User:0xMrRobot/Alienware m16 R1
This article describes how I configure my Arch Linux system for my gaming laptop. It has the following specs:
- 13th Gen Intel Core i9-13900HX CPU;
- 32GB of DDR5 RAM at 5600MT/s;
- Nvidia RTX 4070 Laptop GPU, with 8GB of GDDR6 VRAM;
- 2 NVMe SSDs: one with 1TiB and another with 2TB;
Here's the hardware probe.
I will install Arch on the 2TB SSD with the following characteristics:
- File system: Btrfs (with full drive encryption configured);
- Kernel: linux-zen;
- Desktop environment: KDE;
- Swap: 16GiB file (with hibernation configured);
- Bootloader: systemd-boot;
- Firmware mode: UEFI;
- Multimedia framework: PipeWire;
- Command-line shell: Bash;
- Secure Boot: Enabled;
- Display manager: none, the login will be directly from the tty.
italics must be replaced by whatever you encounter/desire, according to your circunstances (read this). Now that you have read this warning, go read the articles and disclaimers linked above before continuing.
Preparation
Get an ArchISO
Go to the Arch Linux download page, select a mirror that's geographically close to you (for better download speeds) and download the .iso file.
Create an USB flash installation medium
Turn on the laptop and repeatedly press the F2 key to get into the UEFI menu. From there, go to Boot configuration and disable Secure Boot for now, see the note here.
Save your changes, reboot and repeatedly press the F12 to enter the one-time boot menu. Select your installation medium and boot from it. When the boot menu appears, select Arch Linux install medium.
Installation
The installation medium creates an Arch environment that runs in the computer's RAM, and you'll automatically be logged in as the root user. After logging in, you can unplug your USB drive.
The default keyboard layout is US. Since this laptop has a Brazilian layout, I'll be selecting it for ease of use:
# loadkeys br-abnt2
Also, for ease of reading, you may wish to increase the font size:
# setfont ter-v24n
The following drive layout will be used:
- An EFI system partition (also called ESP) of 128 MiB, mounted at
/boot; - A root partition encompassing the rest of the drive.
Use lsblk(8) to see the drives detected by the live environment. Entries with TYPE equal to rom and loop can be ignored. Write down the block device that represents the 2TB SSD, e.g. /dev/nvme1n1.
Next, use gdisk(8) to wipe the drive clean:
# gdisk /dev/nvme1n1
This will open a new prompt. Press x to use expert commands, and then press z to zap (destroy) the GPT on the drive. If it asks you to also blank out the MBR, confirm this action.
Now you have a blank drive, ready to be partitioned. To verify, you can run lsblk again, and the drive shouldn't have any partitions. If this is the case, re-enter the gdisk command above.
In the new prompt, press n to create a new partition. The program will interactively ask for more parameters. As an example, let's create the ESP:
Command (? for help): n
Partition number (...):
First sector (...) or {+-}size{KMGTP}:
Last sector (...) or {+-}size{KMGTP}: +128M # Increase if desired
Current type is 8300 (Linux filesystem)
Hex code or GUID (...): EF00
(). In the example above, the fields are Partition number and First sector.Also, the ellipses
... were used to omit stuff that's not relevant to our purposes, see this article.Repeat the process for the root partition:
Command (? for help): n
Partition number (...):
First sector (...) or {+-}size{KMGTP}:
Last sector (...) or {+-}size{KMGTP}:
Current type is 8300 (Linux filesystem)
Hex code or GUID (...): 8309
Last sector field, you can just press Enter, and the new partition will encompass the entirety of the remaining space on the drive.Finally, verify your changes by pressing p. If everything's correct, write your changes to the drive by pressing w and confirming that you wish to proceed.
Here's an example layout created in a virtual machine, yours should look similar:
root@archiso ~ # lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS loop0 7:0 0 853.9M 1 loop /run/archiso/airootfs sr0 11:0 1 1.2G 0 rom /run/archiso/bootmnt nvme0n1 259:0 0 30G 0 disk ├nvme0n1p1 259:1 0 128M 0 part └nvme0n1p2 259:3 0 29.8G 0 part
Format the ESP with mkfs.fat(8) to create a FAT32 file system:
# mkfs.fat -F 32 -n ESP-Alienware /dev/nvme1n1p1 -v
/
Encrypting
Format and open the partition with cryptsetup(8):
# cryptsetup luksFormat /dev/nvme1n1p2 --type luks2 --cipher aes-xts-plain64 --hash sha512 --iter-time 7000 --key-size 512 --pbkdf argon2id --use-random --verify-passphrase --pbkdf-parallel 4 --pbkdf-memory 4194304 # cryptsetup open /dev/nvme1n1p2 root
Formatting
Format the LUKS container with mkfs.btrfs(8):
# mkfs.btrfs -K -L Root-Alienware /dev/mapper/root
Creating subvolumes
The following subvolumes will be created:
- @ (root subvolume);
- @home (for the
/homefolder); - @opt (for the
/optfolder); - @root (for the
/rootfolder); - @var (for the
/varfolder); - @swap (for storing the swap file).
Mount the LUKS container to a folder e.g. /mnt and go to it with cd(n):
# mount /dev/mapper/root /mnt; cd /mnt
Create the subvolumes with btrfs-subvolume(8):
# btrfs subvolume create @ # btrfs subvolume create @home # btrfs subvolume create @opt # btrfs subvolume create @root # btrfs subvolume create @var # btrfs subvolume create @swap
Finally, get out of the /mnt folder and unmount the container.
Mount the partitions
# mount /dev/mapper/root -o relatime,nodiscard,compress=zstd:X,subvol=@ /mnt # mount /dev/mapper/root -o relatime,nodiscard,compress=zstd:X,subvol=@home /mnt/home --mkdir # mount /dev/mapper/root -o relatime,nodiscard,compress=zstd:X,subvol=@opt /mnt/opt --mkdir # mount /dev/mapper/root -o relatime,nodiscard,compress=zstd:X,subvol=@root /mnt/root --mkdir # mount /dev/mapper/root -o relatime,nodiscard,compress=zstd:X,subvol=@var /mnt/var --mkdir # mount /dev/mapper/root -o relatime,nodiscard,compress=zstd:X,subvol=@swap /mnt/.swap --mkdir # mount /dev/nvme1n1p1 -o umask=0077 /mnt/boot --mkdir
The compress=zstd:X parameter in the Btrfs subvolumes is optional. Here's a full explanation. I usually use 3.
