Arch Linux User Repository

Adding

scripts/config --disable CONFIG_IMA_ARCH_POLICY

to myconfig does solve the "Failed to insert module 'nvidia': Key was rejected by service" problem.

Anyone who configured secure boot using sbctl and want to load dkms modules can try this solution.

This package have several variables to enable/disable features.

##
## The following variables can be customized at build time. Use env or export to change at your wish
##
##   Example: env _microarchitecture=98 use_numa=n use_tracers=n makepkg -sc
##
## Look inside 'choose-gcc-optimization.sh' to choose your microarchitecture
## Valid numbers between: 0 to 99
## Default is: 0 => generic
## Good option if your package is for one machine: 98 (Intel native) or 99 (AMD native)
if [ -z ${_microarchitecture+x} ]; then
  _microarchitecture=0
fi

## Disable NUMA since most users do not have multiple processors. Breaks CUDA/NvEnc.
## Archlinux and Xanmod enable it by default.
## Set variable "use_numa" to: n to disable (possibly increase performance)
##                             y to enable  (stock default)
if [ -z ${use_numa+x} ]; then
  use_numa=y
fi

## Since upstream disabled CONFIG_STACK_TRACER (limits debugging and analyzing of the kernel)
## you can enable them setting this option. Caution, because they have an impact in performance.
## Stock Archlinux has this enabled. 
## Set variable "use_tracers" to: n to disable (possibly increase performance, XanMod default)
##                                y to enable  (Archlinux default)
if [ -z ${use_tracers+x} ]; then
  use_tracers=n
fi

# Unique compiler supported upstream is GCC
## Choose between GCC and CLANG config (default is GCC)
## Use the environment variable "_compiler=clang"
if [ "${_compiler}" = "clang" ]; then
  _compiler_flags="CC=clang HOSTCC=clang LLVM=1 LLVM_IAS=1"
fi

# Choose between the 4 main configs for stable branch. Default x86-64-v1 which use CONFIG_GENERIC_CPU2:
# Possible values: config_x86-64-v1 (default) / config_x86-64-v2 / config_x86-64-v3 / config_x86-64-v4
# This will be overwritten by selecting any option in microarchitecture script
# Source files: https://github.com/xanmod/linux/tree/5.17/CONFIGS/xanmod/gcc
if [ -z ${_config+x} ]; then
  _config=config_x86-64-v1
fi

# Compress modules with ZSTD (to save disk space)
if [ -z ${_compress_modules+x} ]; then
  _compress_modules=n
fi

# Compile ONLY used modules to VASTLY reduce the number of modules built
# and the build time.
#
# To keep track of which modules are needed for your specific system/hardware,
# give module_db script a try: https://aur.archlinux.org/packages/modprobed-db
# This PKGBUILD read the database kept if it exists
#
# More at this wiki page ---> https://wiki.archlinux.org/index.php/Modprobed-db
if [ -z ${_localmodcfg} ]; then
  _localmodcfg=n
fi

# Tweak kernel options prior to a build via nconfig
if [ -z ${_makenconfig} ]; then
  _makenconfig=n
fi

Personally I'm running now xanmod kernel compiled with this:

env _microarchitecture=98 use_tracers=n use_numa=n _localmodcfg=y _compress_modules=y makepkg -sic

Also, you can now create the file myconfig in your local repo to build this package with a custom config or use ${XDG_CONFIG_HOME}/linux-xanmod/myconfig. This file can be a full kernel config or be a script with several entries to add/remove options (you have several examples in PKGBUILD by using scripts/config):

Code involved:

  for _myconfig in "${SRCDEST}/myconfig" "${HOME}/.config/linux-xanmod/myconfig" "${XDG_CONFIG_HOME}/linux-xanmod/myconfig" ; do
    if [ -f "${_myconfig}" ] && [ "$(wc -l <"${_myconfig}")" -gt "0" ]; then
      if grep -q 'scripts/config' "${_myconfig}"; then
        # myconfig is a partial file. Executing as a script
        msg2 "Applying myconfig..."
        bash -x "${_myconfig}"
      else
        # myconfig is a full config file. Replacing default .config
        msg2 "Using user CUSTOM config..."
        cp -f "${_myconfig}" .config
      fi
      echo
      break
    fi
  done

git.archlinux.org is dead, therefore, sphinx-workaround.patch can't be downloaded.

