BeardOverflow MSI_EC for Bazzite

BeardOverflow_msi_ec_for_bazzite.md

Steps I took to build https://github.com/BeardOverflow/msi-ec, sign it, and load it into Bazzite:

1. Install some tools by running sudo rpm-ostree install dkms git make gcc kernel-devel kernel-headers and reboot.

   If it complains about any of these already being provided by an existing package, then remove it from the command and run it again. Chances are most of these are already installed.

2. Clone their git repo and build the code locally by running sudo make

3. If you have secure boot disabled in your bios, you should be able to just unload the built-in module and load this newly built one. This is the easy route. If this works, your MControlCentre should no longer grey out its controls and some of them should work.

   sudo modprobe -r msi_ec 2>/dev/null
sudo insmod ./msi-ec.ko

   Just bear in mind, once you restart your machine, the kernel's built-in module will be loaded in again. Skip ahead to step 9 for automation.

   You can confirm if secure boot is enabled by running mokutil --sb-state, but it also won't let you install the new module because it's not signed.

4. If secure boot is enabled and you plan to keep it that way, you will need to sign the module, which requires generating a MOK file (basically just a "certificate") and installing it into Bazzite, then using it to sign your new msi_ec module before you can install it.

5. To a create a certificate, you need some more tools.

   Run sudo rpm-ostree install mokutil openssl kmod and reboot

   Then make a folder to keep the new key files
   sudo mkdir -p /var/lib/module-signing
cd /var/lib/module-signing

   Then generate the key files
   sudo openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -out MOK.pem -nodes -days 3650 -subj "/CN=PUT YOUR NAME HERE/"
sudo openssl x509 -in MOK.pem -outform DER -out MOK.der

READ this before you blindly continue

In the following steps you wll need to reboot, but you might end up like I did 
at a black screen with an error and unable to boot into Bazzite. Turning off 
secure boot won't save you. You're going to enroll the key in the next step 
and reboot. When you reboot normally you may end up at a black screen that 
says something about "failed to open \EFI\BOOT\mmx64.efi - not found" and 
"some image was not found", and "failed to start MokManager", and it will also
say "something went seriously wrong". You will not be unable to boot into 
Bazzite until you've loaded the new key.

You are supposed to boot into the EFI boot menu (NOT your regular bios boot 
menu and not the grub menu). Maybe reboot now and find what you're looking 
for before you continue any further. For me, I had to press F11 while booting.
This brought me a small bios-looking selection menu with two options - 
"Bazzite" and "Fedora". Choosing Bazzite would take me back to the error 
screen. Choosing Fedora would show a blue screen which was titled 
"Mok Manager" with options to enroll the new key. This might look familiar. 
It's the same Mok Manager you may have seen the first time you started up 
Bazzite. This is the screen you're looking for. 

Go find it, make sure you know how to get there, and then come back here. 

Don't blame me if you can't find your MokManager and you get stuck unable to 
boot back into Bazzite. If you get stuck, you may need a live USB to fix it, 
and a way to google(or chatgpt) yourself out of that situation.

6. Enroll the key
   sudo mokutil --import /var/lib/module-signing/MOK.der

   This will ask you for a password. Make sure you can remember it, because you will need it shortly.

   Now reboot to the EFI boot menu, choose Fedora or whatever option gets you to the MokManager. Once in the Mok Manager, choose Enroll MOK, Continue, enter your password, and reboot again.

7. Sign the module you built with the new key
   KVER="$(uname -r)"
SIGN="/usr/src/kernels/${KVER}/scripts/sign-file"
sudo "$SIGN" sha256 /var/lib/module-signing/MOK.priv /var/lib/module-signing/MOK.pem ./msi-ec.ko

8. Now you can try loading the signed module as follows
   sudo modprobe -r msi_ec 2>/dev/null
sudo insmod ./msi-ec.ko

   Check the dmesg logs to confirm it worked
   dmesg -T | grep -i msi_ec | tail -n 30

   You want to see something in the logs like "msi_ec: module exit" and "msi_ec: module init". This should mean your MControlCentre should be working now, start it up and see.

   You can now also check if you have an msi-ec platform folder:

   ls -la /sys/devices/platform/msi-ec/
   It should list things like 'cooler_boost' or 'fan_mode' or 'shift_mode'.

9. Automation.

   You want to put your new module somehwere persistent
   sudo mkdir -p /var/lib/msi-ec
sudo cp ./msi-ec.ko /var/lib/msi-ec/msi-ec.ko

   And give it the appopriate permissions
   sudo chmod 0644 /var/lib/msi-ec/msi-ec.ko

   Stop the built-in msi_ec from loading
   echo "blacklist msi_ec" | sudo tee /etc/modprobe.d/blacklist-msi-ec.conf

   Create a service to load your custom module on startup:

   sudo tee /etc/systemd/system/msi-ec-oot.service >/dev/null <<'EOF'
   [Unit]
   Description=Load out-of-tree signed msi-ec module
   Wants=local-fs.target
   After=local-fs.target systemd-modules-load.service
   ConditionPathExists=/var/lib/msi-ec/msi-ec.ko
   
   [Service]
   Type=oneshot
   ExecStart=/usr/sbin/insmod /var/lib/msi-ec/msi-ec.ko
   RemainAfterExit=yes
   
   [Install]
   WantedBy=multi-user.target
   EOF
   

   Then:
   sudo systemctl daemon-reload
sudo systemctl enable msi-ec-oot.service
sudo systemctl restart msi-ec-oot.service

   Check for error messages with:
   journalctl msi-ec-oot.service

   If you see permission denied errors in the journal after rebooting and the module didn't load, but you are able to load it manually using insmod then SELinux might be stopping you because the module isn't labelled or tagged correctly as a module and so it doesn't trust it.

   Install one more thing (might already be installed), sudo rpm-ostree install policycoreutils-python-utils and reboot.

   Then
   sudo semanage fcontext -a -t modules_object_t "/var/lib/msi-ec(/.*)?"
sudo restorecon -Rv /var/lib/msi-ec

   Restart the service again and it should work