The nodiscard parameter instructs the system to not run TRIM, which I desire because I'm using disk encryption. Read this article for more details on this topic.
Install the base system packages
Use pacstrap(8) to create your new installation:
# pacstrap -K /mnt base linux-zen linux-zen-headers base-devel bash-completion nano git cryptsetup terminus-font btrfs-progs
For the console text editor, I use nano. If you prefer something else, go ahead and use it instead.
Generate the fstab file
# genfstab -U /mnt >> /mnt/etc/fstab
You can find more details in genfstab(8).
I also like to edit the fstab to add some security options in certain entries. Currently, I add:
nodev,nosuidto/home,/optand/var;nodev,noexec,nosuidto/root,/.swapand/boot;nodiscardto all Btrfs mounts (remove anydiscard=whateveroptions that might be present) [1];umask=0027to/homeand/root, read this article for further context;umask=0077to/boot, check this article for more details.
You can read more about these mount options here and in fstab(5).
Finally, I add custom entries to the file, you can verify them in my GitHub repository.
For /tmp specifically, instead of writing an entry in fstab, it's better to edit the tmp.mount unit:
# systemctl edit tmp.mount
[Mount] Options= # This line clears the original options Options=your_options
Post-installation configuration
Before rebooting into my new system, I like to stay in the live environment a bit longer, in order to configure some things.
Chroot into the new system
# arch-chroot /mnt
Configure keyboard layout and font size
Even though these were configured before, the /etc/vconsole.conf file must be edited to make them permanent. An example configuration can be found here. See Xorg/Keyboard configuration and vconsole.conf(5) for more details.
Depending on which fonts you want to use in the console, you may need to install the package that contains said font, e.g. terminus-font.
Use this in case you either don't use disk encryption or you are fine with the potential risks. See this article for more details.
Configure mkinitcpio
After completing this section, remember to regenerate the initramfs. Read mkinitcpio.conf(5) for more details.
This used to be enabled by default, but now it's disabled, and I like to keep it that way.
Since we're using UKIs, it's also possible to disable the generation of the initramfs-*.img files altogether, saving more space on the ESP. However, depending on the boot entries you might want to add, you can't remove them, so be careful. This is specially true if you would like to use BIOS booting in addition to UEFI booting.
If you won't use UEFI booting at all, don't even bother with UKIs.
Change the default_uki path to point to /boot instead of /efi.
Ensure the configuration directory exists:
# mkdir -p /etc/cmdline.d
Add new configuration files, as desired. A few examples are listed below. The $(...) represents a value that you must get with the command within the parenthesis and manually substitute in the file (run the commands as root directly). For example:
# echo "rd.luks.name=$(cryptsetup luksUUID /dev/nvme1n1p2)=root" > /etc/cmdline.d/sd-encrypt.conf
Shoutout to Mutahar @ SomeOrdinaryGamers, from whom I learned this trick.
These are the files I set up:
/etc/cmdline.d/sd-encrypt.conf
# https://wiki.archlinux.org/title/Dm-crypt/System_configuration#Kernel_parameters rd.luks.name=$(cryptsetup luksUUID /dev/nvme1n1p2)=root
/etc/cmdline.d/root.conf
# https://wiki.archlinux.org/title/Btrfs#Mounting_subvolume_as_root # https://wiki.archlinux.org/title/Dm-crypt/System_configuration#Kernel_parameters root=/dev/mapper/root rootfstype=btrfs rootflags=rw,subvol=/@
/etc/cmdline.d/miscellaneous.conf
loglevel=3
/etc/mkinitcpio.conf
... HOOKS=(base systemd autodetect microcode modconf keyboard sd-vconsole block sd-encrypt filesystems fsck) ...
/etc/mkinitcpio.conf
...
COMPRESSION="zstd"
...
# See zstd(1) for details
COMPRESSION_OPTIONS=(-z -T0 --long -v -M4096 -1 -C)
...
MODULES_DECOMPRESS="yes"
Configure your system's clock
Select your time zone:
# ln -s /usr/share/zoneinfo/Region/City /etc/localtime
Tab to make the shell autocomplete the command.Syncronize your motherboard's clock with hwclock(8):
# hwclock --systohc --utc
Finally, enable the NTP daemon so your clock is automatically and periodically synced.
I also like to add servers from the NTP project as the main servers. To do so, create the following file:
/etc/systemd/timesyncd.conf.d/ntp-servers.conf
[Time] NTP=pool.ntp.org pool.ntp.br
Configure the user accounts
Give the root user a password
# passwd
Consider installing and configuring a privilege escalation tool, like sudo, and then restrict the root user.
# useradd -m -G power,audio,users -s /bin/bash -c "Whatever you want" yourusername
Set a password for your user account:
# passwd yourusername
To allow your new user account to have root privileges via sudo, run visudo(8):
# env EDITOR=nano visudo -f /etc/sudoers.d/yourusername
yourusername ALL=(ALL:ALL) ALL ...
Optionally, you can configure sudo to only accept the root user's password for authentication, instead of your user's password. However, if you choose to do so, then you absolutely cannot disable root!
View my /etc/security/limits.d/custom.conf file here.
Configure Pacman
Initialize and populate the local keyring
# pacman-key --init; pacman-key --populate archlinux
I like to use 7 concurrent downloads.
Enable color and pacman progress bars
Inside /etc/pacman.conf, on the [options] section, uncomment (remove the # symbol at the beginning of) the Color line and add ILoveCandy below:
/etc/pacman.conf
... [options] ... # Misc options ... Color ... ILoveCandy ...