@Logical_Master try to add to MODULES and install the package again (only install with pacman -U, not build). Perhaps you have to add to vfat to /etc/modules-load.d/vfat.conf

@figue They are both present in the modprobed.db file. Should I add "vfat" to the MODULES array in /etc/mkinitcpio.conf?

@Logical_Master ensure that ext4 and vfat are in ~/.config/modprobed.db

@figue it says command not found

Edit: Booting into the mainline kernel, it says ext4 for root and vfat for efi

@Logical_Master what's your "lsblk -f" output? You need to add the correct FS type.

@figue What exactly do I need to add to those files?

Edit: (i.e) The exact text / name of the module

Edit 2: I added "ext4" in modprobed.db and in the modules array, rebuilt the kernel and initramfs. Still getting the same error

@Logical_Master probably your root fs type is not built because _localmodcfg

Check if your FS is in $HOME/.config/modprobed.db and in MODULES array (/etc/mkinitcpio.conf).

I built the xanmod 5.12.11 and 5.12.12. There are no errors during build and after booting into the kernel, I get this error. " Starting version 240.x ERROR: device 'UUID=xxx-...' not found. Skipping fsck. mount: /new_root: can't find UUID=xxx... You are now being dropped into an emergency shell. sh: can't access tty; job control turned off [rootfs ]# "

I built with custom microarchitecture and modprobed-db

My /etc/mkinitcpio.conf -->

SPDX-License-Identifier: GPL-3.0-or-later

vim:set ft=sh

MODULES

The following modules are loaded before any boot hooks are

run. Advanced users may wish to specify all system modules

in this array. For instance:

MODULES=(piix ide_disk reiserfs)

MODULES=(i915)

BINARIES

This setting includes any additional binaries a given user may

wish into the CPIO image. This is run last, so it may be used to

override the actual binaries included by a given hook

BINARIES are dependency parsed, so you may safely ignore libraries

BINARIES=()

FILES

This setting is similar to BINARIES above, however, files are added

as-is and are not parsed in any way. This is useful for config files.

FILES=""

HOOKS

This is the most important setting in this file. The HOOKS control the

modules and scripts added to the image, and what happens at boot time.

Order is important, and it is recommended that you do not change the

order in which HOOKS are added. Run 'mkinitcpio -H <hook name>' for

help on a given hook.

'base' is required unless you know precisely what you are doing.

'udev' is required in order to automatically load modules

'filesystems' is required unless you specify your fs modules in MODULES

Examples:

This setup specifies all modules in the MODULES setting above.

No raid, lvm2, or encrypted root is needed.

HOOKS=(base)

This setup will autodetect all modules for your system and should

work as a sane default

HOOKS=(base udev autodetect block filesystems)

This setup will generate a 'full' image which supports most systems.

No autodetection is done.

HOOKS=(base udev block filesystems)

This setup assembles a pata mdadm array with an encrypted root FS.

Note: See 'mkinitcpio -H mdadm' for more information on raid devices.

HOOKS=(base udev block mdadm encrypt filesystems)

This setup loads an lvm2 volume group on a usb device.

HOOKS=(base udev block lvm2 filesystems)

NOTE: If you have /usr on a separate partition, you MUST include the

usr, fsck and shutdown hooks.

HOOKS="base udev autodetect modconf block keyboard keymap filesystems"

COMPRESSION

Use this to compress the initramfs image. By default, gzip compression

is used. Use 'cat' to create an uncompressed image.

COMPRESSION="gzip"

COMPRESSION="bzip2"

COMPRESSION="lzma"

COMPRESSION="xz"

COMPRESSION="lzop"

COMPRESSION="lz4"

COMPRESSION_OPTIONS

Additional options for the compressor

COMPRESSION_OPTIONS=(-9)