Secureboot: Installation Successful but Not Working

[Mister-Chief-Bot]

Just changed from Windows 11 to Ubuntu 24.04 and am trying to connect my Xbox Elite Series 2 controller to my PC but it is not working as expected. I have mangaed to get the wired connection to work and my PC picks up the inputs. The moment I try to do Bluetooth my PC doesnt pick up the inputs but the Bluetooth connects to my PC.

This is the output of sudo ./install.sh

WARNING: kernel uhid module not found, controller firmware 5.x will not be supported

• deploying DKMS package
  Creating symlink /var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/source -> /usr/src/hid-xpadneo-v0.9-226-ga16acb0
• building module
  Sign command: /usr/bin/kmodsign
  Signing key: /var/lib/shim-signed/mok/MOK.priv
  Public certificate (MOK): /var/lib/shim-signed/mok/MOK.der

Building module:
Cleaning build area...
make -j20 KERNELRELEASE=6.11.0-29-generic -C '/lib/modules/6.11.0-29-generic/build' M='/var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src' VERSION='v0.9-226-ga16acb0' modules...
Signing module /var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src/hid-xpadneo.ko
Cleaning build area...

• installing module

hid-xpadneo.ko.zst:
Running module version sanity check.

• Original module
  • No original module exists within this kernel
• Installation
  • Installing to /lib/modules/6.11.0-29-generic/updates/dkms/

Running the post_install script:
Not disabling ERTM, kernel version doesn't require it...
Installing modalias database...
Installing udev rules...
Reloading udev...
depmod...

My kernal is: 6.11.0-29-generic

[kakra]

Please try running sudo modprobe hid-xpadneo, then check dmesg for any obvious errors.

[Mister-Chief-Bot]

Thank You. After running the sudo modprobe hid-xpadneo I realized that my computer was still in Secure boot. Once that was disabled we followed your instructions and were able to connect.

Thank You.

[kakra]

I wonder why it failed because dkms was using the MOK commands to sign the module... Thus, it should work with secureboot.

[oerkel47]

I wonder why it failed because dkms was using the MOK commands to sign the module... Thus, it should work with secureboot.

I believe to have a similiar/same problem and I don't know why. The module will not be loaded.

dmesg:

[ 1384.365902] hid-generic 0005:045E:0B13.000E: input,hidraw12: BLUETOOTH HID v5.23 Gamepad [Xbox Wireless Controller] on 00:1a:7d:da:71:15
[ 1384.366937] Loading of module with unavailable key is rejected

modprobe:

modprobe: ERROR: could not insert 'hid_xpadneo': Key was rejected by service

Kernel signing + secure boot works fine so I don't know what's going on here or where the problem originates.

Verbose installation log:

• verbose mode enabled

• source lib/installer.sh
  ++ '[' -n '' ']'
  ++ '[' 0 -ne 0 ']'
  +++ git rev-parse --show-toplevel
  ++ GIT_ROOT=/home/yannick/xpadneo
  +++ __version
  +++ git describe --tags --dirty
  ++ VERSION=v0.9-226-ga16acb0
  +++ type -p dkms
  ++ DKMS_BIN=/usr/sbin/dkms
  ++ : /usr/sbin/dkms
  ++ mapfile -t INSTALLED
  +++ get_dkms_versions_installed
  +++ /usr/sbin/dkms status
  +++ tr -s ':,/ ' ' '
  +++ awk -- '$1 == "hid-xpadneo" { print $2 }'
  +++ sort -nu
• set -e
• [[ ! -d /sys/devices/virtual/misc/uhid ]]
• echo '* deploying DKMS package'

