启用Secure Boot与TPM的Ubuntu加密磁盘启动时不显示加密密码对话框的问题求助

Hey there, let’s dig into your problem and figure out what’s going on, along with practical solutions and tradeoffs to consider.

Why this is happening #

Your setup has a few key factors colliding here:

• 12th Gen Intel CPU: It uses a hybrid P-core/E-core architecture, and the i915 integrated graphics driver can have initialization quirks in the early boot stage (before disk decryption) when Secure Boot is enabled.
• Secure Boot + TPM: These security features require all kernel modules (like i915) to be properly signed. If the i915 driver isn’t loaded or initialized correctly in the initramfs phase (when disk decryption runs), it might hijack the display output or fail to render the password prompt—especially if your main monitor is connected to your RTX 3070Ti instead of the Intel iGPU.
• Disk encryption: The decryption prompt runs very early in the boot process, before the full graphics stack loads. If the wrong display adapter (iGPU) is being used for output here, you won’t see the prompt even if it’s technically running.

Fixes to try (in order of preference) #

Let’s start with solutions that let you keep i915 enabled, since disabling it has clear tradeoffs.

1. Ensure i915 is properly signed and initialized for Secure Boot #

• First, install the latest Intel microcode (critical for 12th Gen CPU stability and compatibility):

  sudo apt update && sudo apt install intel-microcode
  

• Regenerate your initramfs to ensure the signed i915 driver is included in the early boot image:

  sudo update-initramfs -u
  

• Check if i915’s signature is enrolled in Secure Boot:

  mokutil --list-enrolled
  

  Look for entries related to Intel or i915. If none appear, you might need to re-enroll Ubuntu’s driver signatures (this usually happens automatically during driver installs, but sometimes needs a refresh—you’ll be prompted to set a MOK password and reboot to complete enrollment).

2. Force early boot to use your NVIDIA GPU for output #

Since your main monitor is connected to the RTX 3070Ti, we can tell the kernel to initialize the NVIDIA driver early so the decryption prompt shows up on the right display:

• Edit your GRUB config file:

  sudo nano /etc/default/grub
  

• Modify the GRUB_CMDLINE_LINUX_DEFAULT line to include nvidia-drm.modeset=1 (you can keep quiet splash or remove it—this parameter is the key fix):

  GRUB_CMDLINE_LINUX_DEFAULT="nvidia-drm.modeset=1 quiet splash"
  

• Update GRUB to apply changes:

  sudo update-grub
  

• Reboot and test if the decryption prompt appears without needing i915.modeset=0.

3. If all else fails: Understand the tradeoffs of disabling i915 #

If you have to stick with i915.modeset=0 or modprobe.blacklist=i915, here’s what you’ll lose:

• Integrated graphics functionality: The Intel iGPU will be completely disabled. You won’t be able to use it for secondary monitors, video decoding via Quick Sync (which is faster than NVIDIA for some formats), or any features relying on the iGPU.
• Minor efficiency hits: 12th Gen CPUs use the iGPU for some power management tasks, but this is negligible for desktop setups with a dedicated GPU.
• Future flexibility: If you ever want to use the iGPU (e.g., adding a second monitor connected to the motherboard), you’ll need to re-enable it and troubleshoot the original issue again.

For a desktop where you only use the RTX 3070Ti as your main display, disabling i915 won’t break core functionality—but fixing the root cause is still the better long-term solution.

备注：内容来源于stack exchange，提问作者pxffluvluv