[Solved] Broadcome driver issue with "Secure boot" enabled

[newmint]

Hi All,
I know, generally there is a problem with Broadcome drivers but I can make it working as advised on Mint site. I connected to internet via cable and then launch ”Update Driver” and install it. After that WiFi was working with no issues.
All of the above was when I disabled secure boot.

Then I enabled “Secure boot” and I got an issue that there is no wifi again.

Couple of questions:
1. Does it mean I cannot have Broadcome driver working with secure boot enabled?
I am not even sure what it have to do with wifi as it should prevent OS to start but I have no issue with starting Mint, only problem with wifi.

2. I disabled secure boot again… but driver still was not working. More than that. I disabled device, then tried to install driver again as before, but with no success. Basically something got completely “screwed up” and I could not re-install driver, no matter what I tried. Any idea what to do? Apart of re-installing Mint, I can do it as well, but wandering if there is something else I can do?

Thanks a lot for any help.

[sleeper12]

Let's see what this shows:

Code: Select all

 inxi -Fxxxz && rfkill list && iwconfig && mokutil --sb-state 

[newmint]

Hi Sleeper12,
and thank you for looking into this.

To make it clean test i have completely re-installed Mint with disabled secure boot.
- connected via cable and updated driver for broadcome.
- WiFi worked fine after that point.
- applied all updates.

After that:
1. I enabled "secure boot" WiFi disappeared and no Broadcome driver there anymore.
2. Executed commanded you have advised and results are below.
3. Disabled "secure boot" and one Mint started WiFi was back. I did not even need to do anything.

I am not sure why result a bit different, in terms that now after I disabled secure boot there were no problem. The only difference is that i have not tried to connect via cable and install driver when secure boot was enabled. I think that is when some got "weird" but after that the only halp was to re-install mint and was not ready to do it again right now, but i can repeat that as well...

I did not do anything else so far.
You help much appreciated and thanks again.

Result of command:

Code: Select all

mintadmin@lmint:~$ inxi -Fxxxz && iwconfig && mokutil --sb-state
System:
  Kernel: 5.4.0-67-generic x86_64 bits: 64 compiler: gcc v: 9.3.0 
  Desktop: Cinnamon 4.8.6 wm: muffin 4.8.1 dm: LightDM 1.30.0 
  Distro: Linux Mint 20.1 Ulyssa base: Ubuntu 20.04 focal 
Machine:
  Type: Laptop System: Sony product: SVF1521E2EW v: C10JHN8D 
  serial: <filter> Chassis: type: 10 serial: <filter> 
  Mobo: Sony model: VAIO serial: <filter> UEFI: Insyde v: R0250DA 
  date: 07/19/2016 
Battery:
  ID-1: BAT1 charge: 34.1 Wh condition: 34.1/42.3 Wh (80%) volts: 5.2/14.4 
  model: SONY Corp. VGP-BPS35A type: Li-ion serial: <filter> status: Full 
CPU:
  Topology: Dual Core model: Intel Core i3-3217U bits: 64 type: MT MCP 
  arch: Ivy Bridge rev: 9 L2 cache: 3072 KiB 
  flags: avx lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx bogomips: 14367 
  Speed: 798 MHz min/max: 800/1800 MHz Core speeds (MHz): 1: 798 2: 798 
  3: 798 4: 798 
Graphics:
  Device-1: Intel 3rd Gen Core processor Graphics vendor: Sony driver: i915 
  v: kernel bus ID: 00:02.0 chip ID: 8086:0166 
  Display: x11 server: X.Org 1.20.9 driver: modesetting unloaded: fbdev,vesa 
  resolution: 1366x768~60Hz 
  OpenGL: renderer: Mesa DRI Intel HD Graphics 4000 (IVB GT2) 
  v: 4.2 Mesa 20.2.6 compat-v: 3.0 direct render: Yes 
Audio:
  Device-1: Intel 7 Series/C216 Family High Definition Audio vendor: Sony 
  driver: snd_hda_intel v: kernel bus ID: 00:1b.0 chip ID: 8086:1e20 
  Sound Server: ALSA v: k5.4.0-67-generic 
Network:
  Device-1: Broadcom and subsidiaries BCM43142 802.11b/g/n vendor: Foxconn 
  driver: N/A port: 3040 bus ID: 07:00.0 chip ID: 14e4:4365 
  Device-2: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet 
  vendor: Sony driver: r8169 v: kernel port: 2000 bus ID: 0e:00.0 
  chip ID: 10ec:8168 
  IF: enp14s0 state: down mac: <filter> 
Drives:
  Local Storage: total: 465.76 GiB used: 9.34 GiB (2.0%) 
  ID-1: /dev/sda vendor: Western Digital model: WD5000LPVX-55V0TT0 
  size: 465.76 GiB speed: 6.0 Gb/s rotation: 5400 rpm serial: <filter> 
  rev: 1A01 scheme: GPT 
Partition:
  ID-1: / size: 201.07 GiB used: 9.29 GiB (4.6%) fs: ext4 dev: /dev/sda8 
Sensors:
  System Temperatures: cpu: 50.0 C mobo: N/A 
  Fan Speeds (RPM): N/A 
Info:
  Processes: 206 Uptime: 3m Memory: 3.72 GiB used: 715.1 MiB (18.7%) 
  Init: systemd v: 245 runlevel: 5 Compilers: gcc: 9.3.0 alt: 9 Shell: bash 
  v: 5.0.17 running in: gnome-terminal inxi: 3.0.38 
lo        no wireless extensions.

