Install driver for Intel 9560 wireless on Ubuntu 18.04

5 years ago

ThinkPad X1 carbon 7th Gen notebook uses an Intel 9560 wireless card, which not work in Ubuntu 18.04 by default. I made a simple tutorial to show you how to fix it.

Contents

Install the driver

We need to compile a kernel module and firmware for it:


sudo apt update
sudo apt install git build-essential
git clone https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/backport-iwlwifi.git
cd backport-iwlwifi/
make defconfig-iwlwifi-public
sed -i 's/CPTCFG_IWLMVM_VENDOR_CMDS=y/# CPTCFG_IWLMVM_VENDOR_CMDS is not set/' .config
make -j$(nproc)
sudo make install
sudo modprobe iwlwifi

If you DISABLED the secure boot, it would work after a reboot. But for a secure boot enabled environment, you have to sign your driver.

Sign your driver

The iwlwifi module will not be able to load due to secure boot automatically.


modprobe: ERROR: could not insert 'iwlwifi': Operation not permitted

We have to self-sign the driver.

At first, we need a self-signed keychain:


name="Kernel Modules Signing"
out_dir='/root/module-signing'
sudo mkdir ${out_dir}
sudo openssl \
req \
-new \
-x509 \
-newkey \
rsa:2048 \
-keyout ${out_dir}/MOK.priv \
-outform DER \
-out ${out_dir}/MOK.der \
-days 36500 \
-subj "/CN=${name}/"
sudo chmod 600 ${out_dir}/MOK*

We can sign the driver after enrolling the MOK. In this time, you will be asked to type in a password for enrolling the key.


sudo mokutil --import /root/module-signing/MOK.der

It will enter the MOK manager EFI utility after reboot. You can add the new key by following steps.

Select Enroll MOK.

Select Continue.

Select Yes to enroll the keys.

Enter the password from earlier.

Select OK to reboot.

Verify the key has been loaded by finding it in the output of

dmesg | grep '[U]EFI.*cert'

The final step is to sign the modules: iwlwifi, iwlmvm, compat, cfg80211, mac80211


cd /root/module-signing/

sudo /usr/src/linux-headers-$(uname -r)-generic/scripts/sign-file sha512 ./MOK.priv ./MOK.der $(modinfo -n iwlwifi)
sudo /usr/src/linux-headers-$(uname -r)-generic/scripts/sign-file sha512 ./MOK.priv ./MOK.der $(modinfo -n iwlmvm)
sudo /usr/src/linux-headers-$(uname -r)-generic/scripts/sign-file sha512 ./MOK.priv ./MOK.der $(modinfo -n compat)
sudo /usr/src/linux-headers-$(uname -r)-generic/scripts/sign-file sha512 ./MOK.priv ./MOK.der $(modinfo -n cfg80211)
sudo /usr/src/linux-headers-$(uname -r)-generic/scripts/sign-file sha512 ./MOK.priv ./MOK.der $(modinfo -n mac80211)