Help with mokutil

genichiro · 2026-07-15 12:32:55

Hi could anyone assist me with mokutil please not sure if I have somehow messed something up on my system, when I tried to install the module I realised dkms was not installed so had to do a manual install via pacman have I messed something up when I originally installed arch via rufus

Trying to add a kernel module

mokutil --sb-state
SecureBoot disabled (even though my bios asus b450 tells me it is enabled)

sudo dkms status
xxxx/0.1, 7.1.3-arch1-3, x86_64: installed

mokutil --test-key /var/lib/dkms/mok.pub
Failed to access kernel trusted keyring: Required key not available
/var/lib/dkms/mok.pub is already in the enrollment request

If I reboot I do not get the mok management screen

I have tried resetting the password but no matter what it never brings up the mok blue screen after resetting

Last edited by genichiro (2026-07-15 17:08:24)

seth · 2026-07-15 13:35:51

What module, why do you need dkms for mokutil, how do you install anything that depends on dkms but has it not listed as dependency? What is "xxxx"?

Assuming you're trying to use secureboot, have you read and followed https://wiki.archlinux.org/title/Unifie … ecure_Boot ?

seth · 2026-07-15 14:35:01

So pulling the generics out of your DM you're trying to sign an OOT module but

SecureBoot disabled (even though my bios asus b450 tells me it is enabled)

that's not required under the premise of SB being disabled.
Can you not

sudo modprobe cpuid… # use the entire module name
lsmod | grep cpuid # just that to deal w/ dash/underscore ambiguities

?

Otherwise (if you truly need to sign OOT modules) afaiu this will still require you to build the kernel yourself, https://wiki.archlinux.org/title/Signed_kernel_modules

genichiro · 2026-07-15 14:43:51

sudo modprobe 'xxx'

modprobe: ERROR: could not insert 'xxxx': No such device

Are you referring to this section?

Native DKMS method

DKMS natively supports signing built modules, as long as your kernel headers include the sign-file program in the scripts directory (most archkernel based PKGBUILDs, including the official ones).

You then need to let it know where your signing key and x509 certificate (on a regular Kernel build, these will be in certs/signing_key.pem and certs/signing_key.x509) are in /etc/dkms/framework.conf:

/etc/dkms/framework.conf

# $kernel_source_dir resolves to /lib/modules/`uname -r`/build
mok_signing_key=$kernel_source_dir/certs/signing_key.pem
mok_certificate=$kernel_source_dir/certs/signing_key.x509

In this example, it'll look into the per-kernel certs directory, so either put your signing key/cert there, or if you're using a custom PKGBUILD, just install it from the kernel:

PKGBUILD

_package-headers() {
# ...

# copy signing keys for dkms
install -Dt "$builddir/certs" -m 400 certs/signing_key.*
}

seth · 2026-07-15 15:00:04

modprobe: ERROR: could not insert 'xxxx': No such device

Sounds like unsigned modules cannot be loaded, what makes you think secureboot is disabled despite the BIOS saying otherwise?

sudo journalctl -b | grep -i secure

I assume you do not intend to just disable secureboot?
The quoted part of the wiki is relevant but your main problem is that you don't have and cannot get certs/signing_key.pem and certs/signing_key.x509 unless you're building the kernel yourself.

genichiro · 2026-07-15 15:08:23

bootctl

System:
      Firmware: UEFI 2.70 (American Megatrends 5.17)
 Firmware Arch: x64
   Secure Boot: disabled
  TPM2 Support: yes
  Measured UKI: no
   Measured OS: no
  Boot into FW: supported
 Platform Lang: en_US.UTF-8

bootctl tells me it is disabled

Asus bios tells me it is enabled

Jul 15 14:43:00 archlinux kernel: Secure boot disabled
Jul 15 14:43:00 archlinux kernel: amdgpu 0000:0a:00.0: SECUREDISPLAY: optional securedisplay ta ucode is not available

https://postimg.cc/dkrBnqDD

Last edited by genichiro (2026-07-15 16:35:19)

seth · 2026-07-15 15:46:24

No way to impact the setting in the firmware?
Do you lock down the kernel by other means?
https://wiki.archlinux.org/title/Securi … kdown_mode
https://wiki.archlinux.org/title/Securi … le_loading

About the secureboot situation:
Are you dual-booting windows?
Are you doing any of https://wiki.archlinux.org/title/Unifie … ecure_Boot (so far, before attempting to load an OOT module at all)?

