Secure Boot and Demise Microsoft CA 2011

[alee]

OK. For my Win11 system (which I have also been trying to make Secure Boot — and which I am using here to communicate), I found the video card wasn’t kosher; I purchased another (which works), but the outputs were incompatible with my existing KVM. I’ve reverted to the previous Win11 video card, so now I can see information on one screen while responding in the other. As explained, my Linux machine (with the old card re-inserted) is not recognising my local network, so I cannot communicate with the internet (I am currently on the Win11 system). Furthermore, I am now finding that if I copy something to a thumb drive on the Linux system, where it appears to save correctly, on transferring the thumb drive to the Win11 system, that file (although claiming to have the correct size) appears empty in an editor. That makes passing detailed information difficult.

Is this a hint that I need additional drivers for the USB ports? This is getting totally crazy!

Now,from:
/sbin/lspci -nmk | grep -iA3 net
07:00.0 Network controller [0280]: MEDIATEK Corp. Device [14c3:7925]
Subsystem Foxcomm International, Inc Device [105b:e112]
0c:00.0 RAID bus controller [0104]: Areca Technology Corp. ARC-188x series PCIe 2.0/3.0 to SAS/SATA 6/12Gb RAID Controller [17d3:1880] (rev 05)
Subsystem: Areca …(and more Areca stuff) …

Sauerland noted “No network controller, only wlan…”.

In principle, I have an (old) comms card physically connected to my network, and an RJ-45 port as part of the Gigabyte MB — which also seemed not to connect correctly to the network (after removing the old comms card, and plugging the network cable into that RJ-45 port.

So, I do not understand the comment “No network controller, only wlan…”. Is this a suggestion I am missing drivers? Under Wicked, I was able to see network card hardware, and to set static addresses such as 192.168.0.3 for the active Linux network card. Now, I seem to be unable to see addresses, and the number of “cards” seems to be unchanged when I remove the comms card. I feel totally at sea here, and need specific advice.

The earlier : “Wlan not available in Leap 15.6:
opensuse156:/home/stephan # modinfo mt7925e
modinfo: ERROR: Module mt7925e not found.
opensuse156:/home/stephan #
mt7925e s the driver for Wlan.”

Was not clear to me. The first part appeared to say a Wlan is not designed to be available in opensuse156 — despite the fact that I have been using a local network (with router for internet access) for a long time. The last part seemed to be a suggestion that mt7925e is an appropriate and necessary driver for Wlan. Which is correct? And driver for what (ie what supplier?). For my old comms card? For the RJ-45 as part of my Gigabyte MB? As a necessary component of opensuse15.6 (which I would have assumed would be part of the kernel).

Earlier, I said:
Googling “realtek r8169 linux driver” produces: “The r8169 is the open-source, in-kernel Linux driver for RealTek Gigabyte Ethernet Chips … it is included by default in the Linux kernel”.

Is that the driver (to be obtained from Gigabyte?) that I should be using? Please be specific, as I seem to be getting inconsistency.

Back in my initial opening of this topic, I asked
" To date I have not been using Secure Boot. Should I continue to try (so far, abysmal failure).

Are OpenSuSE owners not expected to use Secure Boot?"

I am not at all sure I have had these questions answered. Things just worked previously! It all feels like a MicroSoft plot against Linux.

[malcolmlewis]

@alee I have multiple systems, some run secure boot, some don’t, they all have cards that use the 8169 modules…

System:
  Kernel: 6.12.0-160000.35-default arch: x86_64 bits: 64 compiler: gcc v: 13.4.0 clocksource: tsc
    avail: acpi_pm parameters: BOOT_IMAGE=/boot/vmlinuz-6.12.0-160000.35-default
    root=UUID=0cfbf95a-5a4e-4e0e-af24-5e9ee5eb8b9a mitigations=auto quiet security=selinux
    selinux=1 intel_iommu=on rd.driver.blacklist=nouveau loglevel=2 ia32_emulation=1
    intel_pstate=passive
  Console: pty pts/0 DM: GDM v: 48.0 Distro: openSUSE Leap 16.0
Network:
  Device-1: Intel Ethernet I219-LM vendor: Dell driver: e1000e v: kernel port: N/A bus-ID: 00:1f.6
    chip-ID: 8086:15bb class-ID: 0200
  IF: em1 state: up speed: 1000 Mbps duplex: full mac: <filter>
  Device-2: Realtek RTL8821CE 802.11ac PCIe Wireless Network Adapter vendor: AzureWave
    driver: rtw_8821ce v: N/A modules: rtw88_8821ce pcie: gen: 1 speed: 2.5 GT/s lanes: 1 port: 4000
    bus-ID: 03:00.0 chip-ID: 10ec:c821 class-ID: 0280
  IF: wlp3s0 state: down mac: <filter>
  Device-3: Realtek RTL8126 5GbE driver: r8169 v: kernel pcie: gen: 3 speed: 8 GT/s lanes: 1
    port: 3000 bus-ID: 04:00.0 chip-ID: 10ec:8126 class-ID: 0200
  IF: p1p1 state: up speed: 1000 Mbps duplex: full mac: <filter>
  Info: services: NetworkManager, sshd, wpa_supplicant

