[Bug 2171468] [NEW] Power button does not generate KEY_POWER on HP ZBook Power 16 G11 A (AMD GPIO0 / ACPI0011 gpio-keys)

Public bug reported: # Power button does not generate KEY_POWER on HP ZBook Power 16 G11 A (AMD GPIO0 / ACPI0011 gpio-keys) ## Summary On the HP ZBook Power 16 inch G11 A (AMD Ryzen 7 8845HS), pressing the power button while the system is running does nothing under Linux. The GPIO interrupt fires on every press/release, but the `gpio-keys` input device created by `soc_button_array` for `ACPI0011` never emits any `EV_KEY` event, so neither systemd-logind nor GNOME ever see `KEY_POWER`. The same behaviour is observed on Ubuntu 24.04, Ubuntu 26.04 and Fedora. Under Windows on the same machine the power button works normally. ## Hardware / software | Item | Value | |---|---| | Vendor / Product | HP ZBook Power 16 inch G11 A Mobile Workstation PC | | Board | 8C95 | | SKU | A25C8PC#AB2 | | CPU | AMD Ryzen 7 8845HS w/ Radeon 780M Graphics (Hawk Point) | | BIOS | HP W85 Ver. 01.11.01 (07/06/2026) | | Distro | Ubuntu 26.04.1 LTS (also reproduced on Ubuntu 24.04 and Fedora) | | Kernel | 7.0.0-38-generic #38-Ubuntu SMP PREEMPT_DYNAMIC | | systemd | 259 (259.5-0ubuntu3.4) | | Desktop | GNOME Shell 50.1, Wayland | ## ACPI topology - `\_SB_.PWRB` (PNP0C0C, standard ACPI power button): `_STA = 0` (disabled by firmware), so no "Power Button" input device is created by the ACPI button driver. There is no `LNXPWRBN` fixed power button either. - `\_SB_.BTNS` (ACPI0011, Generic Buttons Device): `_STA = 0x0B`. `soc_button_array` binds it and creates: ``` input: gpio-keys as /devices/platform/ACPI0011:00/gpio-keys.1.auto/input/input7 N: Name="gpio-keys" H: Handlers=kbd event5 B: EV=3 B: KEY=10000000000000 0 # only KEY_POWER (116) ``` - The button is wired to AMD GPIO pin 0 (`pinctrl_amd`, AMDI0030): ``` 50: ... amd_gpio 0 power ``` - udev tags `event5` with `power-switch`, and systemd-logind logs `Watching system buttons on /dev/input/event5 (gpio-keys)`. ## Observations 1. Every press of the power button increments IRQ 50 by exactly 2 (press + release edge). No interrupt storm; the counter is stable when idle. | Test | IRQ 50 count | EV_KEY events on /dev/input/event5 | |---|---|---| | 3 short presses | 58 -> 64 | 0 | | 2 short presses | 64 -> 68 | 0 | | 2 presses held ~1 s | 68 -> 72 | 0 | Events were read directly from `/dev/input/event5` as root (raw `struct input_event`), so this is independent of logind/GNOME. 2. `/sys/kernel/debug/gpio` for pin #0, identical before and after the presses: ``` GPIO bank0 #0 😛| b| edge| | | |⏰| | ↑ |input ↑| |0x8151c00 ``` Decoding 0x08151c00 (pinctrl-amd layout): - ACTIVE_LEVEL = both edges, LEVEL_TRIG = edge - INTERRUPT_ENABLE = 1, INTERRUPT_MASK = 1 (unmasked) - WAKECNTRL_Z set - PIN_STS = 1 (high), PULL_UP = 1 - **Debounce: none programmed** The pin status reads high (released) in every sample. It appears that the level that `gpio_keys` samples (via `gpiod_get_value_cansleep()` in the debounce work) never reflects the pressed state, so `gpio_keys_gpio_report_event()` always reports the same value and the input core drops it as a duplicate. 3. `key 116` is not listed in `disabled_keys` of `gpio-keys.1.auto`. 