FreeBSD system upgrade/kernel upgrade 2

1. Kernel hardening
Let's check hierarchy of files we need.
I assume you have source in your computer according this post.

cd /usr/src/sys/amd64/conf

You can copy files I'll write about to /root/kernel etc.

GENERIC: 

-full default kernel configuration used for standard installation

NOTES:

-additional options with explanations which you can stick to your own kernel
-Notes in amd64 dir. are just for amd64 architecture. There are another "Notes" in "/usr/src/sys/conf" dir. which should be valid for all architectures. Notice that "universal" "Notes" are much bigger than arch. specific.

MY_OWN_KERNEL:

-according to post I have sym link of my own kernel configuration from home directory to this location
-do not edit GENERIC. Copy GENERIC to your own named file.

What you should do before you start:

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

- check if your source tree is one you want to have. Make sure you are downloading right version of source via "cvsup" file.
- be aware, mainly with major upgrade, GENERIC and other files may change. Imagine you have old renamed GENERIC in your home dir. and new in the source tree. This inconsistency may cause real problems.
- be aware, with mainly with major upgrade (from one release to another), also "world" is changing. Serious problems may happen if you have old "world" and new kernel and modules. It has happened to me, and getting all in to the "working" state is really annoying, time consuming, googling...
- with updating kernel due to adding/removing options, there shouldn't be problem with "world" but be aware there can be association with it or other part of source.
- most of the problems during compilation and afterward reboot are created by INCONSISTENCY.
- as time goes, you'll forget what have you changed in kernel configuration. Maybe in further time, you will add new peripheral or you will need something what you have disabled in kernel configuration. So be aware, if something is not working, the problem can be the issue you don't have enabled adequate support in kernel
- Have prepared backup plan in case you can't boot. Etc. you can bump into problem after reboot with mounting issues. Disks have different names as in "/etc/fstab". Download live linux CD or FreeBSD live CD.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 

What to have in kernel and what not:

After first clean installation, or before upgrade, check "dmesg" command. With this report you know which peripherals you have. So logically, in kernel, you can remove the rest, simply said.
Hardware you have permanently should be compiled within kernel, rest can be compiled as modules. On the internet, you find many diverse opinions about it.
Components compiled within kernel are considered to work faster. I don't think there is noticeable difference.
Another opinion is, that modules are more susceptible to modifications by intruders etc., as they are loading after reboot or on fly as separated files. So it's security issue.
Here is the brief of my KERNEL.

MY_OWN_KERNEL:

##############

cpu             HAMMER - in amd64 there is no other option
ident           MY_OWN_KERNEL - name of your configuration
makeoptions     DEBUG=-g
#
options         SCHED_ULE
...
...
device          pci
#From SCHED_ULE to pci, I suggest to leave it as it is. They ensure main #function of the system. But if you are sure you don't need something, #comment out particular line. Etc. IPV6, NFS, MSDOSFS, CD9660...
added: options         COMPAT_LINUX32 -  instead of module
removed: floppy
ATA controllers: leaved
SCSI controllers: removed
ATA/SCSI peripherals: leaved
RAID controllers: removed
Keyboard + PS/2: leaved
AGP: removed
PCMCIA: removed
SERIAL: removed
PARALLEL PORT: removed
NICs: all removed except: miibus, alc, ale - leave miibus and NIC you have
ISA NICs: removed
WLAN: all removed except:
wlan
IEEE80211_DEBUG
IEEE80211_AMPDU_AGE
IEEE80211_SUPPORT_MESH
wlan_wep
wlan_ccmp
wlan_tkip
wlan_amrr
ipw + iwi + iwn - mine. Leave your NIC
Pseudo devices: leaved
device          bpf: leaved
USB support: leaved
...
All after USB support I removed. Sound as well, I'll use module for it.

############## 

Looking back, notice I removed a lot I don't need. Kernel is now much lighter.      

2. Kernel additional features 

What I can see interesting from amd64 "NOTES" to implement to kernel:

-watchdog (software/hw)
-device polling
-VESA
-I2C
-LINPROCFS

What I can see interesting from general "NOTES" to implement to kernel:

-disk encryption
-IPSEC
-ALTQ
-PF of course
-bridge interface
-link aggregation
-IPSEC interface
-IPFIREWALL - I use PF
-QUOTA

With traditional way, as you compile kernel, you compile modules in the same time. There are hundreds of modules, together they have cca 300MB I think.
There is is way how to compile kernel and modules separately. In next post.

Last post about upgrade will be about separate compilation kernel/modules, "make.conf" adjustment, multi-thread compilation, compilation using ram-disk.