[alee]

Apologies if I sound stupid, but is r8169 to be obtained from Gigabyte or some Linux source? My earlier quote stated this was included by default in the Linux kernel. Can I input this using a thumb drive (assuming I can get it to work OK).

[malcolmlewis]

@alee is in the default kernel, so no action necessary. Make sure kernel-firmware-realtek package is installed.

[alee]

Does this imply a “repair” using the installation DVD, and selecting a package? Again, apologies for stupidity.

[Sauerland]

Try as root:
modprobe r8169

post it here completely

[malcolmlewis]

@alee is should be available at install. Sure the onboard ethernet card is enabled in the BIOS?

[alee]

As root: modprobe r8169 gave no output. I’ll look for the ethernet card in the BIOS. Perhaps my kek is unhappy?

[Sauerland]

When enabled in Bios/UEFi, hardware should shown in Linux,

It depends not on secure boot.

secure boot is only to load or disable the load of the kernel module (driver).

[alee]

Went through BIOS. Bits that appear relevant:
PCIE
PCIEX16: PCIe 4.0 x8 @ 4.0 x8
PCIEX4 PCIe 2.0 x8 @ 2.0 x4
The comms card is on a small PCI card.

Probably more relevant:
Onboard LAN Controller: Was DISABLED, now ENABLED.
NETWORK STACK CONFIGURATION:
was DISABLED, now ENABLED.

On boot-up: Couple messages: Problem loading X.509 (been there for some time).

Tried root: modprobe r8169 zero response.
ping 192.168.0.1 Network unavailable.

[Sauerland]

@Sauerland

inxi -Naz

Why do not posting ?

[alee]

I’ve been trying to copy data onto a thumb drive in Linux. and then transfer physically to Win11. Problem: Win11 is refusing to see the content.

On inxi -Naz
Network:
Device-1: Realtek RTL8125 2.5GbE vendor: Gigabyte driver: N/A modules: r8169
pcie: gen:2 speed 5GT/s lanes:1 poert: d000 bus_D 07:00.00
chip-ID: 10ec8125 class-ID 0200

Device-2: MEDIATEK vendor:Foxconn driver: N/A pcie:gen: 2 speed 5 GT/s
lanes: 1 port N/A bus-ID 08:00.0 chip-ID 14c37925 class-ID: 0280

Does now mention r8169. Guess that’s progress.

[malcolmlewis]

@alee So if no errors from the modprobe command, all is good;

Based on your PCI ID “10ec:8125”;

/sbin/modinfo r8169 | grep 8125

firmware:       rtl_nic/rtl8125bp-2.fw
firmware:       rtl_nic/rtl8125d-2.fw
firmware:       rtl_nic/rtl8125d-1.fw
firmware:       rtl_nic/rtl8125b-2.fw
firmware:       rtl_nic/rtl8125a-3.fw
alias:          pci:v000010ECd00008125sv*sd*bc*sc*i*

ls /lib/firmware/rtl_nic/rtl8125*

/lib/firmware/rtl_nic/rtl8125a-3.fw.xz  /lib/firmware/rtl_nic/rtl8125b-2.fw.xz   /lib/firmware/rtl_nic/rtl8125d-1.fw.xz
/lib/firmware/rtl_nic/rtl8125b-1.fw.xz  /lib/firmware/rtl_nic/rtl8125bp-2.fw.xz  /lib/firmware/rtl_nic/rtl8125d-2.fw.xz

[malcolmlewis]

Likewise, you haven’t accidentally blacklisted the device?