4. Workaround proof: a userspace loop polling `/proc/interrupts` for IRQ 50 and calling `gnome-session-quit --power-off` on increment works reliably, which confirms the interrupt itself is delivered correctly on every press. ## Expected behaviour Pressing the power button emits `KEY_POWER` press/release on the gpio-keys input device, as it does on Windows (where the button opens the shutdown/sleep action configured by the user). ## Possibly related upstream discussion - "[PATCH 0/3] pinctrl-amd powerbtn handling regression" (Aug 2023) – AMD GPIO0 power button debounce / Windows-certification bit: https://lists.openwall.net/linux-kernel/2023/08/29/1216 - "Revert 'Input: soc_button_array - debounce the buttons'" (Jun 2025) – ACPI0011 power button on AMD, debounce handling in gpio_keys vs pinctrl-amd: https://lkml.iu.edu/2506.3/03268.html Possible directions (for maintainers to judge): for GPIO0 on AMD the hardware power-button logic may own the pin state, so gpio_keys might need to treat this button as IRQ-only (report press on interrupt and synthesize release), or soc_button_array / pinctrl-amd may need a DMI quirk for this platform. ## Additional data available on request - `sudo acpidump > acpidump.txt` (full ACPI tables incl. DSDT / `\_SB_.BTNS`) - full `dmesg`, `/sys/kernel/debug/gpio`, `/proc/interrupts` - testing of patched kernels ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-38-generic 7.0.0-38.38 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: machao 4397 F.... wireplumber /dev/snd/controlC0: machao 4397 F.... wireplumber /dev/snd/seq: machao 4377 F.... pipewire CasperMD5CheckMismatches: ./boot/grub/i386-pc/boot.mod ./boot/grub/i386-pc/bufio.mod ./boot/grub/i386-pc/crypto.mod ./boot/grub/i386-pc/extcmd.mod ./boot/grub/i386-pc/gettext.mod ./boot/grub/i386-pc/normal.mod ./boot/grub/i386-pc/terminal.mod CasperMD5CheckResult: fail CurrentDesktop: ubuntu:GNOME Date: Tue Oct 20 14:45:24 2026 InstallationDate: Installed on 2026-10-20 (0 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: HP HP ZBook Power 16 inch G11 A Mobile Workstation PC ProcEnviron: LANG=zh_CN.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=805fbf1c-db3d-4300-b6c8-f57590f9239b ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 07/06/2026 dmi.bios.release: 11.1 dmi.bios.vendor: HP dmi.bios.version: W85 Ver. 01.11.01 dmi.board.name: 8C95 dmi.board.vendor: HP dmi.board.version: KBC Version 08.53.00 dmi.chassis.type: 10 dmi.chassis.vendor: HP dmi.ec.firmware.release: 8.83 dmi.modalias: dmi:bvnHP:bvrW85Ver.01.11.01:bd07/06/2026:br11.1:efr8.83:svnHP:pnHPZBookPower16inchG11AMobileWorkstationPC:pvrSBKPFV3:rvnHP:rn8C95:rvrKBCVersion08.53.00:cvnHP:ct10:cvr:skuA25C8PC#AB2:pfa103C_5336ANHPZBook: dmi.product.family: 103C_5336AN HP ZBook dmi.product.name: HP ZBook Power 16 inch G11 A Mobile Workstation PC dmi.product.sku: A25C8PC#AB2 dmi.product.version: SBKPFV3 dmi.sys.vendor: HP ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute wayland-session -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171468 Title: Power button does not generate KEY_POWER on HP ZBook Power 16 G11 A (AMD GPIO0 / ACPI0011 gpio-keys) Status in linux package in Ubuntu: New Bug description: # Power button does not generate KEY_POWER on HP ZBook Power 16 G11 A (AMD GPIO0 / ACPI0011 gpio-keys) ## Summary On the HP ZBook Power 16 inch G11 A (AMD Ryzen 7 8845HS), pressing the power button while the system is running does nothing under Linux. The GPIO interrupt fires on every press/release, but the `gpio-keys` input device created by `soc_button_array` for `ACPI0011` never emits any `EV_KEY` event, so neither systemd-logind nor GNOME ever see `KEY_POWER`. The same behaviour is observed on Ubuntu 24.04, Ubuntu 26.04 and Fedora. Under Windows on the same machine the power button works normally. ## Hardware / software | Item | Value | |---|---| | Vendor / Product | HP ZBook Power 16 inch G11 A Mobile Workstation PC | | Board | 8C95 | | SKU | A25C8PC#AB2 | | CPU | AMD Ryzen 