How to build an external kernel module

[a-bali]

I'm trying to build the upstream it87 kernel module for Talos in order to have lm-sensors support for my chipset which is not in the mainline kernel. I'm following the guide here.

I created the following config for this package:

name: it87
variant: scratch      # base container for environment (e.g. alpine, scratch)
shell: /bin/sh        # shell to use to execute commands in steps
dependencies:         # other steps required before building package
  - stage: base
  - stage: kernel-build
steps:                # steps needed to build package container
  - sources:          # download source files
      - url: https://github.com/frankcrawford/it87/archive/02200290da8639630018567c11d129edc0d6bdca.zip
        destination: it87.zip
        sha256: a16ab37fb67e71e3e46dd750962f2bdc7605f0976b48202c56775047fb1043ad
        sha512: e963811f137988ab56eef27b270e10e52f82b521a44fff4ecb87d309a6a3d8562f0595bb9f95c1e0b8b38c5b7c7fbc5bf48fcbe7f24ca8be725fc4e2e6ff567b
    prepare:          # create directories and untar
      - unzip it87.zip
    build:            # compiling software
      - make -C it87-02200290da8639630018567c11d129edc0d6bdca
    install:          # move compiled software to correct directory
      - make DESTDIR=/rootfs install
    test:             # validate software
      - fhs-validator /rootfs
finalize:             # copy directory structure from source to destination
  - from: /rootfs
    to: /

But when I run the build command, it completes for the kernel and fails for the module:

$ gmake kernel it87 REGISTRY=host:5000 PLATFORM=linux/amd64 PUSH=true
[...]
=> CACHED it87:copy                                                                                                                0.0s
 => CACHED it87:context /it87 -> /pkg                                                                                               0.0s
 => CACHED it87:mkdir /tmp/build                                                                                                    0.0s
 => CACHED it87:cksum-prepare                                                                                                       0.0s
 => CACHED it87:cksum-verify                                                                                                        0.0s
 => CACHED it87:download finalize                                                                                                   0.0s
 => CACHED it87:download                                                                                                            0.0s
 => CACHED it87:prepare-0                                                                                                           0.0s
 => ERROR it87:build-0                                                                                                              0.1s
------
 > it87:build-0:
0.115 make[1]: *** /lib/modules/x86_64-talos-linux-musl/build: No such file or directory.  Stop.
0.117 make: *** [Makefile:73: modules] Error 2
------
ERROR: failed to build: failed to solve: process "/bin/sh -c set -eou pipefail\nmake -C it87-02200290da8639630018567c11d129edc0d6bdca" did not complete successfully: exit code: 2

Indeed this directory does not exist in the builder environment - I suppose I would need the output from the kernel build in the module build container. Any ideas how to fix this?

[smira]

Take a look at how other out-of-tree modules are built in pkgs, it depends on the module you're trying to build, but you need to give at a proper directory with kernel source. But basically it's the module you're trying to build issue.

/lib/modules/x86_64-talos-linux-musl/build: this is meaningless.

[a-bali]

Okay, right, I fixed the issue with the module and it now builds fine. However following the guide, I am now stuck at the step where I should be building the extension:

$ gmake it87 REGISTRY=host:5000 PLATFORM=linux/amd64 PUSH=true
gmake[1]: Entering directory '/Users/balia/dev/talos/extensions'
gmake[2]: Entering directory '/Users/balia/dev/talos/extensions'
[+] Building 1.3s (4/4) FINISHED                                                                          docker-container:talos-builder
 => [internal] load build definition from Pkgfile                                                                                   0.0s
 => => transferring dockerfile: 2.37kB                                                                                              0.0s
 => resolve image config for docker-image://ghcr.io/siderolabs/bldr:v0.5.4                                                          0.6s
 => CACHED docker-image://ghcr.io/siderolabs/bldr:v0.5.4@sha256:99de7371eaf3a3349d5f200871ab8287fd54b3fd2b4784b0ea45be7e31855eff    0.0s
 => => resolve ghcr.io/siderolabs/bldr:v0.5.4@sha256:99de7371eaf3a3349d5f200871ab8287fd54b3fd2b4784b0ea45be7e31855eff               0.0s
 => load Pkgfile, pkg.yamls and vars.yamls                                                                                          0.0s
 => => transferring dockerfile: 33.39kB                                                                                             0.0s
Pkgfile:1
--------------------
   1 | >>> # syntax = ghcr.io/siderolabs/bldr:v0.5.4
   2 |
   3 |     format: v1alpha2
--------------------
ERROR: failed to build: failed to solve: failed to marshal LLB for platform linux/amd64 and target it87: invalid checksum digest length