[Sauerland]

Post:

rpm -qa r8168*

[malcolmlewis]

Also, if you gab the openSUSE Tumbleweed Rescue USB, use dd to write to a device. Enable secure boot in your BIOS, boot from that and you may be able to use the mokutil tool to fix…

[alee]

Editing previous version:

[quote=“alee, post:3, topic:194525”]
HSI-1
BIOS firmware updates: Enabled
Fused platform: Locked
Supported CPU: Invalid
TPM v2.0: found
UEFI bootservice variables: Locked
UEFI Platform key: Valid

HSI-2
SPI write protection: Enabled
IOMMU: Enabled
Platform debugging: Locked
TPM PCR0 reconstruction: Valid

HSI-3
✘ SPI replay protection: Not supported
✘ Pre-boot DMA protection: Enabled
✘ Suspend-to-idle: Disabled
✘ Suspend-to-ram: Enabled

HSI-4
✘ Processor rollback protection: Disabled
✘ Encrypted RAM: Not supported

Runtime Suffix -!
fwupd plug-ins: Untainted
Linux kernel: Untainted
✘ Linux kernel lockdown: Disabled
✘ Linux swap: Unencrypted
✘ UEFI secure boot: Disabled (for present)

This system has HSI runtime issues:
https://fwupd.gitgub.io/hsi.html#hsi-runtime-suffix

Host Security Events
2026-06-23 15:59:22: Kernel lockdown disabled
2026-06-23 15:29:22 Secure Boot disabled
2026-06-22 15:32:46: Kernel lockdown enabled
2026-06-22 15:32:46: Secure Boot enabled
2026-06-16 17:09:23 TPM v2.0 changed: Not found → Found

[alee]

Also, if you gab the openSUSE Tumbleweed Rescue USB …

I am currently on Leap 15.6. Is this a suggestion I install Tunbleweed? As you are aware, I am sticking to 15.6 pro tem because 16.0 does not support my RAID card.

I have not yet re-imposed Secure Boot, but there may be a basic cause for my comms issues. I have set up a webcam on my Win11 system, and have tried to photo some Linux screen displays — the process is very cumbersome, slow, and does not produce images I can reliably copy text to insert here — but I can add a pdf — at the cost of more storage information.

Over many years I have used Wicked to set up network details, which identified physical hardware details and permitted me to set up static addresses confident of what hardware they related to. Current fashions are to use Network Manager, which generally does a good job of finding the internet; but I usually finish up switching to Wicked and static addresses. However, now I look at Network Settings, I see my “previous” devices eth0 and eth1 — but am suspicious because both continued to remain after I removed my “old” comms board. Furthermore, for both “devices” is a comment “No hardware information”. There appears to be no relation between these “devices” and the physical hardware. If this is the case, it would explain why my Leap 15.6 system cannot access my local network!. Furthermore, from the Network Settings information, it is not even clear to me that the system knows that my network is 192.168.0.xxx (apart from Gateway address). You will understand I do not claim expertise in Network stuff, or how this is affected by recent innovations or Secure Boot changes. I’ll try to attach my network_settings.pdf. Aghh: dosn’t permit pdf. Attaching (yet more bulky) jpg versions — sequence 1–5.

[malcolmlewis]

No, it’s a live USB device running Tumbleweed Rescue system;

wget https://download.opensuse.org/tumbleweed/iso/openSUSE-Tumbleweed-Rescue-CD-x86_64-Snapshot20260623-Media.iso{,.sha256}

For static IP addresses, you also need to hit the routing tab and add the device and gateway address.

eth0 and eth1 are the old “comms/network card”?

Show the output from ip a and ip r

[alee]

eth0 and eth1 are the old “comms/network card”?

Before all this disaster, I had two ethernet “cards”. One was the Gigabyte built-in RJ-45 outlet port, which I wasn’t using. The other was my “old” PCIe “comms card”, which was actually slower (although fine for me), used because my purchased IDL language license was locked to the MAC address of that card. On my sojourn from Leap 15.6 to 16.0 and back, I lost the FlexLM licensing code (although not the license), so have lost IDL — just the back-story! The essential point is that I was able to relate addresses to hardware.

… you also need to hit the routing tab and add the device and gateway address.

From my SecBoot-5 jpg, you will see I have already put in the gateway address. Are you suggesting I also put in my (previous) addresses and ethx values for these two “comms cards” — leaving the “Gateway” tab blank?

Show the output from ip a and ip r