是什么。
但是，如果你不希望去依赖别人，而是希望你自己管理你的内核，或者你有发行版不支持的硬件，那么你应该去使用最新的稳定版：
### 最新的稳定版
最新的稳定版内核是 Linux 内核开发者社区宣布为“稳定版”的最新的一个内核。大约每三个月，社区发行一个包含了对所有新硬件支持的、新的稳定版内核，最新版的内核不但改善内核性能，同时还包含内核各部分的 bug 修复。再经过三个月之后，进入到下一个内核版本的 bug 修复将被移植进入这个稳定版内核中，因此，使用这个内核版本的用户将确保立即得到这些修复。
最新的稳定版内核通常也是主流社区发行版使用的较好的内核，因此你可以确保它是经过测试和拥有大量用户使用的内核。另外，内核社区（全部开发者超过 4000 人）也将帮助这个发行版提供对用户的支持，因为这是他们做的最新的一个内核。
三个月之后，将发行一个新的稳定版内核，你应该去更新到它以确保你的内核始终是最新的稳定版，当最新的稳定版内核发布之后，对你的当前稳定版内核的支持通常会落后几周时间。
如果你在上一个 LTS 版本发布之后购买了最新的硬件，为了能够支持最新的硬件，你几乎是绝对需要去运行这个最新的稳定版内核。对于台式机或新的服务器，它们通常需要运行在它们推荐的内核版本上。
### 最新的 LTS 发行版
如果你的硬件为了保证正常运行（像大多数的嵌入式设备），需要依赖供应商的源码树外的补丁，那么对你来说，最好的内核版本是最新的 LTS 发行版。这个发行版拥有所有进入稳定版内核的最新 bug 修复，以及大量的用户测试和使用。
请注意，这个最新的 LTS 发行版没有新特性，并且也几乎不会增加对新硬件的支持，因此，如果你需要使用一个新设备，那你的最佳选择就是最新的稳定版内核，而不是最新的 LTS 版内核。
另外，对于这个 LTS 发行版内核的用户来说，他也不用担心每三个月一次的“重大”升级。因此，他们将一直坚持使用这个 LTS 内核发行版，并每年升级一次，这是一个很好的实践。
使用这个 LTS 发行版的不利方面是，你没法得到在最新版本内核上实现的内核性能提升，除非在未来的一年中，你升级到下一个 LTS 版内核。
另外，如果你使用的这个内核版本有问题，你所做的第一件事情就是向任意一位内核开发者报告发生的问题，并向他们询问，“最新的稳定版内核中是否也存在这个问题？”并且，你将意识到，对它的支持不会像使用最新的稳定版内核那样容易得到。
现在，如果你坚持使用一个有大量的补丁集的内核，并且不希望升级到每年一次的新 LTS 内核版本上，那么，或许你应该去使用老的 LTS 发行版内核：
### 老的 LTS 发行版
这些发行版传统上都由社区提供 2 年时间的支持，有时候当一个重要的 Linux 发行版（像 Debian 或 SLES 一样）依赖它时，这个支持时间会更长。然而在过去一年里，感谢 Google、Linaro、Linaro 成员公司、[kernelci.org][3]、以及其它公司在测试和基础设施上的大量投入，使得这些老的 LTS 发行版内核得到更长时间的支持。
这是最新的 LTS 发行版，它们将被支持多长时间，这是 2018 年 8 月 24 日显示在 [kernel.org/category/releases.html][4] 上的信息：
![][5]
Google 和其它公司希望这些内核使用的时间更长的原因是，由于现在几乎所有的 SoC 芯片的疯狂（也有人说是打破常规）的开发模型。这些设备在芯片发行前几年就启动了他们的开发生命周期，而那些代码从来不会合并到上游，最终结果是始终在一个分支中，新的芯片基于一个 2 年以前的老内核发布。这些 SoC 的代码树通常增加了超过 200 万行的代码，这使得它们成为我们前面称之为“类 Linux 内核“的东西。
如果在 2 年后，这个 LTS 发行版停止支持，那么来自社区的支持将立即停止，并且没有人对它再进行 bug 修复。这导致了在全球各地数以百万计的不安全设备仍然在使用中，这对任何生态系统来说都不是什么好事情。
由于这种依赖，这些公司现在要求新设备不断更新到最新的 LTS 发行版，而这些特定的发行版（即每个 4.9.y 发行版）就是为它们发行的。其中一个这样的例子就是新 Android 设备对内核版本的要求，这些新设备的 “O” 版本和现在的 “P” 版本指定了最低允许使用的内核版本，并且在设备上越来越频繁升级的、安全的 Android 发行版开始要求使用这些 “.y” 发行版。
