i915: module verification failed: signature and/or required key missing - tainting kernel

[kenjieo]

Hello,
I'm new to Proxmox and came from QNAP.
I'm pretty new to all of these things and have almost zero knowledge about linux.
Anyway, I'm trying to create VFs for my Intel 12400's iGPU (UHD 730)
My goal is to assign a virtual iGPU to my Plex and Windows 11 VMs.

Here's my hardware:
-Intel 12400 (iGPU UHD 730)
-Asus Z690 Gaming Tuff D4 (VT-d and SR-IOV are enabled)
-Samsung Evo 840 120GB and Patriot Elite 120GB Burst on RAID1 as Proxmox boot drive.
-I also have several HDDs and NVME SSDs but haven't connected those yet.

Other info:

Linux 6.5.13-3-pve (2024-03-20T10:45Z)

Boot Mode: EFI

Manager Version: pve-manager/8.1.10/4b06efb5db453f29

I tried to follow this guide.

However, when doing "dmesg | grep i915", I'm getting this error.

[ 0.000000] Command line: initrd=\EFI\proxmox\6.5.13-3-pve\initrd.img-6.5.13-3-pve root=ZFS=rpool/ROOT/pve-1 boot=zfs intel_iommu=on iommu=pt i915.enable_guc=3 i915.max_vfs=7
[ 0.029919] Kernel command line: initrd=\EFI\proxmox\6.5.13-3-pve\initrd.img-6.5.13-3-pve root=ZFS=rpool/ROOT/pve-1 boot=zfs intel_iommu=on iommu=pt i915.enable_guc=3 i915.max_vfs=7
[ 3.418306] i915: module verification failed: signature and/or required key missing - tainting kernel
[ 3.636376] i915 0000:00:02.0: Running in SR-IOV PF mode
[ 3.637382] i915 0000:00:02.0: [drm] VT-d active for gfx access
[ 3.637402] i915 0000:00:02.0: vgaarb: deactivate vga console
[ 3.637446] i915 0000:00:02.0: [drm] Using Transparent Hugepages
[ 3.638089] i915 0000:00:02.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=io+mem:owns=io+mem
[ 3.639083] mei_hdcp 0000:00:16.0-b638ab7e-94e2-4ea2-a552-d1c54b627f04: bound 0000:00:02.0 (ops i915_hdcp_ops [i915])
[ 3.639400] i915 0000:00:02.0: [drm] Finished loading DMC firmware i915/adls_dmc_ver2_01.bin (v2.1)
[ 3.644992] i915 0000:00:02.0: [drm] GT0: GuC firmware i915/tgl_guc_70.bin version 70.20.0
[ 3.644998] i915 0000:00:02.0: [drm] GT0: HuC firmware i915/tgl_huc.bin version 7.9.3
[ 3.647236] i915 0000:00:02.0: [drm] GT0: HuC: authenticated for all workloads!
[ 3.647536] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled
[ 3.647540] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled
[ 3.647884] i915 0000:00:02.0: [drm] GuC RC: enabled
[ 3.648335] mei_pxp 0000:00:16.0-fbf6fcf1-96cf-4e2e-a6a6-1bab8cbe36b1: bound 0000:00:02.0 (ops i915_pxp_tee_component_ops [i915])
[ 3.648435] i915 0000:00:02.0: [drm] Protected Xe Path (PXP) protected content support initialized
[ 3.649727] [drm] Initialized i915 1.6.0 20201103 for 0000:00:02.0 on minor 0
[ 3.651052] snd_hda_intel 0000:00:1f.3: bound 0000:00:02.0 (ops i915_audio_component_bind_ops [i915])
[ 3.651166] i915 0000:00:02.0: 7 VFs could be associated with this PF
[ 3.651615] i915 0000:00:02.0: [drm] Cannot find any crtc or sizes
[ 3.651834] i915 0000:00:02.0: [drm] Cannot find any crtc or sizes



Here's my "DKMS Status"

i915-sriov-dkms/6.5.13-3, 6.5.13-3-pve, x86_64: installed

Here's my /etc/kernel/cmdline
root=ZFS=rpool/ROOT/pve-1 boot=zfs intel_iommu=on iommu=pt i915.enable_guc=3 i915.max_vfs=7


I've been trying out to figure this out for 3 days now, I've tried several guides but I'm just unable to make it work.
Please help.

 

[kenjieo]

Resolved.
Reinstalled Proxmox on a non-raid boot drive and just followed the instructions and worked perfectly after that.
Although, if anyone can help me how to make this work on a raid boot drive, that would be great.

 

[drevilish]

I might be wrong but I think you need to add the

intel_iommu=on iommu=pt i915.enable_guc=3 i915.max_vfs=7

to

#/etc/default/grub

GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on iommu=pt pcie_aspm=force i915.enable_guc=3 i915.max_vfs=7"

Then
update-grub
update-initramfs -u

 

[SInisterPisces]

@drevilish , the guide OP is using has configurations for both Systemd-boot and GRUB. The config he posted is the syntax for the Systemd boot config.

@kenjieo When you reinstalled, did you enable secure boot with GRUB? That would make that warning disappear, as the module would be properly signed and the keys would be enrolled by MOK (according to the tutorial instructions). I'm on a ZFS mirror (RAID1) for my boot drive, and didn't have any issues following the tutorial--at least none tracable to my RAID config.

If you're still using SystemD/non-Secure Boot, and having an issue with RAID, it might be something different. I'm assuming you're using ZFS, but how exactly did you try to set up the RAID?

I struggled with this quite a bit. For anyone else who finds this thread:
On a non-Secure Boot system, the following text is a warning, not an error. It should not impact whether or not the DKMS works.
On a Secure Boot system, it IS an error and will prevent the DKMS from working unless you followed the steps to enable the DKMS for secure boot in OP's linked tutorial.

[    3.418306] i915: module verification failed: signature and/or required key missing - tainting kernel

That is, with Secure Boot off, dmesg will warn you about the kernel being tainted, but still load the module(s) it's complaining about.

Example - ZFS taints the kernel by having a license the kernel doesn't approve of (?), but clearly loads and works. And spl, too.

 dmesg | grep -i taint
[    5.768146] spl: loading out-of-tree module taints kernel.
[    5.793973] zfs: module license 'CDDL' taints kernel.
[    5.799254] Disabling lock debugging due to kernel taint
[    5.804780] zfs: module license taints kernel.
[    8.418305] i915: module verification failed: signature and/or required key missing - tainting kernel
[    8.737307] Setting dangerous option enable_guc - tainting kernel