NVIDIA Open GPU Datacenter Drivers for RHEL9 Signed by Red Hat
NVIDIA and Red Hat have partnered to bring continued improvements to the precompiled
NVIDIA Driver introduced in 2020
. Last month, NVIDIA
announced
that the open GPU driver modules will become the default recommended way to enable NVIDIA graphics hardware.
Today, NVIDIA announced that Red Hat is now compiling and signing the
NVIDIA open GPU kernel modules
to further streamline the usage for the Red Hat Enterprise Linux 9 OS and to provide a way forward for supporting
Confidential Computing
with NVIDIA hardware in the datacenter.
The signed open GPU drivers can now be installed and used without any extra key enrollment configuration. As with the current legacy precompiled packages, only the latest RHEL 9 kernel is supported at the time of the driver update.
Starting with RHEL 9.5, NVIDIA now offers a tech preview repository available for trial until April 30, 2025. This repository enables the usage of the open GPU driver and legacy driver (with caveats) using
modularity streams
.
After the tech preview ends, the signed kernel modules will be available in the NVIDIA Compute package repositories with the rest of the CUDA platform: CUDA-X acceleration libraries, CUDA-optimized applications, and frameworks.
For more information about modularity streams and how they work with the precompiled graphics driver, see
Streamlining NVIDIA Driver Deployment on RHEL 8 with Modularity Streams
.
Activating the tech preview
To use the signed NVIDIA open GPU driver modules, make sure that the Red Hat repositories are enabled, including RHEL9 AppStream, RHEL9 BaseOS, and RHEL9 CRB:
$ subscription-manager repos --enable=rhel-9-for-x86_64-appstream-rpms
$ subscription-manager repos --enable=rhel-9-for-x86_64-baseos-rpms
$ subscription-manager repos --enable=codeready-builder-for-rhel-9-x86_64-rpms
Add the CUDA network repository:
$ sudo dnf config-manager --add-repo=https://developer.download.nvidia.com/compute/cuda/preview/repos/rhel9/x86_64/
When the tech preview repository is activated, view the supported modularity streams:
$ dnf module list nvidia-driver
Figure 1. Example output list from the tech preview tool of the NVIDIA modularity streams installed
The tech preview provides the following new modularity streams:
latest-open-gpu
<driver_version>-open-gpu
Install the latest stream to opt into the signed precompiled packages:
$ sudo dnf module install nvidia-driver:latest-open-gpu
Reboot and enjoy!
Figure 2. Example
nvidia-smi
command output showing the NVIDIA CUDA driver version running and system parameters
Important caveat with the tech preview repository
The legacy precompiled driver is also listed in the modularity streams:
nvidia-driver:latest
nvidia-driver:latest-<major_version>
nvidia-driver:<major_version>
These drivers have been signed by NVIDIA and require signing key enrollment. They install just fine without any warnings but upon reboot the NVIDIA graphics driver will not be available:
$ nvidia-smi
NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver. Make sure that the latest NVIDIA driver is installed and running.
Upon further inspection, the problem becomes clear:
# insmod /usr/lib/modules/5.14.0-503.16.1.el9_4.x86_64/extra/drivers/video/nvidia/nvidia.ko

insmod: ERROR: could not insert module /usr/lib/modules/5.14.0-503.16.1.el9_4.x86_64/extra/drivers/video/nvidia/nvidia.ko: Key was rejected by service
This happens because secure boot is enabled by default:
$ sudo mokutil --sb-state 
SecureBoot enabled
This module has been signed by NVIDIA using a key that is not in the chain of trust:
$ modinfo /usr/lib/modules/5.14.0-503.16.1.el9_4.x86_64/extra/drivers/video/nvidia/nvidia.ko | grep signer
signer: NVIDIA
For more information about enrolling the NVIDIA signing key with mokutil, see
UEFI Secure Boot
on GitHub.
Installation
Install the tech preview repository on a host with secure boot enabled:
$ sudo dnf config-manager --add-repo=https://developer.download.nvidia.com/compute/cuda/preview/repos/rhel9/x86_64/
$ sudo dnf module install nvidia-driver:latest-open-gpu
$ sudo reboot
If you discover any issues with packaging, please report those problems to
github.com/NVIDIA/yum-packaging-precompiled-kmod/issues
.
This repository will be active until March 31, 2025.
Summary
Now with signed packages from NVIDIA and Red Hat, secure boot with NVIDIA on RHEL 9 is even better. You can look forward to more developments in this space.
The driver source code is available in the
/NVIDIA/open-gpu-kernel-modules
GitHub repo.
Packaging templates and instructions are provided on GitHub to enable you to maintain your own precompiled kernel module packages for custom kernels and derivative Linux distros:
/NVIDIA/yum-packaging-precompiled-kmod
/NVIDIA/yum-packaging-nvidia-plugin
To give feedback,
send comments
or
report driver bugs
. If you are not already a member,
join the NVIDIA Developer Program
.