Read pacman.conf(5) for more details.
Create the hooks directory
# mkdir -p /etc/pacman.d/hooks
Here's an example hook I use (and so should you). See alpm-hooks(5) for more details.
Install pacman-contrib and enable paccache.timer. Optionally, you can edit paccache.service to customize it. An example configuration can be found here.
Here's the configuration I use.
Be careful with them, as they are... well, unofficial. Put them at the bottom of pacman.conf, so they have a lower priority than the official repositories, as explained in pacman.conf(5) § REPOSITORY SECTIONS.
Enable systemd-resolved.service, set up DNS over TLS and set the correct symlink (stub mode).
Install networkmanager and enable NetworkManager.service, Also configure it to use systemd-resolved.
Hosts file
For a full explanation, read hosts(5). A template is shown here.
Install microcode
Ensure the microcode hook is present within Mkinitcpio#HOOKS and install intel-ucode.
Configure the bootloader
Here's my configuration.
No boot entries are required, since we are using UKIs, which systemd-boot automatically recognizes.
However, you may wish to create boot entries for other purposes. Some examples can be found in my GitHub repository.
Configure localization
Uncomment the entries in /etc/locale.gen for the languages you want. For example:
/etc/locale.gen
... en_GB.UTF-8 UTF-8 ... en_US.UTF-8 UTF-8 ... fr_FR.UTF-8 UTF-8 ... pt_BR.UTF-8 UTF-8 ...
# sed -i 's/#pt_BR.UTF-8/pt_BR.UTF-8/' -f /etc/locale.gen
Next, generate the locale:
# locale-gen
Finally, set the desired settings for the system with the /etc/locale.conf file.
These settings will take effect after rebooting. If you want your language to be applied immediately, run:
# export LANG=pt_BR.UTF-8
Set up hibernation
/etc/cmdline.d/resume.conf
# https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Manually_specify_hibernate_location # https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Acquire_swap_file_offset # https://wiki.archlinux.org/title/Dm-crypt/System_configuration#resume resume=/dev/mapper/root resume_offset=$(btrfs inspect-internal map-swapfile -r /.swap/swapfile)
Regenerate the initramfs afterwards.
Read sleep.conf.d(5).
Install essential packages
--needed parameter prevents reinstallation of already present packages, and --asdeps marks installed packages as dependencies.Relevant firmware files
# pacman -S --needed linux-firmware-intel linux-firmware-nvidia linux-firmware-realtek
Filesystem userspace tools
# pacman -S --needed btrfs-progs ntfs-3g exfatprogs dosfstools
# pacman -S --needed alacritty konsole ttf-jetbrains-mono-nerd ttf-input-nerd ttf-hack-nerd ttf-dejavu-nerd
Here's an example configuration for Alacritty.
# pacman -S --needed mesa lib32-mesa opencl-mesa lib32-opencl-mesa mesa-utils lib32-mesa-utils
# pacman -S --needed libpipewire libwireplumber pipewire pipewire-alsa pipewire-audio pipewire-jack pipewire-libcamera pipewire-v4l2 pipewire-pulse wireplumber lib32-libpipewire lib32-pipewire lib32-pipewire-v4l2 lib32-pipewire-jack alsa-firmware sof-firmware
Also follow PipeWire#Troubleshooting for some fixes that are good to perform.
After installing plasma-desktop, search for other Plasma packages that you may desire and haven't been already installed. See KDE Wallet#Configure PAM (don't forget to install kwallet-pam).
I change the Application Launcher icon to the Arch Linux logo, like described here. The file is located at
/usr/share/pixmaps/archlinux-logo.svg.
/etc/cmdline.d/zswap.conf
## https://wiki.archlinux.org/title/Zswap#Customizing_zswap zswap.enabled=1 zswap.shrinker_enabled=1 zswap.compressor=zstd zswap.max_pool_percent=50 zswap.accept_threshold_percent=90
Also add zstd to Mkinitcpio#MODULES and regenerate the initramfs.
Reboot
I reboot now because having a GUI will make the next steps much easier to follow.
After rebooting, repeatedly press the F2 key to enter the firmware menu, go to Boot configuration and put systemd's entry at the top of the boot order. Save the changes and exit.
After logging in with your regular user account, connect to the internet and launch Plasma manually from the CLI.
Use the systemd unit provided by btrfs-progs. Only one activation is needed, i.e. enabling scrub for each subvolume is redundant.
I don't do this anymore, but I'll keep it here nonetheless.
Configure Bluetooth
Install an AUR helper
After ensuring that base-devel and git are installed, choose and install an AUR helper (I personally like yay):
$ cd /tmp $ git clone https://aur.archlinux.org/yay.git $ cd yay/ $ makepkg -sirc # See makepkg(8) for details
If you don't want -debug packages to be built, create this makepkg configuration file.
To build packages in a temporary directory that gets cleaned up after shuttind down the system, create this other configuration file.
Install other needed packages
I will be using Dolphin. To prevent the issue discussed in this forum thread, install archlinux-xdg-menu and run the command below:
# ln -s /etc/xdg/menus/arch-applications.menu /etc/xdg/menus/applications.menu
See the forum thread for more details and also other options.
GUI text editor
I use Kate.
Media player
I use VLC media player and FFmpeg.
(Optional) Add an EFI shell
systemd-boot will automatically create a new entry if an EFI binary is present at /boot/shellx64.efi. To automate the creation and removal of this file in the ESP, you can use the following pacman hooks: [2] and [3]. After setting them up, install edk2-shell.
Archiving and compression utility
I use Ark.
I set up an alias to always use the per-user installation unless I'm root. This requires adding the Flathub repository, as it's only automatically added to the system-wide installation by default:
$ flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
$ flatpak install com.rtosta.zapzap
$ flatpak install dev.vencord.Vesktop
$ flatpak install io.missioncenter.MissionCenter
$ flatpak install io.github.ungoogled_software.ungoogled_chromium
$ flatpak install org.onlyoffice.desktopeditors
$ flatpak install io.gitlab.librewolf-community
$ flatpak install it.mijorus.gearlever
Manage installed packages
Flatpak can automatically detect installed packages that are no longer required. Periodically run the following command:
$ flatpak uninstall --unused
Install Flatseal to manage the apps' permissions easily:
$ flatpak install com.github.tchx84.Flatseal
A GUI system monitor (Mission Center) was already installed, but it's also good to have one with a TUI. I like btop.
