With secure boot I cannot adjust monitor brightness, legacy boot fixes this but has other problems

Hi,

On my HP ZBook G5 laptop, i upgraded from leap 15.1 to 15.2. With the former, 15.1, everything was fine. 15.2 gives mainly problems. I am running the KDE desktop, but GNOME gives the same problems, so I think it is the underlying kernel, currently 5.3.18-lp152.57-default

One of the problems I have is that the brightness of the screen can no longer be adjusted. The control to do so is present, I can vary the control from min to max, but there is no effect.

It now turns-out that when I disable the secure boot, and use the legacy boot instead, I am able to change the monitor brightness!

However, when using the legacy boot, my (KDE) desktop looks and behaves quiet different: KDE-dialogs are somewhat bigger. but dialogs popping-up from other applications are too small to read (the laptop has a 4K screen). Also, the mouse cursor is hardly visible when it hovers above the background, taking normal sizes above windows. Hence, although the legacy boot solves the brightness issue, I am left with an unworkable laptop. With secure boot, the brightness of the screen makes it painful to use when in dimlight conditions.

Any suggestions to address tese issue are welcomed!
Regards
Bertwim

Additional info: I upgraded to the latest stable kernel,
5.9.13-3.g3dfd18b-default

Issues remain the same.

Bertwim

You can boot with secure-boot, which uses UEFI.

You should be able to boot with UEFI, but secure-boot disabled.

And then there is legacy booting. For that to be possible, you would have needed to install booting separately.

Have you tried all three of those?

With secure-boot on, you could also try:

modutil --disable-validation

(you will be prompted on the next boot to allow that change). That turns off some of the secure-boot restrictions, but your BIOS is still set to use secure-boot.

HI, thanks for responding!

The only thing I did to change the booting process was to change the options in the BIOS from
“Secure booting enabled, Legacy disabled” to “Secure booting disabled, Legacy enabled” . There is also an option where both flavours are disabled, but that option seemed not appropriate to me.
I did not install anything special for the legacy booting.

I was not aware that one can use UEFI without the secure boot. I more or less thought this was the same thing…
However, when I tried your suggestion, I get the response:

====
scarlatti:~ # modutil --disable-validation
ERROR: Unknown option: --disable-validation.

Netscape Cryptographic Module Utility
Usage: modutil [command] [options]

followed by a usage() type of output.

Can you suggest what I should do?

Regards
Bertwim

Oops – typo.

That should have been

mokutil --disable-validation

It uses “MokManager”. The “Mok” prefix there stands for “Machine owner key”. It has to do with managing secure-boot keys.

When you disable validation, then secure-boot it still used to check booting. But module signatures are not used.

You can also try the command

bootctl

That won’t do anything important, but it will tell you whether you are booted using UEFI and whether secure-boot is enabled.

Judging only by your description, my guess is that you are still using UEFI booting but with secure-boot disabled when you do that. It is technically different from legacy booting.

Are you using a video card that requires installing additional drivers?

I would suggest you read the man pages:

man 7 kernel_lockdown

except that somehow those man pages did not get installed (maybe I should file a bug report on that). But you can still find that documentation with a google search in your browser. It might be worth checking whether that is related to the problem.

I guess you are taking a crash course on the complexities of modern computing.

Hi
It could also be the systemd acpi backlight control vs hardware brightness control (I see that on my HP AMD laptops), check the journal for backlight.


journalctl -b | grep "backlight"

Dec 12 09:23:41 laptop kernel: [drm] amdgpu atom DIG backlight initialized
Dec 12 09:23:42 laptop systemd[1]: Created slice system-systemd\x2dbacklight.slice.
Dec 12 09:23:42 laptop systemd[1]: Starting Load/Save Screen Backlight Brightness of backlight:amdgpu_bl0...
Dec 12 09:23:43 laptop systemd[1]: Started Load/Save Screen Backlight Brightness of backlight:amdgpu_bl0.

