Dear Maintainer,

I try to make work nvidia kernel module on a freshly updated debian
testing. My computer is an Asus Zenbook UX433F, which embeds this card:

     02:00.0 3D controller: NVIDIA Corporation GP108M [GeForce MX150]
(rev a1)

I installed the nvidia driver using:

      apt install xserver-xorg-video-nvidia

If I (re)starting the system, nvidia kernel is not loaded. dmesg report
this error:

     [    3.325581] Lockdown: modprobe: unsigned module loading is
restricted; see https://wiki.debian.org/SecureBoot

I circumvent the problem by following these steps:
https://unix.stackexchange.com/questions/543576/modprobe-fails-with-permission-denied

     echo 1 > /proc/sys/kernel/sysrq
     echo x > /proc/sysrq-trigger

By doing so, I can load the module:

     modprobe nvidia

dmesg seems ok:

     [  339.479444] nvidia-nvlink: Unregistered the Nvlink Core, major
device number 241
     [  344.166734] nvidia-nvlink: Nvlink Core is being initialized,
major device number 241
     [  344.267272] NVRM: loading NVIDIA UNIX x86_64 Kernel Module 
440.64  Fri Feb 21 01:17:26 UTC 2020
     [  359.809282] broken atomic modeset userspace detected, disabling
atomic
     [  423.153455] nvidia-uvm: Loaded the UVM driver, major device
number 239.
     [  424.737852] nvidia-modeset: Loading NVIDIA Kernel Mode Setting
Driver for UNIX platforms  440.64  Fri Feb 21 00:43:19 UTC 2020
     [  435.647404] broken atomic modeset userspace detected, disabling
atomic

If I try to run /etc/init.d/nvidia-persistenced restart as root, this
directoy is populated:

nvidia-persistenced.pid  socket

But:

1) I'll have to run those echo command in the next reboot

2) nvidia-settings does not run and returns:

     ERROR: Unable to load info from any available system

3) nvidia-smi does not list running process:

     Sun Mar  8 16:25:59 2020
+-----------------------------------------------------------------------------+
     | NVIDIA-SMI 440.64       Driver Version: 440.64       CUDA
Version: N/A      |
|-------------------------------+----------------------+----------------------+
     | GPU  Name        Persistence-M| Bus-Id Disp.A | Volatile Uncorr.
ECC |
     | Fan  Temp  Perf  Pwr:Usage/Cap| Memory-Usage | GPU-Util  Compute M. |
|===============================+======================+======================|
     |   0  GeForce MX150       Off  | 00000000:02:00.0 Off
|                  N/A |
     | N/A   50C    P0    N/A /  N/A |      0MiB / 2002MiB |     
0%      Default |
+-------------------------------+----------------------+----------------------+

+-----------------------------------------------------------------------------+
     | Processes: GPU Memory |
     |  GPU       PID   Type   Process name                            
Usage      |
|=============================================================================|
     |  No running processes
found                                                 |
+-----------------------------------------------------------------------------+


What should I do to make it work? Attached nvidia-bug-report.sh output
to this message.

Best regards
mando

*** End of the template - remove these template lines ***

Dear maintainers,

My problem is solved.

It was happening because I did signed nvidia-kernel.ko as explained here in:
https://wiki.debian.org/SecureBoot

In the details, to automate the process for future nvidia-kernel-dmks
update, I relied on this link:
https://gist.github.com/dop3j0e/2a9e2dddca982c4f679552fc1ebb18df

So, I generated my MOK key, rebooted my computer to enroll it, and
created /etc/dkms/nvidia-current.conf containing:

POST_BUILD=../../../../../../root/module-signing/dkms-sign-module

Then, I installed optirun and nvidia-smi:

apt install primus nvidia-smi

... rebuilt the nvidia module and

apt reinstall nvidia-kernel-dkms

... and provided the passphrase of my MOK key (see dkms-sign-module)
when prompted.

After reboot, the nvidia module is now correctly loaded:

(mando@aldur) (~) $ lsmod | grep nvidia
nvidia_drm             53248  0
nvidia_modeset       1118208  1 nvidia_drm
nvidia              20467712  19 nvidia_modeset
ipmi_msghandler        65536  2 ipmi_devintf,nvidia
drm_kms_helper        212992  2 nvidia_drm,i915
drm                   548864  13 drm_kms_helper,nvidia_drm,i915

In the details, if I run:

optirun glxgears

... and nvidia-smi in another terminal, I get:

(mando@aldur) (~) $ nvidia-smi
Tue Apr 14 03:58:29 2020
+-----------------------------------------------------------------------------+
| NVIDIA-SMI 440.64       Driver Version: 440.64       CUDA Version:
N/A      |
|-------------------------------+----------------------+----------------------+
| GPU  Name        Persistence-M| Bus-Id        Disp.A | Volatile
Uncorr. ECC |
| Fan  Temp  Perf  Pwr:Usage/Cap|         Memory-Usage | GPU-Util 
Compute M. |
|===============================+======================+======================|
|   0  GeForce MX150       On   | 00000000:02:00.0 Off
|                  N/A |
| N/A   46C    P0    N/A /  N/A |     10MiB /  2002MiB | 4%      Default |
+-------------------------------+----------------------+----------------------+

+-----------------------------------------------------------------------------+
| Processes: GPU Memory |
|  GPU       PID   Type   Process name                            
Usage      |
|=============================================================================|
|    0      2306      G /usr/lib/xorg/Xorg                            
7MiB |
|    0      2310      G glxgears                                      
2MiB |
+-----------------------------------------------------------------------------+

Best regards, you can close the bug

mando

It would be helpful if you could write the specifics of that in this
bug report, as that page is no longer available.


Regards,
Paul

Hello Paul,

Thank you for you message. In the following link, you'll find the two
scripts I'm currently using.

https://forums.developer.nvidia.com/t/linux-nvidia-gpu-screens-are-not-yet-supported/120834/7
<https://forums.developer.nvidia.com/t/linux-nvidia-gpu-screens-are-not-yet-supported/120834/7>

*Current status:*

On first nvidia-kernel-dkms installation*:
*

  * First, run enroll.sh to create the pair of key.
  * Second, reboot and enter the BIOS to enroll your keys.
  * Third, run sign.sh and reboot (*).

On linux-image/nvidia-kernel-dkms updates:

  * Run sign.sh to sign the new nvidia module. In my case, I know that I
    must run the script because I see a red line when booting under Debian.
  * Note that in sign.sh, KBUILD_VER is computed from the running
    kernel. This means that you might need to reboot on the new kernel
    before running sign.sh. You could also adapt the script for every
    installed kernel.
  * Then, reboot (*).

*Wish list:*

  * nvidia-kernel-dkms should first determine whether the secure boot is
    enabled or not. If so, it should create a new pair of keys (if not
    yet existing) and indicate the procedure to enroll the key in the BIOS.
  * nvidia-kernel-dkms should install a kind of post-install rule for
    linux-image (I don't know if it's possible) to run sign.sh for the
    new kernel.

Best regards,
mando

(*) You could probably just unload/reload nvidia module and restart X
server. I reboot because it is simpler.

Le 28/05/2021 à 15:07, Paul Slootman a écrit :