• deploying DKMS package

• make VERSION=v0.9-226-ga16acb0 install
  { [ -n "v0.9-226-ga16acb0" ] && echo v0.9-226-ga16acb0 || git describe --tags --dirty; } >VERSION
  make VERSION="v0.9-226-ga16acb0" -C hid-xpadneo dkms.conf
  make[1]: Entering directory '/home/yannick/xpadneo/hid-xpadneo'
  sed 's/"@DO_NOT_CHANGE@"/"v0.9-226-ga16acb0"/g' <"dkms.conf.in" >"dkms.conf"
  make[1]: Leaving directory '/home/yannick/xpadneo/hid-xpadneo'
  mkdir -p /etc/modprobe.d /etc/udev/rules.d /usr/share/doc/xpadneo
  install -D -m 0644 -t /etc/modprobe.d hid-xpadneo/etc-modprobe.d/xpadneo.conf
  install -D -m 0644 -t /etc/udev/rules.d hid-xpadneo/etc-udev-rules.d/60-xpadneo.rules hid-xpadneo/etc-udev-rules.d/70-xpadneo-disable-hidraw.rules
  install -D -m 0644 -t /usr/share/doc/xpadneo NEWS.md docs/3P-BUGS.md docs/BT_DONGLES.md docs/CONFIGURATION.md docs/DEBUGGING.md docs/PACKAGING.md docs/README.md docs/SDL.md docs/TESTING.md docs/TROUBLESHOOTING.md
  dkms add hid-xpadneo
  Creating symlink /var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/source -> /usr/src/hid-xpadneo-v0.9-226-ga16acb0
  rm VERSION
• echo '* building module'

• building module

• dkms build --verbose hid-xpadneo/v0.9-226-ga16acb0
  Sign command: /usr/bin/kmodsign
  Signing key: /var/lib/shim-signed/mok/MOK.priv
  Public certificate (MOK): /var/lib/shim-signed/mok/MOK.der

Building module:
make -C '/lib/modules/6.16.0-061600-generic/build' M='/var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src' clean
make: Entering directory '/usr/src/linux-headers-6.16.0-061600-generic'
make[1]: Entering directory '/var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src'
CLEAN Module.symvers
make[1]: Leaving directory '/var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src'
make: Leaving directory '/usr/src/linux-headers-6.16.0-061600-generic'

{ make -j16 KERNELRELEASE=6.16.0-061600-generic -C '/lib/modules/6.16.0-061600-generic/build' M='/var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src' VERSION='v0.9-226-ga16acb0' modules; } >> /var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/make.log 2>&1

Signing module /var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src/hid-xpadneo.ko
make -C '/lib/modules/6.16.0-061600-generic/build' M='/var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src' clean
make: Entering directory '/usr/src/linux-headers-6.16.0-061600-generic'
make[1]: Entering directory '/var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src'
CLEAN Module.symvers
make[1]: Leaving directory '/var/lib/dkms/hid-xpadneo/v0.9-226-ga16acb0/build/src'
make: Leaving directory '/usr/src/linux-headers-6.16.0-061600-generic'

• echo '* installing module'

• installing module

• dkms install --verbose '' hid-xpadneo/v0.9-226-ga16acb0

hid-xpadneo.ko.zst:
Running module version sanity check.

• Original module
  • No original module exists within this kernel
• Installation
  • Installing to /lib/modules/6.16.0-061600-generic/updates/dkms/

Running the post_install script:
Not disabling ERTM, kernel version doesn't require it...
Installing modalias database...
Installing udev rules...
Reloading udev...
do_depmod 6.16.0-061600-generic

[kakra]

Reopening, because disabling secureboot is not an acceptable solution.

[oerkel47]

So I managed to fix this problem for me. Turns out the key used for module signing (MOK.der) was not enrolled. So this might have been an individual problem on my setup as I have played around with secure boot and kernel signing (using mainline kernels with secure boot).

Some time ago, Linux Mint made the jump to Ubuntu base 24.04 and the the fwts-efi-runtime-dkms package was upgraded. I had to do some problem fixing after that upgrade but it also made signing Kernels >=6.12 possible without manualy editing source files as 6.12 deprecated some stuff.

TLDR: Probably you need to re-enroll the MOK.der key:

sudo mokutil --import 
/var/lib/shim-signed/mok/MOK.der

[kakra]

Thanks for finding the issue. Please keep this opened so I can document it.