Installing Debian stable on a MSI Z690-A with Secureboot

[modo72]

Hello out there, I got a brand new MSI Z690 board on which I want to install Debian 12. But so far I can only login over console or ssh because the free Nouveau driver does not support the GFX board (GeForce RTX 4060Ti). So I installed everything I need for building the nvidia kernel module. That worked but then the trouble started. The board has SecureBoot on, so I had to sign the kernel modules and used this site as guidance: Sign modules for secure boot in Debian (GitHub Gist).

So Step 1 broke already. I was able to enroll DKMS signing key.

Code: Select all

 mokutil --import /var/lib/dkms/mok.pub

But after restarting the system, the MOK manger should be invoked, a plain ncurses interface but never showed up. I use filesystem encryption, maybe this is a problem?
Step 2 works fine of course, but when I start this command to sign my module

Code: Select all

 sudo --preserve-env=KBUILD_SIGN_PIN "$KBUILD_DIR"/scripts/sign-file sha256 "$PRIV_KEY" "$PUB_KEY" nvidia-current.ko

I got this error

At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: nvidia-current

And here is stuck. Switching off SecureBoot leads to a kernel panic at startup, so this is neither a solution

I hope you can help me

Thanks in advance

/Chris

[Peter Zehnder]

check out
https://github.com/stezzbruh/Debian-Secure-Boot

[modo72]

Hello Peter, thank you. This Readme is really helpful and I was indeed able to "go into the MOK manager and enroll my keys. Now it seems that the kernel module is getting accepted. But so far the system crashes again, or rather it freezes down, stalks during boot. When I boot in recovery mode, I was able to get some information:

Code: Select all

dmesg | grep nvidia

[ 33.397616] nvidia: loading out-of-tree module taints kernel.
[ 33.397858] nvidia: module license 'NVIDIA' taints kernel.
[ 33.547860] nvidia-nvlink: Nvlink Core is being initialized, major device number 237
[ 33.548784] nvidia 0000:01:00.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=none:owns=none
[ 33.693047] nvidia-modeset: Loading NVIDIA Kernel Mode Setting Driver for UNIX platforms 535.183.01 Sun May 12 19:31:08 UTC 2024
[ 33.779997] [drm] [nvidia-drm] [GPU ID 0x00000100] Loading driver
[ 33.780187] [drm] Initialized nvidia-drm 0.0.0 20160202 for 0000:01:00.0 on minor 1
[ 34.180507] audit: type=1400 audit(1729801244.120:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe" pid=1210 comm="apparmor_parser"
[ 34.180508] audit: type=1400 audit(1729801244.120:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe//kmod" pid=1210 comm="apparmor_parser"

what irritates me here, are the two latest lines: was the module now accepted or not ?

but lsmod gives clear information:

nvidia_drm 77824 0
nvidia_modeset 1314816 1 nvidia_drm
nvidia 56778752 1 nvidia_modeset
drm_kms_helper 212992 3 drm_display_helper,nvidia_drm,i915
drm 614400 8 drm_kms_helper,drm_display_helper,nvidia,drm_buddy,nvidia_drm,i915,ttm
video 65536 2 i915,nvidia_modeset

and then the X-server log: Xorg log on pastebin

maybe this has something to do that the GFX card doesn't get enough information about the display?

Thanks a lot

BR /Christian

[modo72]

Unfortunately I was not able to solve this problem, I still do not have a full installation. I disabled SecureBoot completely, but the problem remains. Any idea what I can check to see what can be the problem? I added loglevel=3 to the cmdline and got this dump from dmesg: dmesg with loglevel=3

Thanks again

BR /Christian

[stevepusser]

Are you getting the drivers from the Debian nonfree repository section?

Bookworm might not support some brand-new hardware, either. It could help if we knew what else is on that board.