Bash configuration
Install pkgfile and use this script to source it.
The pkgfile database needs to be updated before using. You can update it manually and/or enable automatic updates.
I have a global configuration file: /etc/bash.bash_aliases
Use this script to automatically source it.
Add this code to it.
My personal .bashrc configuration can be found in my GitHub repository.
Add this code to it.
My personal .bash_profile configuration can be found in my GitHub repository.
Install essential packages
# pacman -S --needed efitools sbsigntools openssl dkms efibootmgr mokutil
Create the directories for storing the created keys
You can create a directory anywhere, I like to create one inside /root:
# mkdir -p /root/secureboot/keys/MOK
Make sure only root has any access to this directory:
# chmod -R 1600 /root/secureboot
Create your own keys
# cd /root/secureboot/keys/MOK
# openssl req -newkey rsa:4096 -nodes -keyout MOK.key -new -x509 -sha512 -days 3650 -out MOK.crt -subj "/CN=Mr. Robot Alienware Machine Owner Key/"
# openssl x509 -in MOK.crt -out MOK.cer -outform DER
# openssl req -newkey rsa:4096 -nodes -keyout MOK-module-signing.key -new -x509 -sha512 -days 3650 -out MOK-module-signing.crt -subj "/CN=Mr. Robot Alienware Machine Owner Key - Module Signing/" -addext "extendedKeyUsage = codeSigning,1.3.6.1.4.1.2312.16.1.2"
# openssl x509 -in MOK-module-signing.crt -out MOK-module-signing.cer -outform DER
# ln -s MOK-module-signing.cer MOK-module-signing.pub
Configure Shim
Install the package
We want the shimx64.efi and mmx64.efi files inside /boot/EFI/BOOT/, like described here. To automate this, you can use the following script and pacman hooks: [5], [6], [7].
After setting everything up (making the script executable), install shim-signedAUR.
Sign other binaries
If you want to use other EFI binaries with this setup, they must be signed as well. Here's an example script and pacman hook for memtest86+-efi: [8] and [9]. Remember to make the script executable.
By default, shim will try to load an EFI file named grubx64.efi. Although this can be overriden, it is more foolproof to rely on this default. Create this script. Remember to make it executable.
Edit systemd-boot-update.service and add the instruction below to automatically run this script after every systemd-boot upgrade:
[Service] ExecStartPost=/bin/sh /usr/local/sbin/systemd-boot-setup-shim.sh
Remember to make them executable. Change the UKI script to use your MOK instead of a db key.
Configure DKMS to use your MOK
By default, DKMS uses a MOK that it creates after installation. Create the following file to override this behaviour and make DKMS use your MOK instead:
/etc/dkms/framework.conf.d/custom-mok.conf
# Tell DKMS to use my custom MOK's mok_signing_key=/root/secureboot/keys/MOK/MOK-module-signing.key mok_certificate=/root/secureboot/keys/MOK/MOK-module-signing.pub
This procedure allows the modules built to be loaded when Secure Boot is enabled. To verify if a module is loaded, you can use lsmod(8) or modinfo(8).
Copy the certificates to the ESP:
# mkdir -p /boot/MOK
# cp /root/secureboot/keys/MOK/*.cer /boot/MOK/
Reboot into the firmware menu and enable Secure Boot. Shim will launch MokManager. Add the 2 MOK certificates present in the ESP, reboot again and you're done!
After rebooting, it's a good idea to overwrite the certificates in the ESP with random data to reduce the chance of recovery and compromise, in case your system is e.g. stolen. One way of doing this is using shred.
Optionally, you can also make the directory where the keys are stored read-only, since we won't be touching it again anyway:
# chmod -R -w /root/secureboot
Install the following packages:
# pacman -S --needed nvidia-open-dkms nvidia-prime nvidia-utils nvidia-settings libglvnd opencl-nvidia lib32-nvidia-utils lib32-libglvnd lib32-opencl-nvidia ffnvcodec-headers nvtop
Add these modprobe.d and udev files: [10], [11].
Enable the services below:
# systemctl enable nvidia-hibernate.service nvidia-persistenced.service nvidia-powerd.service nvidia-resume.service nvidia-suspend.service nvidia-suspend-then-hibernate.service
nvidia-persistenced.service can cause the system to hang when rebooting. One way to mitigate this is to reduce systemd's default timeout:
/etc/systemd/system.conf.d/timeout.conf
[Manager] DefaultTimeoutStopSec=20s
My profile.d script will automatically set the relevant environment variables at login (make it executable). All that's left is to install the relevant packages.
VA-API
# pacman -S --needed intel-media-driver libva-nvidia-driver libva-mesa-driver libva-utils lib32-libva libva
VDPAU
# pacman -S --needed libvdpau libvdpau-va-gl vdpauinfo lib32-libvdpau
Vulkan
# pacman -S --needed vulkan-intel vulkan-mesa-layers vulkan-mesa-implicit-layers vulkan-tools lib32-vulkan-intel lib32-vulkan-mesa-layers lib32-vulkan-mesa-implicit-layers
VPL
# pacman -S --needed libvpl vpl-gpu-rt
Configure a printer
My current printer is a Canon E4210. Fortunately, it works out of the box in driverless mode (if you set up network printer discovery). Nevertheless, a PPD driver file is provided by cnijfilter2AUR.
Follow CUPS and SANE, start cups.service and add the printer in CUPS' web interface.
Since I use network discovery, I made cups.service automatically start avahi-daemon.service whenever it's started:
# systemctl edit cups.service
[Unit] After=avahi-daemon.service Wants=avahi-daemon.service
I use tuned and thermald. My custom tuned profiles can be seen here.
