[Solved] Trouble with NVIDIA drivers and secure boot after update

[mrM9]

Hello all!

I installed nvidia-current/525.147.05 driver with secure boot by following this guide: https://makedebianfunagainandlearnhowto ... ootworking

Today I updated the system and now I'm getting:

Code: Select all

$ sudo dkms status
nvidia-current/525.147.05, 6.1.0-18-amd64, x86_64: installed (WARNING! Diff between built and installed module!)

and:

Code: Select all

× nvidia-persistenced.service - NVIDIA Persistence Daemon
     Loaded: loaded (/lib/systemd/system/nvidia-persistenced.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Sat 2024-04-20 19:32:21 CEST; 2h 28min ago
    Process: 1255 ExecStart=/usr/bin/nvidia-persistenced --user nvpd (code=exited, status=1/FAILURE)
    Process: 1280 ExecStopPost=/bin/rm -rf /var/run/nvidia-persistenced (code=exited, status=0/SUCCESS)
        CPU: 11ms

Apr 20 19:32:21 Debian systemd[1]: Starting nvidia-persistenced.service - NVIDIA Persistence Daemon...
Apr 20 19:32:21 Debian nvidia-persistenced[1263]: Started (1263)
Apr 20 19:32:21 Debian nvidia-persistenced[1263]: Failed to query NVIDIA devices. Please ensure that the NVIDIA device files (/dev/nvidia*) exist, and that user 114 has read and write permissions for those files.
Apr 20 19:32:21 Debian nvidia-persistenced[1255]: nvidia-persistenced failed to initialize. Check syslog for more details.
Apr 20 19:32:21 Debian nvidia-persistenced[1263]: Shutdown (1263)
Apr 20 19:32:21 Debian systemd[1]: nvidia-persistenced.service: Control process exited, code=exited, status=1/FAILURE
Apr 20 19:32:21 Debian systemd[1]: nvidia-persistenced.service: Failed with result 'exit-code'.
Apr 20 19:32:21 Debian systemd[1]: Failed to start nvidia-persistenced.service - NVIDIA Persistence Daemon.

It's my first time. Anyone has any idea on how to fix this?

[Aki]

Hello,

The error message WARNING! Diff between built and installed module! could make sense:

• the loaded kernel modules is modified at binary level (as a file) by the signature required by secure boot (appended to the kernel module file)

• therefore, the signed kernel module is different from the its native built version (without signature)

Perhaps you did not sign all kernel modules required by the nvidia proprietary driver, therefore nvidia-persistenced.service fails

The Debian repository (non-free section) hosts the nvidia kernel modules (an their dependencies) and you may install them (after removing what you already installed):

• https://packages.debian.org/bookworm/nvidia-driver

Here the Debian Wiki page:

• https://wiki.debian.org/NvidiaGraphicsDrivers

Hope this helps.

[mrM9]

Hello,

Is there a way to fix this mess I created by updating kernel from Linux 6.1.0-18-amd64 x86_64 to Linux 6.1.0-20-amd64 x86_64 while keeping the drivers I have (i.e. making them work on Linux 6.1.0-20-amd64 x86_64)?

[mrM9]

Solved.

For anyone with my same problem, purge all Nvidia drivers.

Assuming you saved the resources you got while following

https://web.archive.org/web/20230929035 ... ootworking (archived)

you can simply do:

Code: Select all

sudo apt-get install nvidia-settings nvidia-kernel-dkms nvidia-cuda-mps nvidia-driver nvidia-cuda-mps vulkan-tools firmware-linux firmware-linux-nonfree firmware-misc-nonfree nvidia-kernel-dkms

Code: Select all

VERSION="$(uname -r)"
SHORT_VERSION="$(uname -r | cut -d . -f 1-2)"
MODULES_DIR=/lib/modules/$VERSION
KBUILD_DIR=/usr/lib/linux-kbuild-$SHORT_VERSION
cd "$MODULES_DIR/updates/dkms"
sudo apt-get install sbsigntool

Code: Select all

read -s KBUILD_SIGN_PIN

Enter the PIN you chose.

Code: Select all

export KBUILD_SIGN_PIN

Code: Select all

for i in *.ko ; do sudo --preserve-env=KBUILD_SIGN_PIN "$KBUILD_DIR"/scripts/sign-file sha256 /var/lib/shim-signed/mok/MOK.priv /var/lib/shim-signed/mok/MOK.der "$i" ; done

Then reboot and run

Code: Select all

nvidia-smi

It was that simple.

Thank you Aki for your help.

[Aki]

Hello,

I'm glad you sorted it out and thanks for reporting back the solution you found. :)

Please, mark the discussion as "solved" manually adding the text tag "[Solved]" at the beginning of the subject of the first message (after other tags, if any); i.e. :

[Solved] Trouble with NVIDIA drivers and secure boot after update

Happy Debian !