Skip to content

Latest commit

 

History

History
83 lines (57 loc) · 2.77 KB

UEFI.md

File metadata and controls

83 lines (57 loc) · 2.77 KB

yum packaging precompiled kmod

UEFI Secure Boot

For general information: https://www.redhat.com/en/blog/uefi-secure-boot

Demo

asciinema

Verify that Secure Boot is enabled

  • The installation media (ISO-9660 image on CD/USB) for RHEL 8.x is bootable with UEFI Secure Boot enabled.
    • NOTE: make sure to select the EFI boot option to install an appropriate boot loader
$ sudo mokutil --sb-state
SecureBoot enabled

UEFI boot

note: may see above message from EFI stub at boot up

Precompiled driver

Instructions provided are for the precompiled streams only. Use of DKMS streams is not supported with this technique.

$ sudo dnf module install nvidia-driver:latest

or

$ sudo dnf module install nvidia-driver:XXX

Runlevel 3

A clean install of RHEL 8.x (without the NVIDIA driver) is bootable with UEFI Secure Boot enabled. Once the NVIDIA driver is installed, the nouveau driver will be disabled. Without the key enrolled in the MOK, the nvidia kernel modules will be unable to load. Therefore the system will either fallback to the VESA driver (if supported) or runlevel 3 (virtual terminal).

$ lsmod | grep -e nouveau -e nvidia

note: in this scenario, the output will be empty

To avoid this scenario, import the public key into the MOK database prior to reboot. See steps below.

Enroll key in MOK

Download the X.509 certificate public key

note: skip this step if using your own certificate

mokutil

$ sudo mokutil --import *public_key.der

note: you will be asked to create a new password (between 1-256 characters)

$ sudo mokutil --list-new | grep Issuer

note: the key to be enrolled should be listed

UEFI environment

On the next reboot, the MOK management interface will load.

UEFI enroll in MOK

  1. Press a key to continue.
  2. Select enroll MOK
  3. Select view key
  4. Confirm the key is correct
  5. Select yes to enroll the key into db
  6. Input the password created from the mokutil step
  7. Select reboot
  8. The NVIDIA kernel modules will load