7 8845HS w/ Radeon 780M Graphics (Hawk Point) | | BIOS | HP W85 Ver. 01.11.01 (07/06/2026) | | Distro | Ubuntu 26.04.1 LTS (also reproduced on Ubuntu 24.04 and Fedora) | | Kernel | 7.0.0-38-generic #38-Ubuntu SMP PREEMPT_DYNAMIC | | systemd | 259 (259.5-0ubuntu3.4) | | Desktop | GNOME Shell 50.1, Wayland | ## ACPI topology - `\_SB_.PWRB` (PNP0C0C, standard ACPI power button): `_STA = 0` (disabled by firmware), so no "Power Button" input device is created by the ACPI button driver. There is no `LNXPWRBN` fixed power button either. - `\_SB_.BTNS` (ACPI0011, Generic Buttons Device): `_STA = 0x0B`. `soc_button_array` binds it and creates: ``` input: gpio-keys as /devices/platform/ACPI0011:00/gpio-keys.1.auto/input/input7 N: Name="gpio-keys" H: Handlers=kbd event5 B: EV=3 B: KEY=10000000000000 0 # only KEY_POWER (116) ``` - The button is wired to AMD GPIO pin 0 (`pinctrl_amd`, AMDI0030): ``` 50: ... amd_gpio 0 power ``` - udev tags `event5` with `power-switch`, and systemd-logind logs `Watching system buttons on /dev/input/event5 (gpio-keys)`. ## Observations 1. Every press of the power button increments IRQ 50 by exactly 2 (press + release edge). No interrupt storm; the counter is stable when idle. | Test | IRQ 50 count | EV_KEY events on /dev/input/event5 | |---|---|---| | 3 short presses | 58 -> 64 | 0 | | 2 short presses | 64 -> 68 | 0 | | 2 presses held ~1 s | 68 -> 72 | 0 | Events were read directly from `/dev/input/event5` as root (raw `struct input_event`), so this is independent of logind/GNOME. 2. `/sys/kernel/debug/gpio` for pin #0, identical before and after the presses: ``` GPIO bank0 #0 😛| b| edge| | | |⏰| | ↑ |input ↑| |0x8151c00 ``` Decoding 0x08151c00 (pinctrl-amd layout): - ACTIVE_LEVEL = both edges, LEVEL_TRIG = edge - INTERRUPT_ENABLE = 1, INTERRUPT_MASK = 1 (unmasked) - WAKECNTRL_Z set - PIN_STS = 1 (high), PULL_UP = 1 - **Debounce: none programmed** The pin status reads high (released) in every sample. It appears that the level that `gpio_keys` samples (via `gpiod_get_value_cansleep()` in the debounce work) never reflects the pressed state, so `gpio_keys_gpio_report_event()` always reports the same value and the input core drops it as a duplicate. 3. `key 116` is not listed in `disabled_keys` of `gpio-keys.1.auto`. 4. Workaround proof: a userspace loop polling `/proc/interrupts` for IRQ 50 and calling `gnome-session-quit --power-off` on increment works reliably, which confirms the interrupt itself is delivered correctly on every press. ## Expected behaviour Pressing the power button emits `KEY_POWER` press/release on the gpio-keys input device, as it does on Windows (where the button opens the shutdown/sleep action configured by the user). ## Possibly related upstream discussion - "[PATCH 0/3] pinctrl-amd powerbtn handling regression" (Aug 2023) – AMD GPIO0 power button debounce / Windows-certification bit: https://lists.openwall.net/linux-kernel/2023/08/29/1216 - "Revert 'Input: soc_button_array - debounce the buttons'" (Jun 2025) – ACPI0011 power button on AMD, debounce handling in gpio_keys vs pinctrl-amd: https://lkml.iu.edu/2506.3/03268.html Possible directions (for maintainers to judge): for GPIO0 on AMD the hardware power-button logic may own the pin state, so gpio_keys might need to treat this button as IRQ-only (report press on interrupt and synthesize release), or soc_button_array / pinctrl-amd may need a DMI quirk for this platform. ## Additional data available on request - `sudo acpidump > acpidump.txt` (full ACPI tables incl. DSDT / `\_SB_.BTNS`) - full `dmesg`, `/sys/kernel/debug/gpio`, `/proc/interrupts` - testing