systemctl status systemd-backlight@backlight:acpi_video0.service

● systemd-backlight@backlight:acpi_video0.service
   Loaded: masked (/dev/null; masked)
   Active: inactive (dead)

systemctl status systemd-backlight@backlight:amdgpu_bl0.service

● systemd-backlight@backlight:amdgpu_bl0.service - Load/Save Screen Backlight Brightness of backlight:amdgpu_bl0
   Loaded: loaded (/usr/lib/systemd/system/systemd-backlight@.service; static; vendor preset: disabled)
   Active: active (exited) since Sat 2020-12-12 09:23:43 CST; 3min 22s ago
     Docs: man:systemd-backlight@.service(8)
 Main PID: 964 (code=exited, status=0/SUCCESS)

Dec 12 09:23:42 laptop systemd[1]: Starting Load/Save Screen Backlight Brightness of backlight:amdgpu_bl0...
Dec 12 09:23:43 laptop systemd[1]: Started Load/Save Screen Backlight Brightness of backlight:amdgpu_bl0.

Else it could be an acpi_osi issue…
Ref: https://www.kernel.org/doc/Documentation/acpi/osi.txt

I have been busy following-up earlier suggestions and did some more experimentation. I believe the suggestion of malcolmlewis may be right. Alsom, nrickert’s suggestion of the graphical driver is related (i use the nvidia driver from the repository).

  1. Using the mokutil --disable-validation approach:(after reading how this mok-thing works). The systems now reboots while in the top-left corner it flashes “booting in insecure mode”, so I assume this is what was intended. Problems ream the same.

  2. The kernel-lockdown feature was introduced in kernel version 5.4. Although I currently have 5.9, the problem was there already with 5.3.19, so earlier than 5.4.

  1. I made a USB-fashdrive **with a Fedora33 livesystem **on it (it also has a recent kernel, 5.8 or 5.9. When I booted from that flashdrive, I got a KDE-desktop and I could adjust the monitor brightness. Moreover, while the system was booting, it showed one “FAILED”, in red characters.
    I made screenshots, but I don’t see how to upload these. Hence I type them here.
    **[FAILED}[/b] Failed to start Load/Save Screen Backlight Brightness of backlight:nv_backlight

Then, typing, as suggested o the screen:
systemctl status systemd.backlight@backlight@backlight:acpi_video0.service

gives: Fedora system.backlight** Failed to get backlightor LED device 'backlight:acpi_video0;" No such device.

**So indeed an error was detected, but somehow there was a corrective action, as monitor brightness is adjustable! Apparently a similar happened when I still was on Suse 15.1, but not on 15.2.

I hope this additional info gives others a clue of what I can do next. I haven’t the faintest idea,

Kind Regards
Bertwim

**

Hi
So this system is dual GPU?


/sbin/lspci -nnk | egrep -A3 "VGA|Display|3D"

Can you ensure you use secure boot, or if not normal uefi boot, no legacy (BIOS MBR) and run those commands again.

Yes, i think I use secure boot. If I type

bootctl

the response is

Using EFI System Partition at /boot/efi.
System:
     Firmware: n/a (n/a)
  Secure Boot: enabled
   Setup Mode: user

Current Loader:
      Product: n/a
          ESP: n/a
         File: └─n/a

Boot Loader Binaries:
          ESP: /boot/efi
systemd-boot not installed in ESP.
         File: └─/EFI/BOOT/bootx64.efi

Boot Loader Entries in EFI Variables:
        Title: opensuse-secureboot
           ID: 0x0006
       Status: active, boot-order
    Partition: /dev/disk/by-partuuid/703fc842-1dcb-425d-b539-6d8f220716a9
         File: └─/EFI/opensuse/shim.efi

Furthermore, typing


/sbin/lspci -nnk | egrep -A3 "VGA|Display|3D"

I get:

/sbin/lspci -nnk | egrep -A3 "VGA|Display|3D"
01:00.0 VGA compatible controller [0300]: NVIDIA Corporation GP107GLM [Quadro P2000 Mobile] [10de:1cba] (rev a1)
        Subsystem: Hewlett-Packard Company Device [103c:8451]
        Kernel modules: nouveau
01:00.1 Audio device [0403]: NVIDIA Corporation GP107GL High Definition Audio Controller [10de:0fb9] (rev a1)

I thought I was using the nvidia driver but the above suggests it is still the nouveau-driver?