Undervolting
Disable undervolting protection
You need to perform the steps listed here before proceeding with any undervolting.
This setting is inside the "hidden" firmware menu. To access it, follow the steps below:
- Navigate to this GitHub repository, download the compressed folder and extract it somewhere;
- Grab an USB flash drive, format it with FAT32 and copy the extracted folder's contents to it;
- Reboot, enter the firmware menu by pressing
F2repeatedly and disable Secure Boot;
- Save and exit, launch the boot menu by pressing
F12repeatedly and select your USB drive;
- Go into the Intel Advanced Menu > OverClocking Performance Menu and disable UnderVolt Protection;
- Save and reboot. Now you may turn Secure Boot back on if you wish.
Install intel-undervolt. Here's my system's configuration. Only after testing the stability of your system, enable either intel-undervolt.service or intel-undervolt-loop.service.
GPU
The information presented here was compiled from this GitHub discussion, this Reddit post (big shoutout to u/rexpulli) and this article.
Throughout this section, you are advised to use a GPU benchmark to test the GPU's stability. I used Unigine Heaven, it's available on the AUR as unigine-heavenAUR. There are other benchmarks available as well.
$ env __NV_PRIME_RENDER_OFFLOAD=1 __GLX_VENDOR_LIBRARY_NAME=nvidia __VK_LAYER_NV_optimus=NVIDIA_only __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0 unigine-heaven
1. Install python-nvidia-ml-py.
2. Create the following Python script: [12]. Remember to make it executable.
The details of the functions used can be read in the Device Commands section of the NVML API documentation.
If you want to configure other P-states aside from P0, check this Reddit post for advice.
# nvidia-smi -pl 140If this happens to you, remove or comment out the power limit section of the script, and as a last resource, you can use NVIDIA/Tips and tricks#Dynamic Boost
3. Create a systemd service:
# systemctl edit --force --full nvidia-undervolt.service
[Unit] Description=Undervolt the Nvidia GPU [Service] Type=oneshot ExecStart=/bin/python /usr/local/sbin/nvidia-undervolt.py StandardOutput=journal StandardError=journal [Install] WantedBy=graphical.target
Run the script manually and test your configuration. Only after verifying that your system is stable (e.g. Heaven doesn't freeze/crash, no graphical glitches appear, etc.), enable the service so the settings are applied after every startup, if desired.
Set correct parameters
Some Dell laptops don't have support for the S3 ACPI state. You can read more about this in nwildner's blog post.
I use firewalld with the base settings in the Chris Titus Tech's LinUtil, plus a few rules of mine. I have firewall-config installed as the frontend. My configuration is available here.
I enable systemd-oomd.service.
View my fstab.
System Cleanup
Here's a list of useful commands (view their respective help and man pages for details, you can search for them here):
# pacman -Sc # journalctl --vacuum-time=2weeks $ yay -Sc ## The 2 commands below aren't really useful to me, ## as I mount ~/.cache with tmpfs. $ du -sh ~/.cache/ $ rm -rf ~/.cache/*
I use this tmpfiles.d(5) configuration.
windows VM with QEMU/KVM and GPU passthrough
Enable nested virtualization in KVM
Install QEMU, libvirt and virt-manager
Enable libvirtd.socket after installing libvirt.
Add your user to the libvirt group, to not be asked for your password every time. This can be done with usermod(8):
# usermod -aG group user
Reboot or log out and back in for the changes to take effect. You can verify if your changes were successful with groups(1).
Remember to configure the fstab.
In my case, the hugepage size is 2048 KiB (2 MiB), which is the default. Since I want to allocate 16 GiB to my VM, 16384 MiB ÷ 2 MiB/page = 8192 pages. I'll round up to 8200.
My XML configuration looks like this (based on libvirt's documentation and this article (16 GiB is 16777216 KiB)): [13]
Create a new storage image
By default, QEMU will use a .qcow2 file, but for more performance, you can use a .img file of type raw. It's also a good idea to change the bus used from "SATA" to "VirtIO".
When creating a new VM in virt-manager, select "Manual Installation" and go through the menus until you arrive at the storage selection menu. Click on "Select managed or other existing storage" and click on "Browse". Select the "+" icon next to "Volumes" and create a new one with type raw. Also select "Allocate entire volume now". Later, when configuring the different hardware elements of the VM, change the disk from "SATA" to "VirtIO" for more performance.
I will be using Looking Glass, since I only have one monitor.
1. I bound the GPU to the vfio_pci module via its ID, configured the modprobe.d file (presented here) and configured the initramfs;
When you want to use the dGPU on the host, comment out the softdep and options lines in the modprobe.d file, regenerate the initramfs and reboot.
2. I installed Looking Glass on the host system.
3. I determined the amount of vRAM I want to allocate, configured the modprobe.d file for KVMFR, adjusted the permissions with udev and edited cgroups;
I allocate 256 MiB, which is 268435456 bytes.
4. I edited the VM's XML configuration to use Looking Glass;
5. I configured the /etc/libvirt/hooks/qemu hook to load the KVMFR module;
6. I configured the Spice server's XML to use a Unix socket: [14]
Uncomment the group line in /etc/libvirt/qemu.conf and set it to group = "kvm".
If you haven't already, add your user to the kvm user group.
7. I edited the video XML: [15]
I have a configuration file for Looking Glass: [16]
My CPU has 8 P-Cores (2 threads each) and 16 E-Cores (1 thread each). I allocate 4 P-Cores (8 threads total) to the VM; 4 E-Cores to the emulatorpin; and 4 other E-Cores to the iothreadpin. I enable this feature as well. My XML configuration for the VM looks like this: [17]
Now, for maximum performance, I isolate these cores from the host, so they are exclusively used by the VM. For this, I used this solution. Here's the libvirt hook: [18].
The iothread pin I created helps to improve the VM's I/O performance. Since I'm using a physical disk as the VM's storage, I edit the XML like this: [19]
Install windows
1. Download the latest ISO of the VirtIO drivers from the Fedora People repository and add it to the hardware list of your VM as a CDROM image. Do the same for the windows installation ISO and put it as the 1st boot option.
