mok

For signing Dragon Kernel for EFI Boot with your MOK

$ openssl x509 -in /var/lib/shim-signed/mok/MOK.der -inform DER -outform PEM -out ~/MOK.pem
$ sudo add-apt-repository ppa:wip-kernel/genv5
$ sudo apt-get update
$ sudo apt install linux-headers-5.1.13-dragon linux-headers-5.1.13-dragon-generic linux-image-unsigned-5.1.13-dragon-generic linux-modules-5.1.13-dragon-generic linux-modules-extra-5.1.13-dragon-generic
$ sudo sbsign --key /var/lib/shim-signed/mok/MOK.priv --cert ~/MOK.pem /boot/vmlinuz-5.1.13-dragon-generic --output /boot/vmlinuz-5.1.13-dragon-generic.signed
$ sudo cp /boot/initrd.img-5.1.13-dragon-generic{,.signed}
$ sudo update-grub
$ reboot
$ sudo rm /boot/vmlinuz-5.1.13-dragon-generic
$ sudo rm /boot/initrd.img-5.1.13-dragon-generic
$ sudo update-grub
$ reboot

Thanks Edgard Pineda “epineda”


iptables

Fixes work IPTABLES for Dragon Kernel

It is strongly recommended to use the iptables package only from the PPA Linux WIP-Kernel team:

$ sudo add-apt-repository ppa:wip-kernel/iptables
$ sudo apt update
$ sudo apt dist-upgrade -y

Package version - iptables (1.8.2-4ubuntu1)


i915

Fixes booting kernel for i915 video chipset

If kernel starting and boot screen black or boot process stop then:

From boot grub menu enter “e” key and edit kernel boot line and press F10 for boot.


ALSA-LIB

Alsa v1.1.8 PPA (only for Ubuntu Cosmic)

It is strongly recommended to use the packeges only from the PPA Linux WIP-Kernel team:

$ sudo add-apt-repository ppa:wip-kernel/alsa-lib
$ sudo apt update
$ sudo apt dist-upgrade -y

Example config files for Intel i5 Westmere, 4Gb RAM

GRUB_CMDLINE_LINUX_DEFAULT="noresume psi=1 acpi_serialize acpi_osi=Linux acpi_backlight=vendor intel_iommu=on swiotlb=32768 apparmor=0 net.ifnames=0 biosdevname=0"
GRUB_CMDLINE_LINUX="systemd.gpt_auto=0 zswap.enabled=1 zswap.compressor=lz4 zswap.max_pool_percent=15 pcie_acs_override=downstream"

Enable ZSWAP

Zswap is a kernel feature that provides a compressed RAM cache for swap pages

  • Add to grub.cfg
GRUB_CMDLINE_LINUX="zswap.compressor=lz4 zswap.max_pool_percent=15"
  • Add to /etc/initramfs-tools/modules
lz4
lz4_compress
  • Run command
$ sudo update-grub && update-initramfs -u

  • /etc/sysctl.conf
vm.laptop_mode = 0

vm.overcommit_ratio = 200 
vm.overcommit_memory = 2

# System open file limit
fs.file-max = 243968

# Core dump suidsafe
kernel.core_uses_pid = 1
kernel.core_pattern = /tmp/core-%e-%s-%u-%g-%p-%t
fs.suid_dumpable = 2

kernel.printk = 4 4 1 7
kernel.sysrq = 0

# Network
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.tcp_max_orphans = 65536
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_keepalive_time = 1800
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_syn_retries = 3
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_mem = 50576   64768   98152
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_orphan_retries = 0
net.ipv4.tcp_syncookies = 1
net.netfilter.nf_conntrack_max = 16777216
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_congestion_control = yeah
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.route.flush = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.lo.rp_filter = 1
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.wlan0.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.lo.accept_source_route = 0
net.ipv4.conf.eth0.accept_source_route = 0
net.ipv4.conf.wlan0.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.ip_forward = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_echo_ignore_all = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 4096
net.core.rmem_default = 65536
net.core.wmem_default = 65536
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
fs.inotify.max_user_watches = 16777216
#
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.ip_default_ttl = 63
#
net.ipv4.tcp_ecn = 1
net.core.default_qdisc = cake
#
kernel.perf_cpu_time_max_percent = 100
#
# IO shedulers
vm.dirty_background_bytes = 67108864
vm.dirty_bytes = 134217728
#
# Huge Page
vm.nr_hugepages = 16
vm.nr_overcommit_hugepages = 16
vm.hugetlb_shm_group = 1001
#
kernel.yama.ptrace_scope = 2
#
net.netfilter.nf_conntrack_helper = 1
#
# LKRG
lkrg.clean_message = 0
lkrg.log_level = 3
#
# For Chromium sandbox use!
kernel.unprivileged_userns_clone = 0

  • /etc/network/interfaces
wireless-power off

  • /etc/NetworkManager/conf.d/default-wifi-powersave-on.conf
[connection]
wifi.powersave = 2

  • /etc/NetworkManager/NetworkManager.conf
[connection]
wifi.powersave = 2

[device]
wifi.scan-rand-mac-address=no

Copyright © 2019 AndyLavr All rights reserved.