Hi
How did you install the Nvidia driver, repository or hardway? Have you run mkinitrd to ensure the nouveau module is blacklisted? Boot from non-secure boot and see how it goes…

I installed the NVIDIA drivers from the repository. When nothing helped, I tried the NVIDIA hard way, making sure mkinitrd was run. Procedure went ok, no issues installing. But also not a solution. In fact, it was worse in the sense that I got en environment that resembles what I get with the nouveau driver. Fonts that are slightly too big and a mouse cursor that is way too small, hardly visible. After more attempts, I could no longer boot into a graphical environment anymore. At that moment I decided to go for a fresh install of leap 15.2 (grrr).
Now I a back at square one, with kernel 5.3.18 and the NVIDIA 450.80.02-lp152.37 driver taken from the repository.
But it looks still like the nouveaudriver case (coarse fonts, tiny mouse etc.)

This appears to be a Optimus setup. ie Intel+NVIDIA GPU’s

Simply installing NVIDIA drivers is not enough it is recommended to use suse-prime to control GPU usage.

Hi
The output from lspci already indicates just a Nvidia gpu…

Hi
You haven’t created a /etc/X11/xorg.conf file by chance?

Can disable and mask the acpi backlight service, not the nv one.

Specs on computer seem to indicate a Optimus laptop SO should have a Intel GPU also ???

Hi
Maybe disabled in the BIOS…

maybe, There seems to several hardware configs for that model

Wonder what the resolution of the screen is. May need to make some adjustments to dots per inch if the res is very high and screen is relatively small.

Things have improved a bit. I now have a situation where the backlight is adjustable a little bit. Less than it used to be in the good old days (of 15.1), but enough to protect my eyes in dim-light circumstances.

The font / cursor / dialog widths are still wrong, impractical. I can only find the mouse cursor by right-clicking (so that the context menu appears). But they all used to be ok!! I have seen other posts of people struggling with the same.

So I feel the issue has not yet been entirely solved.

Note that I have gone back to a fresh install of 15.2 + updates + nvidia driver (from repository).
Responding to the remarks / comments made above:

*/ There is no /etc/X11/xorg.conf. There is a directory /etc/X11/xorg.conf.d and there is a file /etc/X11/xorg.conf.install.

*) The screen has a resolution of 3840x2160, and the screen is just 15",

*) I don;t think there is any Intel graphics on board. I don’t see it in the BIOS, and it is also not in the output of

scarlatti:~ # /sbin/lspci -nnk | egrep -A3 "VGA|Display|3D"
01:00.0 VGA compatible controller [0300]: NVIDIA Corporation GP107GLM [Quadro P2000 Mobile] [10de:1cba] (rev a1)
        Subsystem: Hewlett-Packard Company Device [103c:8451]
        Kernel driver in use: nvidia
        Kernel modules: nouveau, nvidia_drm, nvidia

The presence of the noueau module still puzzles me, especially because this tiny cursor stuff is also what I got when I had only the nouvoudriver installed on the system. Is is possible that is still plays a role, somehow?

*) repeating the others commands that were suggested above:

hwinfo --gfxcard 
18: PCI 100.0: 0300 VGA compatible controller (VGA)             
  [Created at pci.386]
  Unique ID: VCu0.DuwXU5aeBkC
  Parent ID: vSkL.ytxrR7AdL16
  SysFS ID: /devices/pci0000:00/0000:00:01.0/0000:01:00.0
  SysFS BusID: 0000:01:00.0
  Hardware Class: graphics card
  Model: "nVidia GP107GLM [Quadro P2000 Mobile]"
  Vendor: pci 0x10de "nVidia Corporation"
  Device: pci 0x1cba "GP107GLM [Quadro P2000 Mobile]"
  SubVendor: pci 0x103c "Hewlett-Packard Company"
  SubDevice: pci 0x8451 
  Revision: 0xa1
  Driver: "nvidia"
  Driver Modules: "nvidia"
  Memory Range: 0xe8000000-0xe8ffffff (rw,non-prefetchable)
  Memory Range: 0xa0000000-0xafffffff (ro,non-prefetchable)
  Memory Range: 0xb0000000-0xb1ffffff (ro,non-prefetchable)
  I/O Ports: 0x4000-0x4fff (rw)
  Memory Range: 0xe9080000-0xe90fffff (ro,non-prefetchable,disabled)
  IRQ: 189 (94861 events)
  Module Alias: "pci:v000010DEd00001CBAsv0000103Csd00008451bc03sc00i00"
  Driver Info #0:
    Driver Status: nouveau is not active
    Driver Activation Cmd: "modprobe nouveau"
  Driver Info #1:
    Driver Status: nvidia_drm is active
    Driver Activation Cmd: "modprobe nvidia_drm"
  Driver Info #2:
    Driver Status: nvidia is active
    Driver Activation Cmd: "modprobe nvidia"
  Config Status: cfg=new, avail=yes, need=no, active=unknown
  Attached to: #13 (PCI bridge)