Loading OOT modules is an absolute non-issue on unlocked kernels w/o secureboot and most likely what the majority of cases you're citing reflect.

Also please avoid handling this via DMs, loading OOT modules is a perfectly valid topic - regardless of what they do.
Speaking of which: can you build and load https://archlinux.org/packages/extra/an … call-dkms/ (just for comparism to rule out any problems w/ the critical module)

genichiro · 2026-07-15 16:15:52

Hi no I am not dual booting nor doing any of the other stuff linked

:: Proceed with installation? [Y/n] 
:: Retrieving packages...
 acpi_call-dkms-1.2.2-3-any                                               12.3 KiB   217 KiB/s 00:00 [############################################################] 100%
(1/1) checking keys in keyring                                                                       [############################################################] 100%
(1/1) checking package integrity                                                                     [############################################################] 100%
(1/1) loading package files                                                                          [############################################################] 100%
(1/1) checking for file conflicts                                                                    [############################################################] 100%
(1/1) checking available disk space                                                                  [############################################################] 100%
:: Processing package changes...
(1/1) installing acpi_call-dkms                                                                      [############################################################] 100%
:: Running post-transaction hooks...
(1/3) Arming ConditionNeedsUpdate...
(2/3) Install DKMS modules
==> dkms install --no-depmod acpi_call/1.2.2 -k 7.1.3-arch1-3
Deprecated feature: CLEAN (/usr/src/acpi_call-1.2.2/dkms.conf)
==> depmod 7.1.3-arch1-3
(3/3) Updating linux initcpios...
==> Building image from preset: /etc/mkinitcpio.d/linux.preset: 'default'
==> Using default configuration file: '/etc/mkinitcpio.conf'
  -> -k /boot/vmlinuz-linux -g /boot/initramfs-linux.img
==> Starting build: '7.1.3-arch1-3'
  -> Running build hook: [base]
  -> Running build hook: [udev]
  -> Running build hook: [autodetect]
  -> Running build hook: [microcode]
  -> Running build hook: [modconf]
  -> Running build hook: [kms]
  -> Running build hook: [keyboard]
  -> Running build hook: [keymap]
  -> Running build hook: [consolefont]
==> WARNING: consolefont: no font found in configuration
  -> Running build hook: [block]
  -> Running build hook: [filesystems]
  -> Running build hook: [fsck]
==> Generating module dependencies
==> Creating zstd-compressed initcpio image: '/boot/initramfs-linux.img'
  -> Early uncompressed CPIO image generation successful
==> Initcpio image generation successful
[gary@archlinux ~]$ dkms status
acpi_call/1.2.2, 7.1.3-arch1-3, x86_64: installed

Last edited by genichiro (2026-07-15 16:34:26)

WorMzy · 2026-07-15 16:18:20

Please use code tags for terminal output.

https://wiki.archlinux.org/title/Genera … s_and_code

genichiro · 2026-07-15 16:29:27

ignore

Last edited by genichiro (2026-07-15 16:32:55)

genichiro · 2026-07-15 16:32:15

[root@archlinux ~]# cd /root
[root@archlinux ~]# mkdir module-signing
[root@archlinux ~]# touch dkms-sign-module
[root@archlinux ~]# nano dkms-sign-module 
[root@archlinux ~]# touch one-time-setup
[root@archlinux ~]# nano one-time-setup 
[root@archlinux ~]# touch sign-modules
[root@archlinux ~]# nano sign-modules
[root@archlinux ~]# chmod u+x one-time-setup
[root@archlinux ~]# chmod u+x dkms-sign-module 
[root@archlinux ~]# chmod u+x sign-modules 
[root@archlinux ~]# ls
dkms-sign-module  module-signing  one-time-setup  sign-modules
[root@archlinux ~]# ./one-time-setup
I am about to generate the Machine Owner Key (MOK).
The passphrase you enter for this key will be required every time you want to sign a module.
Please press Return to go on...
./one-time-setup: line 8: hostname: command not found
.+......+.........+....+++++++++++++++++++++++++++++++++++++++*....+...+...+.....+.........+...+...............+...+....+++++++++++++++++++++++++++++++++++++++*....+...........++++++
.+.+...+...........+.+.....+++++++++++++++++++++++++++++++++++++++*......+.+........+......+++++++++++++++++++++++++++++++++++++++*.+............+...........................+..+.+..+..........+..+....++++++
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----

Now I will import the generated key into the secure keystore.
The passphrase you will enter is only required once, during the following reboot.
Please press Return to go on...