我注意到一些生产商现在已经在做这些事情。Sony 是其中一个非常好的例子，在他们的大多数新手机上，通过他们每季度的安全发行版，将设备更新到最新的 4.4.y 发行版上。另一个很好的例子是一家小型公司 Essential，他们持续跟踪 4.4.y 发行版，据我所知，他们发布新版本的速度比其它公司都快。
当使用这种很老的内核时有个重大警告。移植到这种内核中的 bug 修复比起最新版本的 LTS 内核来说数量少很多，因为这些使用很老的 LTS 内核的传统设备型号要远少于现在的用户使用的型号。如果你打算将它们用在有不可信的用户或虚拟机的地方，那么这些内核将不再被用于任何”通用计算“的模型中，因为对于这些内核不会去做像最近的 Spectre 这样的修复，如果在一些分支中存在这样的 bug，那么将极大地降低安全性。
因此，仅当在你能够完全控制的设备中使用老的 LTS 发行版，或者是使用在有一个非常强大的安全模型（像 Android 一样强制使用 SELinux 和应用程序隔离）去限制的情况下。绝对不要在有不可信用户、程序、或虚拟机的服务器上使用这些老的 LTS 发行版内核。
此外，如果社区对它有支持的话，社区对这些老的 LTS 内核发行版相比正常的 LTS 内核发行版的支持要少的多。如果你使用这些内核，那么你只能是一个人在战斗，你需要有能力去独自支持这些内核，或者依赖你的 SoC 供应商为你提供支持（需要注意的是，对于大部分供应商来说是不会为你提供支持的，因此，你要特别注意 …）。
### 不再维护的内核发行版
更让人感到惊讶的事情是，许多公司只是随便选一个内核发行版，然后将它封装到它们的产品里，并将它毫不犹豫地承载到数十万的部件中。其中一个这样的糟糕例子是 Lego Mindstorm 系统，不知道是什么原因在它们的设备上随意选取了一个 `-rc` 的内核发行版。`-rc` 的发行版是开发中的版本，Linux 内核开发者认为它根本就不适合任何人使用，更不用说是数百万的用户了。
当然，如果你愿意，你可以随意地使用它，但是需要注意的是，可能真的就只有你一个人在使用它。社区不会为你提供支持，因为他们不可能关注所有内核版本的特定问题，因此如果出现错误，你只能独自去解决它。对于一些公司和系统来说，这么做可能还行，但是如果没有为此有所规划，那么要当心因此而产生的”隐性“成本。
### 总结
基于以上原因，下面是一个针对不同类型设备的简短列表，这些设备我推荐适用的内核如下：
* 笔记本 / 台式机：最新的稳定版内核
* 服务器：最新的稳定版内核或最新的 LTS 版内核
* 嵌入式设备：最新的 LTS 版内核或老的 LTS 版内核（如果使用的安全模型非常强大和严格）
至于我，在我的机器上运行什么样的内核？我的笔记本运行的是最新的开发版内核（即 Linus 的开发树）再加上我正在做修改的内核，我的服务器上运行的是最新的稳定版内核。因此，尽管我负责 LTS 发行版的支持工作，但我自己并不使用 LTS 版内核，除了在测试系统上。我依赖于开发版和最新的稳定版内核，以确保我的机器运行的是目前我们所知道的最快的也是最安全的内核版本。
--------------------------------------------------------------------------------
via: http://kroah.com/log/blog/2018/08/24/what-stable-kernel-should-i-use/
作者：[Greg Kroah-Hartman][a]
选题：[lujun9972](https://github.com/lujun9972)
译者：[qhwdw](https://github.com/qhwdw)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://kroah.com
[1]:https://s3.amazonaws.com/kroah.com/images/kernel.org_2018_08_24.png
[2]:http://kroah.com/log/blog/2018/02/05/linux-kernel-release-model/
[3]:https://kernelci.org/
[4]:https://www.kernel.org/category/releases.html
[5]:https://s3.amazonaws.com/kroah.com/images/kernel.org_releases_2018_08_24.png