适用于 RHEL9 的 NVIDIA 开放 GPU 数据中心驱动，由 Red Hat 签署
NVIDIA 和 Red Hat 合作，对
2020 年推出的预编译 NVIDIA Driver
进行持续改进。上个月，NVIDIA
宣布
，开放的 GPU 驱动模组将成为启用 NVIDIA 图形硬件的默认推荐方式。
今天，NVIDIA 宣布 Red Hat 正在编译并签署
NVIDIA 开放 GPU 内核模块
，以进一步简化 Red Hat Enterprise Linux 9 操作系统的使用，并为在数据中心使用 NVIDIA 硬件支持
机密计算
提供前进方向。
现在无需任何额外的密钥注册配置即可安装和使用经过签名的开放 GPU 驱动。与当前的旧版预编译软件包一样，在驱动更新时仅支持最新的 RHEL 9 内核。
从 RHEL 9.5 开始，NVIDIA 现在提供技术预览库，可在 2025 年 4 月 30 日之前试用。此库允许使用
模块化流使
用开放式 GPU 驱动程序和旧版驱动程序（附带说明）。
技术预览结束后，已签名的内核模块将在 NVIDIA Compute 软件包存储库中与 CUDA 平台的其他部分一起提供：CUDA-X 加速库、CUDA 优化的应用和框架。
有关 模块化流及其如何与预编译图形驱动程序配合使用的更多信息 ，请参阅
Streamlining NVIDIA Driver Deployment on RHEL 8 with Modularity Streams
。
激活技术预览
要使用经过签名的 NVIDIA 开源 GPU 驱动模块，请确保已启用 Red Hat 资源库，包括 RHEL9 AppStream、RHEL9 BaseOS 和 RHEL9 CRB：
$ subscription-manager repos --enable=rhel-9-for-x86_64-appstream-rpms
$ subscription-manager repos --enable=rhel-9-for-x86_64-baseos-rpms
$ subscription-manager repos --enable=codeready-builder-for-rhel-9-x86_64-rpms
添加 CUDA 网络存储库：
$ sudo dnf config-manager --add-repo=https://developer.download.nvidia.com/compute/cuda/preview/repos/rhel9/x86_64/
激活技术预览库后，请查看支持的模块化流：
$ dnf module list nvidia-driver
图 1、已安装的 NVIDIA 模块化流的技术预览工具中的输出列表示例
技术预览提供了以下新的模块化流：
latest-open-gpu
<driver_version>-open-gpu
安装最新的流，选择使用经过签名的预编译软件包：
$ sudo dnf module install nvidia-driver:latest-open-gpu
重启并尽情享受吧！
图 2、显示
正在运行的 NVIDIA CUDA 驱动程序版本和系统参数的 nvidia-smi 命令输出示例
技术预览库的重要注意事项
旧版预编译驱动也列在模块化流中：
nvidia-driver:latest
nvidia-driver:latest-<major_version>
nvidia-driver:<major_version>
这些驱动已由 NVIDIA 签名，需要签名密钥注册。它们可以正常安装，没有任何警告，但在重启后，NVIDIA 图形驱动程序将不可用：
$ nvidia-smi
NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver. Make sure that the latest NVIDIA driver is installed and running.
经过进一步检查，问题变得明显：
# insmod /usr/lib/modules/5.14.0-503.16.1.el9_4.x86_64/extra/drivers/video/nvidia/nvidia.ko

insmod: ERROR: could not insert module /usr/lib/modules/5.14.0-503.16.1.el9_4.x86_64/extra/drivers/video/nvidia/nvidia.ko: Key was rejected by service
发生这种情况的原因是默认情况下启用了 secure boot：
$ sudo mokutil --sb-state 
SecureBoot enabled
本模块由 NVIDIA 使用不在信任链中的密钥进行签名：
$ modinfo /usr/lib/modules/5.14.0-503.16.1.el9_4.x86_64/extra/drivers/video/nvidia/nvidia.ko | grep signer
signer: NVIDIA
有关使用 mokutil 注册 NVIDIA 签名密钥的更多信息，请参阅 GitHub 上的 UEFI Secure Boot。
安装
在已启用安全启动的主机上安装技术预览库：
$ sudo dnf config-manager --add-repo=https://developer.download.nvidia.com/compute/cuda/preview/repos/rhel9/x86_64/
$ sudo dnf module install nvidia-driver:latest-open-gpu
$ sudo reboot
如果您发现任何打包问题，请向
github.com/NVIDIA/yum-packaging-precompiled-kmod/issues
报告这些问题。
此库的有效期至 2025 年 3 月 31 日。
总结
现在，借助 NVIDIA 和 Red Hat 的签名软件包，在 RHEL 9 上使用 NVIDIA 进行安全启动会更好。您可以期待此领域的更多开发。
您可在
/NVIDIA/open-gpu-kernel-modules
GitHub 仓库中获取驱动源代码。
GitHub 上提供了打包模板和说明，以便您为自定义内核和衍生 Linux 发行版维护自己的预编译内核模块包：
/NVIDIA/yum-packaging-precompiled-kmod
/NVIDIA/yum-packaging-nvidia-plugin
如要提供反馈，请
发送评论
或
报告驱动错误
。如果您还不是会员，请
加入 NVIDIA Developer Program
。