Running Fedora 41 Atomic, with a Nvidia 3080Ti GPU, trying to get the default Nouveau driver to load with Secure Boot Enabled.
Everything works fine with Kernel 6.13. However with both 6.14 and 6.15 the nouveau module is not loading, based on output of lsmod. I tested 6.14 with both Fedora 41 and 42, 6.15 with just F41, the issue is the same regardless of the Fedora version. To get module loading I override my rpm-ostree deployment with latest 6.13 kernel, leaving everything else in the image the same, and all is good. Seems likely to be an issue in the kernel packages based on all of that.
Looking at After upgrade to F42, I cannot load VirtualBox drivers signed modules in the kernel (SecureBoot) - #13 by cbr84 I see that both the xz compression and signing hash algo changed in 6.14.
It seems like the xz params are correct, but that the signing hash algo is using sha256, not sha512. However, I cherry-picked some modules that are loaded and checked, and both (wireguard and nf_tables) are also using sha256 signing hash algo, so not sure if this is a red herring:
$ xz -l -vv /lib/modules/6.15.3-100.fc41.x86_64/kernel/drivers/gpu/drm/nouveau/nouveau.ko.xz
/lib/modules/6.15.3-100.fc41.x86_64/kernel/drivers/gpu/drm/nouveau/nouveau.ko.xz (1/1)
Streams: 1
Blocks: 3
Compressed size: 1,090.8 KiB (1,117,016 B)
Uncompressed size: 8,272.4 KiB (8,470,950 B)
Ratio: 0.132
Check: CRC32
Stream Padding: 0 B
Streams:
Stream Blocks CompOffset UncompOffset CompSize UncompSize Ratio Check Padding
1 3 0 0 1,117,016 8,470,950 0.132 CRC32 0
Blocks:
Stream Block CompOffset UncompOffset TotalSize UncompSize Ratio Check CheckVal Header Flags CompSize MemUsage Filters
1 1 12 0 567,804 3,145,728 0.181 CRC32 d5362ce7 20 cu 567,779 2 MiB --lzma2=dict=1MiB
1 2 567,816 3,145,728 238,660 3,145,728 0.076 CRC32 e4301238 20 cu 238,636 2 MiB --lzma2=dict=1MiB
1 3 806,476 6,291,456 310,500 2,179,494 0.142 CRC32 507cd3ce 20 cu 310,473 2 MiB --lzma2=dict=1MiB
Memory needed: 2 MiB
Sizes in headers: Yes
Minimum XZ Utils version: 5.0.0
$ modinfo nouveau
vermagic: 6.15.3-100.fc41.x86_64 SMP preempt mod_unload
sig_id: PKCS#7
signer: Fedora kernel signing key
sig_key: 5C:E5:EF:7A:8F:F3:3C:C3:C1:43:89:D5:55:E5:C5:7F:71:7B:E2:53
sig_hashalgo: sha256
Trying to load the module manually fails:
# modprobe -vv nouveau
modprobe: INFO: libkmod/libkmod.c:391 kmod_set_log_fn() custom logging function 0x555fd1db5220 registered
insmod /lib/modules/6.15.3-100.fc41.x86_64/kernel/drivers/gpu/drm/nouveau/nouveau.ko.xz
modprobe: INFO: libkmod/libkmod-module.c:973 kmod_module_insert_module() Failed to insert module '/lib/modules/6.15.3-100.fc41.x86_64/kernel/drivers/gpu/drm/nouveau/nouveau.ko.xz': Operation not permitted
modprobe: ERROR: could not insert 'nouveau': Operation not permitted
modprobe: INFO: libkmod/libkmod.c:358 kmod_unref() context 0x555fe35104c0 released
The nouveau module is in the initramfs image:
$ lsinitrd /boot/ostree/fedora-3997c8e689d5605d8799f99c040bc3fd55c84fe8da3246740825f2eb12d0379d/initramfs-6.15.3-100.fc41.x86_64.img | grep -i nouveau
drwxr-xr-x 2 root root 0 Dec 31 1969 usr/lib/modules/6.15.3-100.fc41.x86_64/kernel/drivers/gpu/drm/nouveau
-rw-r--r-- 1 root root 1117016 Dec 31 1969 usr/lib/modules/6.15.3-100.fc41.x86_64/kernel/drivers/gpu/drm/nouveau/nouveau.ko.xz
Looking at dmesg warn level and above, and journalctl -k with warning level and above nothing is jumping out that is different compared to the 6.13 kernel.
Not sure if this is related, but another regression with kernel 6.14+ is failing to unmount certain mounts on shutdown. systemd-shutdown reports:
[FAILED] Failed unmounting etc.mount - /etc.
[FAILED] Failed unmounting usr.mount.
[ 185.018471] systemd-shutdown[1]: Unable to finalize remaining DM devices, ignoring.