Arch Linux User Repository

The PKGBUILD file supports a few different configurable build-time options:

• _makenconfig Tweak kernel options prior to a build via nconfig. Pseudo-graphical menu based on ncurses. 1 2
• _localmodcfg Only compile active modules to VASTLY reduce the number of modules built and the build time.
• Please read arch wiki page for detailed explanation on how to use it.
• _subarch Enable additional optimization/tuning for kernel builds by adding more micro-architectures options. Default is Generic-x86-64 number 36 if nothing else is selected.
• PKGBUILD file with the list of architectures
• graysky kernel_compiler_patch
• _use_current Use the current kernel's .config file. Enabling this option will use the .config of the RUNNING kernel rather than the ARCH defaults. Useful when the package gets updated and you already went through the trouble of customizing your config options. NOT recommended when a new kernel is released, but again, convenient for package bumps.
• _use_llvm_lto Compile the kernel with LLVM/Clang.
• _debug Enable y some additional debug features present in arch kernel, but not in Clear upstream. n to force disable or leave empty to ignore.

Lastly, build the kernel by setting your environment variable env _subarch=40 _localmodcfg=y.

1. Binaries available in my repo: http://download.opensuse.org/repositories/home:/metakcahura:/kernel/Arch_Extra_standard/x86_64/

[home_metakcahura_kernel_Arch_Extra_standard]
SigLevel = Never
Server = http://download.opensuse.org/repositories/home:/metakcahura:/kernel/Arch_Extra_standard/$arch

THIS IS OPTIONAL:

2. After install adjust your boot cmd line. ClearLinux uses clr-boot-manager which takes care of that. This is upstream default:

quiet console=tty0 console=ttyS0,115200n8 cryptomgr.notests initcall_debug intel_iommu=igfx_off kvm-intel.nested=1 no_timer_check noreplace-smp page_alloc.shuffle=1 rcupdate.rcu_expedited=1 rootfstype=ext4,btrfs,xfs,f2fs tsc=reliable rw 

@Osleg Yes, the easier choice is to not use initrd /intel-ucode.img (clr default), otherwise the build would fail and require some adjustments/patching.

Hm, I just realized that linux-clear also has ucode built in so we either should not initrd /intel-ucode.img or should not compile it with clear... I think first option is better to follow intel's kernel as close as possible.

@metak unfortunately I have no idea. The boot process goes well until the end and it stuck when starting to load graphical.target. I could boot into single user mode but that doesn't help in any way :/

And yay for the module.sig_unenforce, will try that... in recovery mode tho :(

@Osleg Do you have any idea what might be the problem? Btw, clr-team introduced new patch in their latest commit called Add boot option to allow unsigned modules so that's why I removed that sed line from pkgbuild.

+Add module.sig_unenforce boot parameter to allow loading unsigned kernel
 +modules. Parameter is only effective if CONFIG_MODULE_SIG_FORCE is
 +enabled and system is *not* SecureBooted.

https://github.com/clearlinux-pkgs/linux/commit/347ebb59a916a6fd112663d68e0b72623f6994f7

Just to be exact, it stopped working even before update back when it was 4.15.15

Have no idea what happened but the kernel stopped working for me. It reaches target graphical and then laptop hangs. :/

@Osleg I disabled CONFIG_MODULE_SIG_FORCE by default and if anyone wants to turn it on just comment that line in pkgbuild.

The main issue with modules not loading is that clear has CONFIG_MODULE_SIG and CONFIG_MODULE_SIG_FORCE enabled. Meaning most of the "custom" modules won't load. The workaround that I'm using for that is to sign those modules manually as described here https://www.kernel.org/doc/html/v4.10/admin-guide/module-signing.html

Tho I think it might be a good idea to disable CONFIG_MODULE_SIG_FORCE or at least provide a config for PKGBUILD to disable it for those who want. as this setting is good for hardened kernel for servers and such. For desktop machines, especially for developers, this setting provides nothing but pain :)

https://arstechnica.com/gadgets/2018/02/intel-releases-new-spectre-microcode-update-for-skylake-other-chips-remain-in-beta/

But I don't see the microcode for linux on Intel's website yet.