2. Go through the menus of the live media until you hit the disk selection screen. Click on "Load Driver" and select the correct folder of the VirtIO ISO, e.g. E:\amd64\w11. Load the driver that appears, and you will see your virtual disk pop up.
3. Now, perform a manual installation through cmd, and right before rebooting out of the live install media environment, add the VirtIO block device drivers, i.e. vioscsi.sys and viostor.sys, to the new installation with dism. Assuming that your new installation is mounted at C:\ and the VirtIO ISO at E:\:
> dism /Add-Driver /Image:C:\ /Recurse /Driver:E:\viostor\w11\amd64 > dism /Add-Driver /Image:C:\ /Recurse /Driver:E:\vioscsi\w11\amd64
If you don't do this, windows won't be able to start, returning an "INACCESSIBLE BOOT DEVICE" error. Now you may reboot.
4. After dropping into the desktop, open File Explorer, open the VirtIO CDROM (e.g. Local Disk (E:)) and install the Guest Tools and other drivers by launching virtio-win-guest-tools.exe.
5. Download the Looking Glass windows host binary from their website and install it in the VM. You also need to make sure it will automatically launch when the VM starts:
- 5.1. I opened
services.mscand set the Looking Glass, all SPICE, QEMU and VirtIO services' startup property to "Automatic";
In my case, this means either using a spare monitor or a dummy HDMI/miniDP plug (the solution I use most often). Both trigger the VM to use the GPU being passed through instead of the virtual video driver.
If you installed the Guest Tools like described earlier, the VirtioFsSvc service will already exist. To add the WinFsp dependency (like recommended in the official documentation), install WinFsp and run the following command on a cmd/PowerShell prompt with admin privileges:
> sc.exe config VirtioFsSvc start=auto depend="WinFsp.Launcher/VirtioFsDrv"
You can install WinFsp with winget from a cmd/PowerShell prompt with admin privileges:
> winget install --id WinFsp.WinFsp -e --source winget
After doing so, set the WinFsp service's startup property to "Automatic".
Arch setup
The VM's XML looks like this: [20]
I created a directory and changed its ownership to the libvirt-qemu group:
# mkdir -p /path/to/shared/directory # chown -R user:libvirt-qemu /path/to/shared/directory # chmod -R 0770 /path/to/shared/directory
You might need to log out/reboot for changes to take effect.
# cd /tmp # git clone https://github.com/pantae35872/virtiofsd-quick-patch.git # cd /tmp/virtiofsd-quick-patch # pacman -S --needed rust # ./run # mv virtiofsd-patched /lib/
And now edit the VM's XML:
...
<filesystem>
...
<binary path="/lib/virtiofsd-patched" xattr="on">
</binary>
...
</filesystem>
...
You can read more about this issue here and here. In the future, when this patch gets added to the package inside Arch's repositories, undo these steps and upgrade your system.
I like to always set this on all windows VMs.
Enable BitLocker
I use an emulated TPM for this.
This section will host things I learned/found interesting that are specific to windows. My w11 installation is on the 1TiB drive.
Fix boot order
Since windows has a superiority complex, during installation it will create a boot entry in the firmware and place it as the first option.
To fix this, wait until the installation is complete, reboot into the firmware and put the Linux bootloader as the first option.
Don't delete windows' entry, otherwise during boot the system will recreate the boot entry and place it at the top of the boot order again.
Open regedit.exe as admin, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power, create a DWORD variable called HiberbootEnabled and set its value to 0.
To enable hibernation, in the same registry path, create a DWORD variable called HibernateEnabled and set its value to 1. Then, open a cmd or PowerShell window as admin and run:
> powercfg /H on
(Optional) Create a new ESP for windows
If you followed these instructions so far, then you are installing windows after installing Arch. So, even though windows is installed in a separate drive, it will use the ESP created during the installation of Arch. This is not necessarily a bad thing: systemd-boot will automatically create an entry for Windows because of this.
However, if you prefer to keep the 2 OS's completely physically separate (which isn't a bad idea), then boot into windows, create a new ESP in windows' drive and create new boot files with bcdboot.
This video by Chris Titus Tech shows how to do so. The TL;DW of it is:
1. Reduze windows' partition size by ~64MB;
2. Use the freshly made empty space to create a new partition;
3. Format this new partition with FAT32;
4. Mount the partition (assign a letter to it, e.g. B:);
5. Create boot files with bcdboot C:\Windows /s B: /f ALL;
6. Unmount (unassign the letter of) the partition, so windows doesn't remount it after rebooting;
7. (Optional) Boot into Arch and delete the files added by windows to Arch's ESP.
Mount the windows partition in Arch
First, make sure ntfs-3g is installed. Then, choose a location to mount windows on, e.g. /mnt/windows.
Run the following command to add an entry to /etc/fstab. Again, shoutout to Mutahar @ SomeOrdinaryGamers:
# echo "PARTUUID=$(blkid -s PARTUUID -o value /dev/nvmeXnYpZ) /mnt/windows ntfs-3g rw,nosuid,nodev,noexec,user_id=0,group_id=0,allow_other,blksize=4096,x-systemd.automount 0 0" >> /etc/fstab
Remember to replace /dev/nvmeXnYpZ with the correct partition. Use lsblk(8) to identify it.
If you created a new ESP for windows, you can use the same logic to mount it on Arch as well (I used /boot/windows as an example mount point):
# echo "PARTUUID=$(blkid -s PARTUUID -o value /dev/nvmeXnYpZ) /boot/windows vfat rw,nosuid,nodev,noexec,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro,x-systemd.automount 0 0" >> /etc/fstab
Undervolting
GPU
The following stable voltage settings were discovered by empirical testing, using MSI Afterburner and this method.
- 2500 MHz @ 900 mV
- 2400 MHz @ 850 mV
- 2300 MHz @ 825 mV
- 2200 MHz @ 800 mV
For whatever reason, playing BF6 with the 2300 MHz @ 825 mV setting (the one I used to use the most) kept leading to driver crashes. Changing it to 2300 MHz @ 850 mV fixed this.
