Arch Linux User Repository

Adding

scripts/config --disable CONFIG_IMA_ARCH_POLICY

to myconfig does solve the "Failed to insert module 'nvidia': Key was rejected by service" problem.

Anyone who configured secure boot using sbctl and want to load dkms modules can try this solution.

This package have several variables to enable/disable features.

##
## The following variables can be customized at build time. Use env or export to change at your wish
##
##   Example: env _microarchitecture=98 use_numa=n use_tracers=n makepkg -sc
##
## Look inside 'choose-gcc-optimization.sh' to choose your microarchitecture
## Valid numbers between: 0 to 99
## Default is: 0 => generic
## Good option if your package is for one machine: 98 (Intel native) or 99 (AMD native)
if [ -z ${_microarchitecture+x} ]; then
  _microarchitecture=0
fi

## Disable NUMA since most users do not have multiple processors. Breaks CUDA/NvEnc.
## Archlinux and Xanmod enable it by default.
## Set variable "use_numa" to: n to disable (possibly increase performance)
##                             y to enable  (stock default)
if [ -z ${use_numa+x} ]; then
  use_numa=y
fi

## Since upstream disabled CONFIG_STACK_TRACER (limits debugging and analyzing of the kernel)
## you can enable them setting this option. Caution, because they have an impact in performance.
## Stock Archlinux has this enabled. 
## Set variable "use_tracers" to: n to disable (possibly increase performance, XanMod default)
##                                y to enable  (Archlinux default)
if [ -z ${use_tracers+x} ]; then
  use_tracers=n
fi

# Unique compiler supported upstream is GCC
## Choose between GCC and CLANG config (default is GCC)
## Use the environment variable "_compiler=clang"
if [ "${_compiler}" = "clang" ]; then
  _compiler_flags="CC=clang HOSTCC=clang LLVM=1 LLVM_IAS=1"
fi

# Choose between the 4 main configs for stable branch. Default x86-64-v1 which use CONFIG_GENERIC_CPU2:
# Possible values: config_x86-64-v1 (default) / config_x86-64-v2 / config_x86-64-v3 / config_x86-64-v4
# This will be overwritten by selecting any option in microarchitecture script
# Source files: https://github.com/xanmod/linux/tree/5.17/CONFIGS/xanmod/gcc
if [ -z ${_config+x} ]; then
  _config=config_x86-64-v1
fi

# Compress modules with ZSTD (to save disk space)
if [ -z ${_compress_modules+x} ]; then
  _compress_modules=n
fi

# Compile ONLY used modules to VASTLY reduce the number of modules built
# and the build time.
#
# To keep track of which modules are needed for your specific system/hardware,
# give module_db script a try: https://aur.archlinux.org/packages/modprobed-db
# This PKGBUILD read the database kept if it exists
#
# More at this wiki page ---> https://wiki.archlinux.org/index.php/Modprobed-db
if [ -z ${_localmodcfg} ]; then
  _localmodcfg=n
fi

# Tweak kernel options prior to a build via nconfig
if [ -z ${_makenconfig} ]; then
  _makenconfig=n
fi

Personally I'm running now xanmod kernel compiled with this:

env _microarchitecture=98 use_tracers=n use_numa=n _localmodcfg=y _compress_modules=y makepkg -sic

Also, you can now create the file myconfig in your local repo to build this package with a custom config or use ${XDG_CONFIG_HOME}/linux-xanmod/myconfig. This file can be a full kernel config or be a script with several entries to add/remove options (you have several examples in PKGBUILD by using scripts/config):

Code involved:

  for _myconfig in "${SRCDEST}/myconfig" "${HOME}/.config/linux-xanmod/myconfig" "${XDG_CONFIG_HOME}/linux-xanmod/myconfig" ; do
    if [ -f "${_myconfig}" ] && [ "$(wc -l <"${_myconfig}")" -gt "0" ]; then
      if grep -q 'scripts/config' "${_myconfig}"; then
        # myconfig is a partial file. Executing as a script
        msg2 "Applying myconfig..."
        bash -x "${_myconfig}"
      else
        # myconfig is a full config file. Replacing default .config
        msg2 "Using user CUSTOM config..."
        cp -f "${_myconfig}" .config
      fi
      echo
      break
    fi
  done

@duht I applied the patch posted, as I tested disabling in a normal way with "scripts/config --disable CONFIG_PER_VMA_LOCK", but when compilation starts it's enabled automatically again. That's why I suposed patch was the right way.

I'll wait a bit until the discussion goes a little further and look for a better patch.

Edit: Finally I added the same patch but v4 (I didn't see it last time) https://lore.kernel.org/lkml/20230706011400.2949242-2-surenb@google.com/T/#md6ecb2cb14e14276e2dc03157d1b2bb255cb77e7

Check if this workaround works for you.

@figue I'm not sure you done it right way...
If you have an existing .config this patch does nothing link.
linux-xanmod already has existing configs (config_x86-64-v*), so you should disable it in config_x86-64-v2 (as this is default in your package now), similar way as Arch did here.

Edit: I installed linux-xanmod 6.4.1-2 from chaoticaur repo and CONFIG_PER_VMA_LOCK is still enabled, conky still freezes:(

@duht thanks. I'm testing the patch

Edit: done 811e14eafebc

Also default config will be config_x86-64-v2

@figue could you disable PER_VMA_LOCK? Vma lock is buggy in 6.4 and causing crashing in some applications link, especially in conky link. Kernel devs decided to disable it by default until fix link, and newest Arch kernel has it also disabled link I'm instaling this package from ChaoticAur repository, so I can't "disable it myself" in PKGBUILD.

@aunjbr thanks. Updated script choose-gcc-optimization.sh

Check new microarchitectures supported!

Please add AMD Zen 4 architecture

I want to apologize because I pushed the package to the EDGE version by mistake. For now, I'll keep at EDGE but the idea is to keep this package following the Stable Mainline [MAIN] branch. Probably for the next release I'll make a new package for the edge. Same for all -bin packages.

Thank you to understand.

Cheers

@mdhishamsayed I'm not using eBPF, so for me it's not a problem. You probably already know the Arch's philosophy, it appeals to follow upstream in their decisions. So, as this is open source and if there is a patch out there to re-enable eBPF you can always add to my PKGBUILD (name it whatever.patch) and automatically will be applied.

Cheers

Enable eBPF i'm a xanmod kernel user and currently, as the eBPF is disabled, i'm unable to run applications which depend on it such as dae and ananicy-cpp, xanmod has good performance as compared to zen and i'm thinking of reverting to xanmod, as the creator is reluctant to do it due to some "Performance Issues", i think that to add better compatibility, eBPF should be enabled

@Riedler flex and bison are in base-devel, which is an implicit make dependency of all AUR packages.