Primary display adapter: #18

journalctl -b | grep "backlight"
Dec 14 10:10:00 scarlatti systemd[1]: Created slice system-systemd\x2dbacklight.slice.
Dec 14 10:10:00 scarlatti systemd[1]: Starting Load/Save Screen Backlight Brightness of backlight:acpi_video0...
Dec 14 10:10:00 scarlatti systemd[1]: Started Load/Save Screen Backlight Brightness of backlight:acpi_video0.
Dec 14 10:10:03 scarlatti systemd[1]: Starting Load/Save Screen Backlight Brightness of backlight:nvidia_0...
Dec 14 10:10:03 scarlatti systemd[1]: Started Load/Save Screen Backlight Brightness of backlight:nvidia_0.
Dec 14 10:14:51 scarlatti org_kde_powerdevil[2389]: powerdevil: Kbd backlight brightness value:  0
Dec 14 10:53:47 scarlatti org_kde_powerdevil[2389]: powerdevil: Kbd backlight brightness value:  0
Dec 14 11:01:17 scarlatti org_kde_powerdevil[2389]: powerdevil: Kbd backlight brightness value:  0
systemctl status systemd-backlight@backlight:acpi_video0.service
● systemd-backlight@backlight:acpi_video0.service - Load/Save Screen Backlight Brightness of backlight:acpi_video0
   Loaded: loaded (/usr/lib/systemd/system/systemd-backlight@.service; static; vendor preset: disabled)
   Active: active (exited) since Mon 2020-12-14 10:10:00 CET; 1h 5min ago
     Docs: man:systemd-backlight@.service(8)
 Main PID: 1141 (code=exited, status=0/SUCCESS)
    Tasks: 0
   CGroup: /system.slice/system-systemd\x2dbacklight.slice/systemd-backlight@backlight:acpi_video0.service

Dec 14 10:10:00 scarlatti systemd[1]: Starting Load/Save Screen Backlight Brightness of backlight:acpi_video0...
Dec 14 10:10:00 scarlatti systemd[1]: Started Load/Save Screen Backlight Brightness of backlight:acpi_video0.

systemctl status systemd-backlight@backlight:nvidia_0.service
● systemd-backlight@backlight:nvidia_0.service - Load/Save Screen Backlight Brightness of backlight:nvidia_0
   Loaded: loaded (/usr/lib/systemd/system/systemd-backlight@.service; static; vendor preset: disabled)
   Active: active (exited) since Mon 2020-12-14 10:10:03 CET; 1h 6min ago
     Docs: man:systemd-backlight@.service(8)
 Main PID: 1981 (code=exited, status=0/SUCCESS)

Dec 14 10:10:03 scarlatti systemd[1]: Starting Load/Save Screen Backlight Brightness of backlight:nvidia_0...
Dec 14 10:10:03 scarlatti systemd[1]: Started Load/Save Screen Backlight Brightness of backlight:nvidia_0.

Hi
So disable the acpi one and mask and see how that goes…


systemctl stop systemd-backlight@backlight\:acpi_video0.service
systemctl disable systemd-backlight@backlight\:acpi_video0.service
systemctl mask systemd-backlight@backlight\:acpi_video0.service

The presence of nouveau is fine, it’s not the driver in use, all normal :wink:

Adjust resolution ie dots per inch. You have about 3840/15 685 dots per inch on the screen