Debian Linux on a HP 250 G7

After several years the time has come to replace our aging Thinkpad Edge330. Our choice was a HP 250 G7 with Core i7, 512GB SSD and 16GB RAM. Regarding the OS, there was no question: Debian. At the time of installing it was Debian 10 (“buster”). Below some points regarding the installation:

  1. Installation worked out of the box, even with SecucreBoot enabled, no problems with the netinst image, with two exceptions:
    • Wireless LAN is not working (Realtek RTL8821CE)
    • Brightness control keys are not working
  2. There is a solution for the wireless driver, works as described on several forums:
    • install the tools:
      apt-get install git dkms build-essential
    • get the source:
      git clone https://github.com/tomaspinho/rtl8821ce
    • build the kernel module:
      cd rtl8821ce
      chmod +x dkms-install.sh
      chmod +x dkms-remove.sh
      ./dkms-install.sh
  3. To keep using SecureBoot the driver must be signed as described on https://wiki.debian.org/SecureBoot. Otherwise you get the following error message:
    Apr 24 22:58:55 hp250 kernel: [ 3762.662396] Lockdown: Loading of unsigned modules is restricted; see https://wiki.debian.org/SecureBoot
    You can disable SecureBoot so it will work with the following warning in the kernel log:
    Apr 25 13:22:40 hp250 kernel: [ 3.402154] 8821ce: loading out-of-tree module taints kernel.
    Apr 25 13:22:40 hp250 kernel: [ 3.402917] 8821ce: module verification failed: signature and/or required key missing - tainting kernel

    I suggest to sign the driver, it can be done quickly based on the instructions in the Debian Wiki.
  4. Brightness control works via power settings, or via the battery icon, for the keys I’m looking for a solution. In the kernel log I see these error messages:

Some further notes:
$lspci
00:00.0 Host bridge: Intel Corporation Device 3e34 (rev 0c)
00:02.0 VGA compatible controller: Intel Corporation UHD Graphics 620 (Whiskey Lake) (rev 02)
00:04.0 Signal processing controller: Intel Corporation Skylake Processor Thermal Subsystem (rev 0c)
00:08.0 System peripheral: Intel Corporation Skylake Gaussian Mixture Model
00:12.0 Signal processing controller: Intel Corporation Cannon Point-LP Thermal Controller (rev 30)
00:14.0 USB controller: Intel Corporation Cannon Point-LP USB 3.1 xHCI Controller (rev 30)
00:14.2 RAM memory: Intel Corporation Cannon Point-LP Shared SRAM (rev 30)
00:16.0 Communication controller: Intel Corporation Cannon Point-LP MEI Controller (rev 30)
00:17.0 RAID bus controller: Intel Corporation 82801 Mobile SATA Controller [RAID mode] (rev 30)
00:1d.0 PCI bridge: Intel Corporation Cannon Point-LP PCI Express Root Port (rev f0)
00:1d.1 PCI bridge: Intel Corporation Device 9db1 (rev f0)
00:1d.4 PCI bridge: Intel Corporation Device 9db4 (rev f0)
00:1f.0 ISA bridge: Intel Corporation Cannon Point-LP LPC Controller (rev 30)
00:1f.3 Audio device: Intel Corporation Cannon Point-LP High Definition Audio Controller (rev 30)
00:1f.4 SMBus: Intel Corporation Cannon Point-LP SMBus Controller (rev 30)
00:1f.5 Serial bus controller [0c80]: Intel Corporation Cannon Point-LP SPI Controller (rev 30)
01:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 15)
02:00.0 Network controller: Realtek Semiconductor Co., Ltd. RTL8821CE 802.11ac PCIe Wireless Network Adapter
03:00.0 Non-Volatile memory controller: Sandisk Corp WD Black 2018/PC SN520 NVMe SSD (rev 01)