Secure Boot key signing about lenovolegionlinux HOT 10 CLOSED

I guess @MrDuartePT knows this better!

from lenovolegionlinux.

@Reaversword Well i dont know what distro you are using but i recommed using sbctl is a easy process and allow to use the Microsoft key to be possible to use discrete mode with secure boot enable on linux (if you remove microsoft key you get black screen in discrete mode and in hybrid the nvidia module dosent load on boot [i know that because i try to use custom keys one time])

the guide i will post helps just install sbctl on your distro
secure boot guide: https://wiki.archlinux.org/title/User:Krin/Secure_Boot,_full_disk_encryption,_and_TPM2_unlocking_install#Secure_boot

from lenovolegionlinux.

@Reaversword Well i dont know what distro you are using but i recommed using sbctl is a easy process and allow to use the Microsoft key to be possible to use discrete mode with secure boot enable on linux (if you remove microsoft key you get black screen in discrete mode and in hybrid the nvidia module dosent load on boot [i know that because i try to use custom keys one time])

the guide i will post helps just install sbctl on your distro secure boot guide: https://wiki.archlinux.org/title/User:Krin/Secure_Boot,_full_disk_encryption,_and_TPM2_unlocking_install#Secure_boot

Do you mean that proprietary/nouveau just won't work at all in hybrid without those M$ keys? I thought that the arch wiki warning was mostly for some old laptops with broken BIOSes. Regarding nvidia is there some error that complaints about it or it just some generic error or smth?

from lenovolegionlinux.

If you remove the microsoft keys and activate secure boot you will get a black screen if you boot in discrete mode and in hybrid mode the nvidia/nouveau modules will load but the card cant be used. The problem is how nvidia vbios is sign on laptop and because lenovo legion laptop dont have optirom in the tpm you need to use the microsoft keys

This issues on sbctl project can help you understand:
Foxboron/sbctl#85 (comment)
Foxboron/sbctl#40

edit: on other word you can brick or laptop on discrete and need the blind bios method to go back to hybrid.

sbctl faq about Option Rom: https://github.com/Foxboron/sbctl/wiki/FAQ

from lenovolegionlinux.

@pm4rcin @Reaversword @johnfanv2 in the latest bios Option Rom is working:
➜ ~ doas sbctl status
Installed: ✓ sbctl is installed
Owner GUID:
Setup Mode: ✓ Disabled
Secure Boot: ✓ Enabled
Vendor Keys: tpm-eventlog
This means if you use sbctl to create or import your custom keys (or you can do everthing manually) and include the Option Rom the mux will be intact (you need to have AMD PSP or intel equivalent enable on the bios for the TPM to work after that i think you can disable it)

from lenovolegionlinux.

@MrDuartePT that's great to hear. Could you tell which laptop model do you have? I also have read the links you've provided and some more and found one example of hard-brick because of buggy firmware. But it was thinkpad t14s gen 1 AMD so I guess it shouldn't be a problem but who knows... I'll probably try it sooner or later but first I need to figure out how to do that on Fedora Sericea since it uses Windows keys. Or rI'll return again to Arch or smth :D

from lenovolegionlinux.

My laptop is a Legion 5 gen 6 AMD variant.
Fedora use MS key by default to provide compatible but i think you can change to Option Rom if possible. Try updating your bios version and then try to see if possible to change before distro hopping.
I think i will close this issue if you need any help go to the discord server and ping me.

from lenovolegionlinux.

Will this allow the preservation of secureboot keys after kernel updates? I heard that you need to manually recreate keys after every update (or something like that) and that sounds like a pain on arch

from lenovolegionlinux.

I allways use the same keys and my system automatic sign the kernel file after building the initramfs

from lenovolegionlinux.

Since this dosent have any activity for the past 1 month and the kernel module work with secure boot (at least on my setup using sbctl) I will close this issue.

from lenovolegionlinux.