CPU
Install Intel XTU. If it complains about VBS being turned on, disable it by opening gpedit.msc, going to Local Computer Policy > Computer Configuration > Administrative Templates > System > Device Guard, double-clicking Turn on Virtualization Based Security, selecting Disabled, saving and rebooting.
After configuring all the settings you want, click the Save button and create a new profile, e.g. Undervolt. Then, go to Profiles, select your newly created profile and export it. A .xtu file will be created. If XTU for some reason changes the values for your settings, go to Profiles, select your profile, click Show Values and click Apply.
The voltage settings below were discovered by empirical testing, using Cinebench to stress the CPU. Other settings, like frequency and power limits, were based off of the official Intel specifications. Settings that I also changed in the "hidden" firmware menu are written in bold.
Test your system to check if it's stable or not. Only after doing this you should save and apply your settings permanently.
1. Core
- Reference Clock: 100 MHz;
- Core Voltage Mode: Adaptive;
- Intel Turbo Boost Technology: Enabled;
- Core Voltage Offset: -0.1 V;
- Processor Core IccMax: 250 A;
- Power Limit 1 (PL1): 150 W; (a bit lower than max specs)
- Turbo Boost Short Power Max Enable (PL2 Enable): Disable;
- Performance Active-Core Tuning:
- 1-2 Active Cores: 54x;
- 3-4 Active Cores: 50x;
- 5-6 Active Cores: 46x;
- 7-8 Active Cores: 42x;
- Efficient Active-Core Tuning:
- 1-4 Active Cores: 39x;
- 5-8 Active Cores: 38x;
- 9-12 Active Cores: 37x;
- 13-16 Active Cores: 36x;
2. Cache
- Processor Cache Frequency Ratio: 48x;
- Processor Cache Voltage Mode: Adaptive;
- Processor Cache Voltage Offset: -0.1 V;
- Efficient Cores Cache Voltage Mode: Adaptive;
- Efficient Cores Cache Voltage Offset: -0.1 V;
3. Graphics
- Processor Graphics Ratio Limit: 16.5x;
- Processor Graphics Voltage Mode: Adaptive;
- Processor Graphics Voltage Offset: -0.07 V;
- Processor Graphics IccMax: 42 A;
- Processor Graphics Media Voltage Mode: Adaptive;
- Processor Graphics Media Voltage Offset: -0.07 V;
4. Other
- System Agent Voltage Mode: Adaptive;
- System Agent Voltage Offset: -0.07 V;
5. Settings only available in the firmware
- Watchdog Timer: Enabled! (If you don't enable this, XTU won't reapply your settings across reboots);
- Legacy Game Mode: Enabled (Scroll Lock key toggles E-Cores);
- Maximum performance core frequency allowed: 5.4 GHz;
- Maximum efficiency core frequency allowed: 3.9 GHz;
- Maximum iGPU frequency allowed: 1.65 GHz;
Automatically apply settings after booting
Even though XTU has an option in its settings to apply the settings across reboots, it might not automatically launch.
If this happens to you, there are a few solutions, presented here. Before using any of them, enable the Watchdog Timer in the firmware and check the Restore tuning after reboot box inside XTU's settings menu.
1. Using windows Services
Open a cmd/PowerShell prompt as admin and run the following to make the service automatically start after booting:
> sc.exe config XTUOCDriverService start=auto
2. Using shell:startup
If the 1st solution isn't enough, press Win + R, run shell:startup, copy or create a shortcut for the XTU executable and put it inside the folder that opened. This will force it to launch after every boot.
The downside of this method is that it launches the GUI, not just the background task, and you have to manually close it every time. But after doing so, XTU will run in the background, with your settings applied.
Don't add bloat to your system
windows is already pretty bloated on its own, and even though this laptop has plenty of computing power, that's not an excuse to add even more crap into the system.
This software is completely unnecessary. Instead of installing it, consider using AlienFX Tools (it can do more than AWCC, while occupying hundreds of times less storage space, literally).
Create a temporary folder
Users of windows Pro and above can use Wikipedia:Group Policy to, among other things, run scripts at startup and shutdown time. This allows running a script that empties a specific folder automatically, similar to /tmp on Linux.
1. Create the folder that will be used, e.g. C:\tmp;
2. Press Win + R and run gpedit.msc;
3. Go to Local Computer Policy > Computer Configuration > Windows Settings > Scripts (Startup/Shutdown) > Shutdown > Add > Add a Script > Browse. Close the File Explorer tab that just opened. This creates the C:\Windows\System32\GroupPolicy\Machine\Scripts\Shutdown\ folder, where the script will be stored;
4. Open Notepad as admin and create the following Batch script:
C:\Windows\System32\GroupPolicy\Machine\Scripts\Shutdown\DeleteFilesInTmp.bat
@echo off
del /f /q /s "C:\tmp\*.*"
for /d %%x in ("C:\tmp\*") do rmdir /s /q "%%x"
5. Follow Step 3, but instead of closing the Explorer tab, select the script, press OK and then press Apply. Test the script by saving unimportant data to the folder and rebooting.
Use your bare metal installation under Arch
It is possible to use QEMU/KVM to boot your bare metal installation as a VM. This section will be an extention to Section 4. Here's how I did it:
1. Install windows normally and update it as much as possible. Also make sure to install all the drivers for your physical system;
2. Download the latest VirtIO ISO from the Fedora People repository;
- 2.1. Run
virtio-win-guest-tools.exeto install most of the necessary drivers;
- 2.2. It's also imperative to install the block device drivers, i.e.
vioscsi.sysandviostor.sys. Assuming that the VirtIO ISO is mounted atD:\:
> pnputil.exe -a -i D:\vioscsi\w11\amd64\*.inf > pnputil.exe -a -i D:\viostor\w11\amd64\*.inf
- If you don't do this, windows won't boot under the VM, returning an "INACCESSIBLE BOOT DEVICE" error.