$ cat it87/pkg.yaml
name: it87
variant: scratch      # base container for environment (e.g. alpine, scratch)
shell: /bin/sh        # shell to use to execute commands in steps
dependencies:         # other steps required before building package
  - stage: base
  - image: host:5000/siderolabs/it87-pkg:v1.12.0-alpha.0-29-g3a0900f-dirty@sha256:8364d1f5dbec125fd9ca306f07f35bcd
steps:
  - install:
      - mkdir -p /rootfs/usr/lib/modules
      - cp -R /usr/lib/modules/* /rootfs/usr/lib/modules/
finalize:
  - from: /rootfs
    to: /rootfs
  - from: /pkg/manifest.yaml  # make sure you add the metadata file
    to: /

[a-bali]

Nevermind, I fixed this by removing the @sha256:... part from the image reference.

[a-bali]

So I managed to complete the documentation to the letter, but still my custom module it87 is not getting loaded (it says it is not signed?). Also the official i915 module somehow got lost in the process. Any ideas how to fix it?

10.10.2.115: kern:  notice: [2025-10-07T10:15:14.360541725Z]: Loading of unsigned module is rejected
10.10.2.115: user: warning: [2025-10-07T10:15:14.361181725Z]: [talos] controller failed {"component": "controller-runtime", "controller": "runtime.KernelModuleSpecController", "error": "error loading module \"i915\": module not found\nerror loading module \"it87\": load it87 failed: key was rejected by service"}

[a-bali]

It's not dropping the caches, the rebuild is almost instant.

[frezbo]

probably have a corrupted cache or not using the right PKGS_KERNEL for the talos build

[a-bali]

No, the issue is that the .ko file, which is built out-of-tree, is not signed.

[frezbo]

Then the issue is with the build script for that module, you might need to explicitly tell it needs to be signed as here https://github.com/siderolabs/pkgs/blob/main/zfs/pkg.yaml#L30

also the next step should error if the module is not signed at all

[a-bali]

Indeed, the issue was the non-standard install part. I was expecting the signing to be completed at build time, but it is completed actually on the modules_install action from the kernel source tree. Here is the fixed pkg.yaml which works fine:

name: it87-pkg
variant: scratch      # base container for environment (e.g. alpine, scratch)
shell: /bin/sh        # shell to use to execute commands in steps
dependencies:         # other steps required before building package
  - stage: base
  - stage: kernel-build
steps:                # steps needed to build package container
  - sources:          # download source files
      - url: https://github.com/frankcrawford/it87/archive/02200290da8639630018567c11d129edc0d6bdca.zip
        destination: it87.zip
        sha256: a16ab37fb67e71e3e46dd750962f2bdc7605f0976b48202c56775047fb1043ad
        sha512: e963811f137988ab56eef27b270e10e52f82b521a44fff4ecb87d309a6a3d8562f0595bb9f95c1e0b8b38c5b7c7fbc5bf48fcbe7f24ca8be725fc4e2e6ff567b
    prepare:          # create directories and untar
      - unzip it87.zip
    build:            # compiling software
      - make -C /src M=$(pwd)/it87-02200290da8639630018567c11d129edc0d6bdca modules
    install:          # move compiled software to correct directory
      - make -C /src M=$(pwd)/it87-02200290da8639630018567c11d129edc0d6bdca modules_install INSTALL_MOD_PATH=/rootfs/usr/ INSTALL_MOD_DIR=drivers/hwmon INSTALL_MOD_STRIP=1
    test:             # validate software
      - fhs-validator /rootfs
finalize:             # copy directory structure from source to destination
  - from: /rootfs
    to: /