From 1a654d52d6c90ffa5958f0898d058de323696dc0 Mon Sep 17 00:00:00 2001
From: ps1x <ps1x@users.noreply.github.com>
Date: Mon, 3 Aug 2026 19:51:27 +0300
Subject: [PATCH] Harden OXP startup under Secure Boot

---
 README.md               | 15 +++++++++++++++
 install.sh              |  5 ++++-
 oxp-fan-control.service |  4 +++-
 oxp-sensors.conf        |  1 -
 4 files changed, 22 insertions(+), 3 deletions(-)
 delete mode 100644 oxp-sensors.conf

diff --git a/README.md b/README.md
index 848747e..b06c0d0 100644
--- a/README.md
+++ b/README.md
@@ -90,6 +90,21 @@ To install through DKMS:
 make dkms
 ```
 
+### Secure Boot
+
+DKMS signs `oxp-sensors`, but Secure Boot will reject it until the DKMS Machine
+Owner Key is enrolled. On Fedora, check the key after `make dkms` with:
+
+```shell
+sudo mokutil --test-key /var/lib/dkms/mok.pub
+```
+
+If it is not enrolled, queue it with `sudo mokutil --import
+/var/lib/dkms/mok.pub`, reboot, and choose **Enroll MOK** in the firmware screen.
+The one-time password entered at the `mokutil` prompt is required there. The OXP
+services limit their retries if the key is missing, so this condition does not
+create a boot-time restart storm.
+
 ## Install On Linux
 
 Install the client tools, fan-control service, and GNOME extension:
diff --git a/install.sh b/install.sh
index 852b55c..572b8bc 100755
--- a/install.sh
+++ b/install.sh
@@ -25,7 +25,10 @@ sudo install -Dm644 "$REPO_DIR/oxp-fan-control.service" /etc/systemd/system/oxp-
 sudo install -Dm644 "$REPO_DIR/contrib/power/oxp-turbo-tdp.service" /etc/systemd/system/oxp-turbo-tdp.service
 sudo install -Dm644 "$REPO_DIR/contrib/power/oxp-idle-power.service" /etc/systemd/system/oxp-idle-power.service
 sudo install -Dm755 "$REPO_DIR/contrib/power/oxp-idle-power-resume" /usr/lib/systemd/system-sleep/oxp-idle-power
-sudo install -Dm644 "$REPO_DIR/oxp-sensors.conf" /etc/modules-load.d/oxp-sensors.conf
+# The fan and Turbo services load oxp-sensors themselves.  Keeping it in
+# modules-load makes a Secure Boot signature problem fail the global
+# systemd-modules-load service during boot.
+sudo rm -f /etc/modules-load.d/oxp-sensors.conf
 sudo install -Dm644 "$REPO_DIR/oxp-fan-profile.rules" /etc/polkit-1/rules.d/49-oxp-fan-profile.rules
 sudo install -Dm644 "$REPO_DIR/oxp-rgb-hid.rules" /etc/udev/rules.d/99-oxp-rgb-hid.rules
 sudo install -Dm644 "$REPO_DIR/contrib/power/80-oxp-disable-fingerprint.rules" /etc/udev/rules.d/80-oxp-disable-fingerprint.rules
diff --git a/oxp-fan-control.service b/oxp-fan-control.service
index 1b80484..cb0a03c 100644
--- a/oxp-fan-control.service
+++ b/oxp-fan-control.service
@@ -2,13 +2,15 @@
 Description=OXP SuperX Fan Control Daemon
 After=systemd-modules-load.service
 Wants=systemd-modules-load.service
+StartLimitIntervalSec=60
+StartLimitBurst=3
 
 [Service]
 Type=simple
 ExecStartPre=/usr/sbin/modprobe oxp-sensors
 ExecStartPre=/bin/sh -c 'for i in $(seq 1 20); do for d in /sys/class/hwmon/hwmon*; do [ -r "$d/name" ] || continue; [ "$(cat "$d/name")" = "oxpec" ] && exit 0; done; sleep 0.5; done; echo "oxpec hwmon device not found after loading oxp-sensors" >&2; exit 1'
 ExecStart=/usr/local/bin/oxp-fan-control.py
-Restart=always
+Restart=on-failure
 RestartSec=5
 
 [Install]
diff --git a/oxp-sensors.conf b/oxp-sensors.conf
deleted file mode 100644
index 36acd28..0000000
--- a/oxp-sensors.conf
+++ /dev/null
@@ -1 +0,0 @@
-oxp-sensors