- These drivers can also be installed with Driver Store Explorer, if you prefer a GUI instead of a CLI;
- 2.3. Open
services.mscand set the startup property of all SPICE, QEMU and VirtIO services to "Automatic";
3. You must create an ESP in windows' SSD in order to boot it as a VM. Removing the boot files that were created in Arch's ESP is not mandatory, but I recommend creating the new files after installing all of the VirtIO drivers, specially the block device ones;
4. Disable Fast Startup. If you'd like to use hibernation, enable it in windows and edit the VM's XML:
...
<pm>
...
<suspend-to-disk enabled="yes"/>
</pm>
...
5. Now reboot into Arch. This is the most important step to perform. When creating the new VM, you must select the SSD where windows is already installed as the VM's storage device. Using virt-manager, click on "Create a new VM" and select "Import existing disk image". Hit "Browse" and search for the ID of your SSD, it will be listed under /dev/disk/by-id/. You must select the ID of the SSD itself, not a partition on it.
For example:
$ ls -l /dev/disk/by-id/
... # This is the correct ID to choose ... nvme-PM9A1_NVMe_Samsung_1024GB__S6H2NF0WC50542 # The others shown below must not be chosen, # as they represent only a single partition ... nvme-PM9A1_NVMe_Samsung_1024GB__S6H2NF0WC50542-part1 ... nvme-PM9A1_NVMe_Samsung_1024GB__S6H2NF0WC50542-part2 ... nvme-PM9A1_NVMe_Samsung_1024GB__S6H2NF0WC50542-part3 ... nvme-PM9A1_NVMe_Samsung_1024GB__S6H2NF0WC50542-part4 ...
In the example above, the full path used in virt-manager would be /dev/disk/by-id/nvme-PM9A1_NVMe_Samsung_1024GB__S6H2NF0WC50542.
The XML of the VM should look something like this:
... <disk type="block" device="disk"> <driver name="qemu" type="raw" cache="none" io="native" discard="unmap"/> <source dev="/dev/disk/by-id/nvme-PM9A1_NVMe_Samsung_1024GB__S6H2NF0WC50542"/> <target dev="vda" bus="virtio"/> <boot order="1"/> ... </disk> ...
The rest of the VM's configuration can follow the steps described earlier in Section 4.
Amazing open-source program to manage the driver store. It is a portable program, therefore no installation is required.
Change a local account's password
In case the password set is incorrect and you get locked out of your system, you can perform this solution. I personally prefer to use the live environment instead of the troubleshooting menu, but both options should work.
- 1. Boot into a live media environment and press Shift + F10 to open a cmd prompt;
- 2. Use diskpart to see if your windows installation was recognized (by default, it'll be assigned the drive letter
C:):
X:\sources> diskpart DISKPART> list vol # Output would be here DISKPART> exit
- 3. After exiting diskpart, go to
C:\Windows\System32(assuming your installation is atC:), renameUtilman.exetoUtilman1.exeandcmd.exetoUtilman.exe:
X:\sources> C: C:\> cd Windows\System32 C:\Windows\System32> ren Utilman.exe Utilman1.exe C:\Windows\System32> ren cmd.exe Utilman.exe
- 4. Reboot into your system and click on the "Accessibility options" icon on the login screen. A cmd prompt will open. Run
control userpasswords2, select the user you want to edit and give it a new password;
- 5. Login to see if the change was successful. If so, reboot into the live environment and revert the changes you did in Step 3;
Disable password expiration
Press Win + R, run lusrmgr.msc, select the user you want to edit and check the "Password never expires" box.
Really nice Wikipedia:Windows Registry settings to have, as the context menu button quickly gives your user ownership of a selected folder and all of its content.
If you search online, you may also find a .exe called TakeOwnershipPro, but I don't like the idea of installing a random program from the web on my system. Thus, I use the registry approach.
A better alternative to using this and the cybercrime that is the Microslop Photos app is nomacs.
windows updates in PowerShell
It has your back when WU in the Settings decides to break. Thanks, Titus!
Since I'm a bass player, I need to do more stuff for recording equipment to work well on Arch. The main goal here is to reduce latency and set up pieces of software to record, play and transmit the sounds generated from my instruments.
Most of the steps listed here were taken from this beautiful website. I also took some things from the Linux Audio wiki.
This kernel parameter is an alternative to using a realtime kernel, like linux-rt or linux-lqxAUR. These options aren't mutually exclusive, however.
/etc/cmdline.d/audio.conf
# https://this.ven.uber.space/docs/computer/pro-audio/#kernel-parameter-threadirqs threadirqs
Adjusting limits.conf
View my configuration here.
RT priority
$ systemctl edit --user pipewire.service
[Service] CPUAffinity=8-23 LimitRTPRIO=infinity LimitMEMLOCK=infinity
The CPUAffinity line is used to exclude the cores that my windows VM uses, to avoid conflicts (I already isolate these from the host, but better to be safe than sorry).
I did this same edit in wireplumber.service and pipewire-pulse.service.
Another good idea is to install realtime-privileges and add your user to the realtime user group [21].
An amazing consequence is that now I can listen to music without stutters on the host while my windows VM is running. Before, they were unbearable.
Custom configuration
Here are my configuration files.
Replay captured audio in loopback
I can identify my audio interface and desired output device with pw-cli(1):
$ pw-cli ls Node | grep -E 'id|node.name|node.description'
... id 58, type PipeWire:Interface:Node/3 factory.id = "19" client.id = "41" device.id = "43" node.description = "PCM2902 Audio Codec Pro" node.name = "alsa_input.usb-Burr-Brown_from_TI_USB_Audio_CODEC-00.pro-input-0" ...
Now I can use pw-loopback(1):
$ pw-loopback -l 1 -c 2 --capture-props='node.name="desired_input_node.name"' --playback-props='node.name="desired_output_node.name"'
Wikipedia:Tablature editor
For now, I'm learning tuxguitarAUR.
For now, I'm experimenting with ardour.