Setting up NVidia drivers on Fedora 34 with Gnome and Wayland on a PRIMUS enabled laptop with secureboot enabled.

tags: Linux Fedora Nvidia optimus secureboot drivers

This has been eluding me for a looooong time. Since I got a new SSD anyway, I thought it would be a good time to do a clean install of Fedora 34 and see if I can get my nvidia dGPU to work. There are tons of manuals out there, but none of them match my setup. First of all, linux distro's are starting to switch to Wayland by default, so all the ones that describe how to do it on X11 are outdated. Also, X11 doesn't handle my dual hidpi/lowdpi monitors elegantly, so I prefer Wayland anyway. Secondly, since i also have windows 11 on this laptop, I need secureboot turned on. Which most of them tell you to turn off. ANd lastly, there are guides how to set it up with Bumblebee, but recent Fedora/Gnome version say it should work with PRIME_RENDER_OFFLOAD environment variables only. So I had to find a bunch of different manuals to piece the different parts together, but eventually I made it work. Maybe there are some details I forgot, or there may be something that is slightly different in your setup, but this probably is a lot closer if you're in the same boat as me.

Create the keypair and enroll them for module signing in secureboot

From https://gist.github.com/reillysiemens/ac6bea1e6c7684d62f544bd79b2182a4

Create this script in /root/module-signing/sign_module. This is just for convenience so you don't have to remember the commands later. It allows you to specify a kernel module, which gets signed using the keys created and renrolled below.

#!/bin/bash
module=$1
for modfile in $(dirname $(modinfo -n "$module"))/*.ko; do
        hexdump -Cv  "$modfile" | tail -n 5
done
for modfile in $(dirname $(modinfo -n "$module"))/*.ko; do
        /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 /root/module-signing/MOK.priv /root/module-signing/MOK.der "$modfile"
done
for modfile in $(dirname $(modinfo -n "$module"))/*.ko; do
        hexdump -Cv  "$modfile" | tail -n 5
done

Create the keypair with

name="$(getent passwd $(whoami) | awk -F: '{print $5}')"
out_dir='/root/module-signing'
sudo mkdir ${out_dir}
sudo openssl \
    req \
    -new \
    -x509 \
    -newkey \
    rsa:2048 \
    -keyout ${out_dir}/MOK.priv \
    -outform DER \
    -out ${out_dir}/MOK.der \
    -days 36500 \  # This is probably waaay too long.
    -subj "/CN=${name}/"
sudo chmod 600 ${out_dir}/MOK*

Enroll this keypair with (this will ask for a password that you will need to enter later. Don't loose it.)

sudo mokutil --import /root/module-signing/MOK.der

Now reboot your laptop, and when prompted, enter the password you just added to the key.

Make sure wayland works with gnome and nvidia

From https://forum.manjaro.org/t/howto-use-wayland-with-propietary-nvidia-drivers/36130
In /etc/gdm/custom.conf make sure the line with WaylandEnabled=false is commented

In /usr/lib/udev/rules.d/61-gdm.rules comment all the lines that disable wayland in gdm with nvidia drivers:

# disable Wayland on Hi1710 chipsets
#ATTR{vendor}=="0x19e5", ATTR{device}=="0x1711", RUN+="/usr/libexec/gdm-runtime-config set daemon WaylandEnable false"
# disable Wayland when using the proprietary nvidia driver
#DRIVER=="nvidia", RUN+="/usr/libexec/gdm-runtime-config set daemon WaylandEnable false"
# disable Wayland if modesetting is disabled
#IMPORT{cmdline}="nomodeset", RUN+="/usr/libexec/gdm-runtime-config set daemon WaylandEnable false"

Enable kms-modifiers to enable Vulkan an OpenGL on wayland:

gsettings set org.gnome.mutter experimental-features [\"kms-modifiers\"]

Blacklist the nouveau driver and enable nvidia drm

Make a file /etc/modprobe.d/nvidia-blacklist.conf with the following content:

blacklist nouveau

Blacklist the module too in grub. In /etc/default/grub on the line with GRUB_CMDLINE_LINUX add this at the end of the line, before the closing quote (after quiet usually):

rd.driver.blacklist=nouveau nvidia-drm.modeset=1

Uninstall xorg-x11-drv-nouveau.

Install the nvidia binary drivers

From https://docs.fedoraproject.org/en-US/quick-docs/how-to-set-nvidia-as-primary-gpu-on-optimus-based-laptops/

Update dnf:

sudo dnf update

In the gnome software center, under repositories (in the hamburger menu), you need to enable the RPM Fusion for Fedora 32 - Nonfree - NVIDIA Driver repository.

Update your software and refresh the list:

sudo dnf update --refresh

Install the drivers:

sudo dnf install gcc kernel-headers kernel-devel akmod-nvidia xorg-x11-drv-nvidia xorg-x11-drv-nvidia-libs xorg-x11-drv-nvidia-libs.i686

Force build the initramfs and kernel module with:

sudo akmods --force
sudo dracut --force

Sign the kernel module

This needs to be done every time a new kernel module is built. Like on every kernel update.
You can run sudo /root/module-signing/sign_module nvidia && sudo /root/module-signing/sign_module nvidia-uvm

Test

After a reboot, hopefully the kernel module is loaded.
If you dnf install glxspheres64 you can test it with:

__NV_PRIME_RENDER_OFFLOAD=1 __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0 __GLX_VENDOR_LIBRARY_NAME=nvidia __VK_LAYER_NV_optimus=NVIDIA_only glxspheres64

which on the commandline should tell you it's running using the nvidia GPU:

 __NV_PRIME_RENDER_OFFLOAD=1 __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0 __GLX_VENDOR_LIBRARY_NAME=nvidia __VK_LAYER_NV_optimus=NVIDIA_only glxspheres64
Polygons in scene: 62464 (61 spheres * 1024 polys/spheres)
GLX FB config ID of window: 0x190 (8/8/8/0)
Visual ID of window: 0x285
Context is Direct
OpenGL Renderer: NVIDIA GeForce MX150/PCIe/SSE2
61.279911 frames/sec - 68.388381 Mpixels/sec
59.161910 frames/sec - 66.024692 Mpixels/sec
59.986810 frames/sec - 66.945279 Mpixels/sec