of patched kernels ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-38-generic 7.0.0-38.38 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: machao 4397 F.... wireplumber /dev/snd/controlC0: machao 4397 F.... wireplumber /dev/snd/seq: machao 4377 F.... pipewire CasperMD5CheckMismatches: ./boot/grub/i386-pc/boot.mod ./boot/grub/i386-pc/bufio.mod ./boot/grub/i386-pc/crypto.mod ./boot/grub/i386-pc/extcmd.mod ./boot/grub/i386-pc/gettext.mod ./boot/grub/i386-pc/normal.mod ./boot/grub/i386-pc/terminal.mod CasperMD5CheckResult: fail CurrentDesktop: ubuntu:GNOME Date: Tue Oct 20 14:45:24 2026 InstallationDate: Installed on 2026-10-20 (0 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: HP HP ZBook Power 16 inch G11 A Mobile Workstation PC ProcEnviron: LANG=zh_CN.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=805fbf1c-db3d-4300-b6c8-f57590f9239b ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 07/06/2026 dmi.bios.release: 11.1 dmi.bios.vendor: HP dmi.bios.version: W85 Ver. 01.11.01 dmi.board.name: 8C95 dmi.board.vendor: HP dmi.board.version: KBC Version 08.53.00 dmi.chassis.type: 10 dmi.chassis.vendor: HP dmi.ec.firmware.release: 8.83 dmi.modalias: dmi:bvnHP:bvrW85Ver.01.11.01:bd07/06/2026:br11.1:efr8.83:svnHP:pnHPZBookPower16inchG11AMobileWorkstationPC:pvrSBKPFV3:rvnHP:rn8C95:rvrKBCVersion08.53.00:cvnHP:ct10:cvr:skuA25C8PC#AB2:pfa103C_5336ANHPZBook: dmi.product.family: 103C_5336AN HP ZBook dmi.product.name: HP ZBook Power 16 inch G11 A Mobile Workstation PC dmi.product.sku: A25C8PC#AB2 dmi.product.version: SBKPFV3 dmi.sys.vendor: HP To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171468/+subscriptions

[Bug 2170415] Re: ASUS Zenbook 14 UM3405GA: internal speakers silent, CS35L41 amps probed but not bound (ALC294, subsystem 1043:19f4)

Thanks Daniel (#2), the workaround works. On my installed Ubuntu 26.04 (kernel 7.0.0-38-generic) I added this: options snd-hda-intel model=,1043:1c03 in /etc/modprobe.d/, ran update-initramfs -u and rebooted. The internal speakers now play sound. I did not need to add the cs35l41-dsp1-spk-prot-104319f4 firmware symlinks. I haven't tested 26.10 yet, but can if it's still useful. Chris (#7): I believe ALC294_FIXUP_CS35L41_I2C_2 isn't the right fixup for this machine, per #2. The ALSA info collected with the original report was taken before the workaround. It's attached to this bug. Thanks -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2170415 Title: ASUS Zenbook 14 UM3405GA: internal speakers silent, CS35L41 amps probed but not bound (ALC294, subsystem 1043:19f4) Status in linux package in Ubuntu: Confirmed Status in linux-firmware-misc package in Ubuntu: Confirmed Bug description: Claude wrote this after some testing. Hardware: ASUS Zenbook 14 UM3405GA, Ryzen AI 9 465 OS: Ubuntu 26.04 LTS, kernel 7.0.0-38-generic BIOS version: UM3405GA.304 Problem: Internal speakers produce no sound. Headphone jack, HDMI audio and Bluetooth audio work. Findings: - Codec: Realtek ALC294, Subsystem ID 0x104319f4 - ACPI device CSC3551 is present. dmesg shows two Cirrus Logic CS35L41 amps (Revision B2) detected by cs35l41-hda: cs35l41-hda i2c-CSC3551:00-cs35l41-hda.0: Cirrus Logic CS35L41 (35a40), Revision: B2 cs35l41-hda i2c-CSC3551:00-cs35l41-hda.1: Reset line busy, assuming shared reset cs35l41-hda i2c-CSC3551:00-cs35l41-hda.1: Cirrus Logic CS35L41 (35a40), Revision: B2 - The codec driver logs "picked fixup (pin match)", meaning no model-specific quirk is applied. - The kernel already contains ALC294_FIXUP_CS35L41_I2C_2, which looks like the right fixup, but 0x104319f4 doesn't appear to be in the quirk table. - linux-firmware 20260319 has no cs35l41-dsp1-spk-prot-104319f4 tuning files. - speaker-test -D hw:1,0 is silent. alsamixer shows nothing muted except headphones. PipeWire shows a correct default sink. - fwupd has no System Firmware update for this model. Request: please consider adding a quirk entry for 1043:19f4 using the CS35L41 I2C fixup, and tuning files if available. I can test patches or test kernels. