1

I have Fedora 21 on a computer that I built with a NVIDIA GeForce GTX 660 Ti graphics card. When I was originally installing my system, I had a large number of issues with getting it running until I installed the kmod-nvidia package from RPMFusion. Since then, my experience in the operating system itself has been fine and smooth.

However, at the kernel selection screen and bootup process, I can tell that it is using the basic graphics drivers, as when it prompts me for the decryption passphrase, it uses a basic text interface (as compared to the normal text box that appears with the plymouth theme). Additionally, after entering my decryption phrase, it also loads up with the bar instead of the Fedora balloon.

This obviously isn't a major issue, but it is something that has had me curious for a while as I know my system has the capable drivers, but I just don't know how to get them loaded that early in the system.

When I was originally diagnosing and fixing my system, I followed this guide from if-not-true-then-false.

Any help is appreciated!

  • Any ideas? Still remains an issue on my system. – Justin W. Flory Apr 13 '15 at 14:09
1

Here's how I got the kmod-nvidia software from rpmfusion nonfree working with Fedora 26 on a machine configured for "secure boot" / UEFI. I had been getting the error "required key not available" when running modprobe against the nvidia kernel modules.

It's possible, and, not too hard, to keep UEFI secure boot enabled and run the proprietary nvidia driver.

  • After installing the rpmfusion free and nonfree repositories, install kmod-nvidia: dnf install kmod-nvidia
  • Create a self signed certificate and key by making openssl configuration and running the following:

    cd /root #or somewhere reasonably safe
    cat > mokutil-openssl.conf << XYZZY
    [ req ]
    default_bits = 4096
    distinguished_name = req_distinguished_name
    string_mask = utf8only
    x509_extensions = exts
    prompt = no
    
    [ req_distinguished_name ]
    O = username
    CN = username
    emailAddress = username@example.com
    
    [ exts ]
    basicConstraints=critical,CA:FALSE
    keyUsage=digitalSignature
    subjectKeyIdentifier=hash
    authorityKeyIdentifier=keyid
    XYZZY
    
    # create the certificate & key
    openssl req -x509 -new -nodes -utf8 -sha256 -days 7300 -config ./mokutil-openssl.conf -outform DER -out mokutil.der -keyout mokutil.key -batch
    # to verify the certificate:
    openssl x509 -inform DER -in ./mokutil.der -noout -text |less
    
  • Next, sign the new nvidia kernel modules with the provided utility:

    cd /lib/modules/$(uname -r)/extra/nvidia
    /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 /root/mokutil.key /root/mokutil.der nvidia.ko
    /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 /root/mokutil.key /root/mokutil.der nvidia-drm.ko 
    /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 /root/mokutil.key /root/mokutil.der nvidia-modeset.ko 
    /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 /root/mokutil.key /root/mokutil.der nvidia-uvm.ko 
    
  • The certificate needs to be added to the BIOS to be trusted:

    # first, we stage the new certificate to be added to the BIOS on 
    # the next reboot.  You will be prompted to enter a password when
    # running the utility; the BIOS will ask for the same password on 
    # reboot.
    mokutil --import ./mokutil.der
    
    # This command shows whether or not mokutil was able to stage the
    # new certificate for import into the BIOS.  If the process is 
    # unsuccessful, you may have to enter the BIOS and import the key
    # manually from its interface, perhaps from a USB stick.  If this
    # command returns your certificate, you should reboot.  The BIOS 
    # will prompt you to take action and enter in the password you
    # input in the previous step.
    mokutil -N
    
    # This command shows which certificates are trusted by the BIOS.
    # There will be one installed by the manufacturer and if 
    mokutil --list-enrolled 
    
  • If all went well, your machine should have loaded the new modules. You can check with lsmod |grep nvidia

  • You will have to sign the modules again when a new kernel is installed.

I found most of this information here, but the signing utility doesn't need to be called with perl. I also signed all four modules output by the kmod-nvidia build process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.