enp14s0   no wireless extensions.

SecureBoot enabled

[sleeper12]

Sorry, you lost me. You have wifi right now or not? If not, disable secure boot again.

[sleeper12]

You should leave secure boot disabled. If wifi still doesn't work, do:

Code: Select all

 sudo apt install --reinstall bcmwl-kernel-source 

Reboot

[newmint]

Sorry, if I confused you.
When I disable secure boot then it is all working fine and I have WiFi.

I want to figure out how i can WiFi working with enabled secure boot. if it possible?

Thank you for your command.
I have tried your command with secure boot enabled and I think it might help. During execution It seems it generates MOK but I made a mistake when it rebooted to "Enroll MOK" I accidently choose different option...

Now I think I need to re-install mint before i try it all again. I wanted to use timeshift for "clean run" but forgot to exclude "update grub menu" checks but they are checked by default and now I cannot get into Mint.

Too many mistakes I just will re-install it all to make everything clean and let you know what happens.

Thank you very much again.

[Pjotr]

Sorry, if I confused you.
When I disable secure boot then it is all working fine and I have WiFi.

I want to figure out how i can WiFi working with enabled secure boot. if it possible?

Probably not. But why are you so keen on having Secure Boot enabled? After all, it doesn't add any meaningful security anyway....

Secure Boot (a highly misleading term if there ever was one) is primarily just a means for Microsoft to enforce its vendor lock-in. Another hurdle to protect its market share. Good riddance to bad rubbish, I say....

[newmint]

Thank you Pjotr.

Yes, I agree that it mostly MS.
But I also heard that theoretically it is also may protect against root kits.
Not sure if that is true or not as it seems there are conflicting opinions on this.

So yes, i gust thought... if I can make it work with secure boot... then i do not really care if that is true or not
well, not so much for Linux but because I still will have windows on it for a bit longer...

so at the moment it more or less experiment if i can make it work with enabled secure boot or not.

Thank you and all for help.

[Pjotr]

But I also heard that theoretically it is also may protect against root kits.
Not sure if that is true or not as it seems there are conflicting opinions on this.

You might find this article interesting, that I've written about security in Linux Mint:
https://easylinuxtipsproject.blogspot.c ... urity.html

[SMG]

So yes, i gust thought... if I can make it work with secure boot... then i do not really care if that is true or not
well, not so much for Linux but because I still will have windows on it for a bit longer...

so at the moment it more or less experiment if i can make it work with enabled secure boot or not.

If you want it to work with Secure Boot on, then install Mint with Secure Boot on and then install the driver with Secure Boot on. I do not know how your computer handles MOK, but you will need to sign the keys to have the third-party Broadcom software installed. Then any time you change either the Broadcom driver version or the kernel version (such as through an update to the next patch release) then you will need to create a new set of MOK so the Broadcom driver will be trusted and load during the boot cycle.

Here is information on Secure Boot and MOK Ubuntu wiki: SecureBoot.

Normally we see this issue on this forum with regards to Nvidia drivers which are also third-party drivers. That is the specific driver in this thread What exactly is MOK in Linux for?, but the concept is the same.

[newmint]

Thank you SMG.
I will check read and see if i can make it work.

[newmint]

Thank you Pjotr, i will read it as yes, i would like to get a bit better idea on security .

[newmint]

Hi all,
Just quick update for anyone who is interested...

After a few attempts I think figured it out how to make it work with "secure boot" enabled... of course with the assistance from all of you and thank you all again.

Having said that, I understand that now it turning into security question... Do i bother with secure boot or just disable it?
I am not sure what is the best practice to continue this post because it is connected or perhaps ask for opinions in a new topic?

In short I understand that for Linux secure boot does not add anything except of extra complexity for updates, etc... but I am still keeping Windows and will be using it for some tasks. Therefore secure boot potentially provides better security for Windows.

Anyway, I appreciate pointers on both questions
- keep this topic to continue here...
and/or
- is good idea to keep secure boot while using Windows?

Thank you all a lot!

[Pjotr]

- is good idea to keep secure boot while using Windows?

No, not even for Windows.