Did not get the mok management blue screen on reboot

[root@archlinux module-signing]# ls
dkms-sign-module  MOK.der  MOK.priv  one-time-setup  sign-modules

Last edited by genichiro (2026-07-15 16:45:11)

seth · 2026-07-15 19:42:00

We've still not figured whether you're using any kind of secureboot (notably since https://wiki.archlinux.org/title/Unifie … ecure_Boot seems news to you) or what else is preventing the module from being loaded.

modprobe -v acpi_call # the idea was to try to load it and please use -v
cat /sys/kernel/security/lsm
cat /proc/cmdline

genichiro · 2026-07-15 21:24:25

Hi sorry

modprobe -v acpi_call - no output

cat /sys/kernel/security/lsm
capability,landlock,lockdown,yama,bpf

cat /proc/cmdline
initrd=\initramfs-linux.img root=PARTUUID=f4a8825a-dff4-44f8-b14d-6c9e15998a8e zswap.enabled=0 rootflags=subvol=@ rw rootfstype=btrfs clearcpuid=umip

seth · 2026-07-15 21:38:44

lsmod | grep acpi

If that loads the failure to load the other module might be very much related to that module - try to remove "clearcpuid=umip"

genichiro · 2026-07-15 21:41:04

lsmod | grep acpi
snd_intel_sdw_acpi     16384  1 snd_intel_dspcfg
acpi_call              20480  0

seth · 2026-07-15 21:51:15

You've no general issues loading unsigned OOT modules…

seth wrote:

try to remove "clearcpuid=umip"

Also

lscpu | grep -oiE '[^ ]*cpuid[^ ]*'

genichiro · 2026-07-15 21:55:43

lscpu | grep -oiE '[^ ]*cpuid[^ ]*'
cpuid

cpuid in red

Last edited by genichiro (2026-07-15 21:56:51)

seth · 2026-07-15 22:04:21

It's red because https://wiki.archlinux.org/title/Color_ … nsole#grep
So the CPU has not cpuid_fault support…

lscpu
uname -a

did you remove the clearcpuid=umip flag so it no longer shows up in /proc/cmdline?

genichiro · 2026-07-15 22:18:52

You know what ive had half an eye on cachyos for a while been using stock arch for a good while now (about 7 years lol) might just throw in the towel and do a fresh install, I only use the rig for gaming anyway

Who knows I might hate it and be back next week

Really appreciate you taking the time to help me, this is the second time you have helped me (I had a btfrs) issue a couple of years ago you really are a credit to this forum

seth · 2026-07-16 05:26:31

Why do you think this will be any different?
You *can* load out of tree modules fine, the entire thread is an https://en.wikipedia.org/wiki/XY_problem

The problem seems with the particular module you're trying to load, the CPU details, kernel version (AMD chips only gained software cpuid_fault support w/ some 6.17 kernel) and certainly the kernel parameter that's there for some unclear reason will be more relevant here.

Arch Linux

#1 2026-07-15 12:32:55

Help with mokutil

#2 2026-07-15 13:35:51

Re: Help with mokutil

#3 2026-07-15 14:35:01

Re: Help with mokutil

#4 2026-07-15 14:43:51

Re: Help with mokutil

#5 2026-07-15 15:00:04

Re: Help with mokutil

#6 2026-07-15 15:08:23

Re: Help with mokutil

#7 2026-07-15 15:46:24

Re: Help with mokutil

#8 2026-07-15 16:15:52

Re: Help with mokutil

#9 2026-07-15 16:18:20

Re: Help with mokutil

#10 2026-07-15 16:29:27

Re: Help with mokutil

#11 2026-07-15 16:32:15

Re: Help with mokutil

#12 2026-07-15 19:42:00

Re: Help with mokutil

#13 2026-07-15 21:24:25

Re: Help with mokutil

#14 2026-07-15 21:38:44

Re: Help with mokutil

#15 2026-07-15 21:41:04

Re: Help with mokutil

#16 2026-07-15 21:51:15

Re: Help with mokutil

#17 2026-07-15 21:55:43

Re: Help with mokutil

#18 2026-07-15 22:04:21

Re: Help with mokutil

#19 2026-07-15 22:18:52

Re: Help with mokutil

#20 2026-07-16 05:26:31

Re: Help with mokutil

Board footer