Asking about why the kernel needs to support secure boot on an individual system where I am not concerned about the hole punched by the nvidia kernel module. I’m concerned about the proprietary boot loader firmware that will never be maintained well. I’m not asking if it is a good idea in general or for most people.
Shit Gigabyte Aorus YE5 laptop doesn’t support custom secure boot keys for PK in the bootloader. AVOID these thieves selling hardware you can’t own.
Why can’t an unsigned shitvidia kernel module run as a hotplugged device from user space without causing a problem with secure boot handover?
I can run Fedora with secure boot using the Microsoft 3rd party key. I just can’t enable the shitvidia GPU. My primary use case is for LLM/stable diffusion, the GPU doesn’t matter for graphics.
This is most likely there to patch holes from Windows than having anything to do with Linux specifically, as Linux is always an afterthought anyway for these manufacturers.
I think the idea is that hybrid GPUs on laptops are a lot more intimate with the CPU because of memory sharing and needing to DMA between the two GPUs directly. So you can’t exploit the GPU to rootkit the OS. Although I’m sure there’s a lot of ways to bypass that anyway from within Windows…
In my case here, I have a 16GBV 3080Ti paired with a 12 gen i7. The integrated graphics for the i7 are fine for all graphics operations I need. I got the GPU specifically for LLM stuff. The system memory is DDR5 and the GPU is DDR6. It is an optimus design, so it is a bit different than a desktop, but from what I’ve read, this is just a matter of thermal and power throttling features that are broken out for kernel controls that are not present in the desktop cards.
The bootloader issues are universal to all platforms that use UEFI. There are several documents available from the UEFI Consortium and NIST that cover the subject in detail and how to mitigate the problems.