CR-2026-06-19: Implementation

Implementation

Phase 0: Pre-Change Btrfs Snapshot

Take a read-only btrfs snapshot before modifying boot configuration. This provides a filesystem-level rollback point independent of the boot entry rollback documented in the rollback page.

The P16g deploy project (thinkpad-t16g) uses native btrfs snapshots — not snapper. The rollback procedure is documented in Phase 13 (Maintenance) of the deploy project.

Before — verify subvolume layout and /.snapshots exists

sudo btrfs subvolume list / | awk '{print $NF}'

Expected output (at minimum)

@
@snapshots
@var_log

@home is on a separate LUKS volume (crypthome), not cryptroot. It does not appear in this listing. Root subvolume snapshots cannot affect /home.

Before — check for existing snapshots

ls -la /.snapshots/ 2>&1

If /.snapshots does not exist, create it:

sudo mkdir -p /.snapshots

Change — take read-only pre-change snapshot

sudo btrfs subvolume snapshot -r / /.snapshots/pre-psr-fix-2026-06-19

After — verify snapshot created

sudo btrfs subvolume list /.snapshots | awk '{print $NF}'

Expected output (includes new snapshot)

@snapshots/pre-psr-fix-2026-06-19

Actual output — validated 2026-06-19 22:30

@
@snapshots
@var_log
@/var/lib/portables
@/var/lib/machines
pre-psr-fix-2026-06-19

Snapshot Rollback Procedure (if needed)

If the boot parameter change causes a worse problem than it fixes, roll back the entire filesystem state from a live USB or LTS kernel:

# 1. Boot from LTS kernel or live USB
# 2. Unlock and mount the btrfs volume
sudo cryptsetup luksOpen /dev/<device> cryptroot
sudo mount /dev/mapper/cryptroot /mnt

# 3. Replace current @ with the snapshot
sudo mv /mnt/@ /mnt/@broken-psr-fix
sudo btrfs subvolume snapshot /mnt/@snapshots/pre-psr-fix-2026-06-19 /mnt/@

# 4. Reboot into restored system
sudo umount /mnt
sudo reboot

After successful verification (Phase 4), the snapshot can be kept as a reference point or removed:

# Optional cleanup after verified success
sudo btrfs subvolume delete /.snapshots/pre-psr-fix-2026-06-19

Phase 1: Fix ESP Boot Entries (Immediate)

Both ESP entries are missing i915.enable_psr=0. This phase appends it to the options line in both.

Before — capture current state

sudo awk '/^options/' /boot/efi/loader/entries/arch.conf /boot/efi/loader/entries/arch-lts.conf

Expected output (no i915.enable_psr=0)

/boot/efi/loader/entries/arch.conf:options cryptdevice=UUID=... security=apparmor
/boot/efi/loader/entries/arch-lts.conf:options cryptdevice=UUID=... security=apparmor

Actual before output — validated 2026-06-19 22:35

options cryptdevice=UUID=a33cc5e6-0e54-4aa4-bc26-d08a212aa32a:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw nvidia_drm.modeset=1 mem_sleep_default=s2idle acpi_mask_gpe=0x6E lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor=1 security=apparmor
options cryptdevice=UUID=a33cc5e6-0e54-4aa4-bc26-d08a212aa32a:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw nvidia_drm.modeset=1 mem_sleep_default=s2idle acpi_mask_gpe=0x6E lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor=1 security=apparmor

Change — append PSR disable to both entries

sudo sed -i '/^options/ s/$/ i915.enable_psr=0/' /boot/efi/loader/entries/arch.conf /boot/efi/loader/entries/arch-lts.conf

After — verify parameter appended

sudo awk '/^options/' /boot/efi/loader/entries/arch.conf /boot/efi/loader/entries/arch-lts.conf

Expected output (parameter present at end of both lines)

/boot/efi/loader/entries/arch.conf:options cryptdevice=UUID=... security=apparmor i915.enable_psr=0
/boot/efi/loader/entries/arch-lts.conf:options cryptdevice=UUID=... security=apparmor i915.enable_psr=0

Actual after output — validated 2026-06-19 22:37

options cryptdevice=UUID=a33cc5e6-0e54-4aa4-bc26-d08a212aa32a:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw nvidia_drm.modeset=1 mem_sleep_default=s2idle acpi_mask_gpe=0x6E lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor=1 security=apparmor i915.enable_psr=0
options cryptdevice=UUID=a33cc5e6-0e54-4aa4-bc26-d08a212aa32a:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw nvidia_drm.modeset=1 mem_sleep_default=s2idle acpi_mask_gpe=0x6E lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor=1 security=apparmor i915.enable_psr=0

Phase 2: Create Persistent Kernel Command Line

Without /etc/kernel/cmdline, every kernel update regenerates ESP entries from scratch. This file is the canonical source that kernel-install reads when generating boot entries.

Before — confirm file does not exist

ls -la /etc/kernel/cmdline 2>&1

Expected output

ls: cannot access '/etc/kernel/cmdline': No such file or directory

Actual before output — validated 2026-06-19 22:40

"/etc/kernel/cmdline": No such file or directory (os error 2)

Change — create persistent cmdline

echo 'cryptdevice=UUID=a33cc5e6-0e54-4aa4-bc26-d08a212aa32a:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw nvidia_drm.modeset=1 mem_sleep_default=s2idle acpi_mask_gpe=0x6E lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor=1 security=apparmor i915.enable_psr=0' | sudo tee /etc/kernel/cmdline

After — verify file contents

cat /etc/kernel/cmdline

Expected output (single line, i915.enable_psr=0 at end)

cryptdevice=UUID=a33cc5e6-0e54-4aa4-bc26-d08a212aa32a:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw nvidia_drm.modeset=1 mem_sleep_default=s2idle acpi_mask_gpe=0x6E lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor=1 security=apparmor i915.enable_psr=0

Actual after output — validated 2026-06-19 22:40

cryptdevice=UUID=a33cc5e6-0e54-4aa4-bc26-d08a212aa32a:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw nvidia_drm.modeset=1 mem_sleep_default=s2idle acpi_mask_gpe=0x6E lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor=1 security=apparmor i915.enable_psr=0

Phase 3: Clean Up Stale XBOOTLDR Entry

The /boot/loader/entries/arch.conf (XBOOTLDR copy) has the parameter but is not read by systemd-boot. Synchronize it with the ESP version to avoid future confusion.

Before — check XBOOTLDR entry

sudo awk '/^options/' /boot/loader/entries/arch.conf

This file already has i915.enable_psr=0 from the May 23 edit. No change needed unless it has drifted. If the output matches the ESP version, skip this step.

Phase 4: Reboot and Verify

sudo reboot

After reboot, verify the login screen appears on the internal panel without an external monitor connected.