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-38-generic 7.0.0-38.38 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: user13 5480 F.... wireplumber /dev/snd/controlC0: user13 5480 F.... wireplumber /dev/snd/seq: user13 5461 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Fri Oct 9 22:23:21 2026 InstallationDate: Installed on 2026-10-10 (0 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: ASUS Zenbook 14 UM3405GA ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 03/13/2026 dmi.bios.release: 5.35 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: UM3405GA.304 dmi.board.asset.tag: ATN12345678901234567 dmi.board.name: UM3405GA dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: 1.0 dmi.chassis.asset.tag: No Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: ASUSTeK COMPUTER INC. dmi.chassis.version: 1.0 dmi.ec.firmware.release: 3.3 dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvrUM3405GA.304:bd03/13/2026:br5.35:efr3.3:svnASUS:pnZenbook14UM3405GA:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnUM3405GA:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku:pfaZenbook14: dmi.product.family: Zenbook 14 dmi.product.name: Zenbook 14 UM3405GA dmi.product.version: 1.0 dmi.sys.vendor: ASUS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170415/+subscriptions

[Bug 2170908] Re: Intel Bluetooth stops working on some cold boots on Dell systems

** Tags added: jira-stella-4234 stella -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2170908 Title: Intel Bluetooth stops working on some cold boots on Dell systems Status in HWE Next: New Status in linux package in Ubuntu: Invalid Status in linux-oem-7.0 package in Ubuntu: Invalid Status in linux source package in Resolute: In Progress Status in linux-oem-7.0 source package in Resolute: In Progress Bug description: [Impact] On some cold boots, the Intel PCIe Bluetooth controller (btintel_pcie) is declared dead and Bluetooth does not work. hci0 stays down for the rest of the session. Seen on a Dell system (CID: 202608-39584) running linux-oem-7.0. Error log: Bluetooth: hci0: Controller in error state Bluetooth: hci0: Timeout (3000 ms) on alive interrupt, alive context: intel_reset1 Bluetooth: hci0: Failed to send frame (-62) Bluetooth: hci0: Failed to send Intel Reset command Bluetooth: hci0: Intel Soft Reset failed (-62) Measured on the affected system: 10 of 60 cold boots hit the error. 4 of those 10 left hci0 down. The driver treats bit 12 of the boot stage register as a fatal error. The hardware documents that bit as a warning only. When the controller sets it, the driver starts a soft reset on a controller that was fine, and the reset fails. [Fix] Cherry-pick of upstream commit 5917dd39db2b ("Bluetooth: btintel_pcie: treat boot stage bit 12 as warning"), in v7.1 (first seen in v7.1-rc3). It renames the bit to DEVICE_WARNING and removes it from btintel_pcie_in_error(). Only the abort handler bit (bit 13) is an error now. A set warning bit is logged and the boot continues. It also prints the boot stage value in the error message. Fixes: 190377500fde ("Bluetooth: btintel_pcie: Dump debug registers on error"), in v6.16. [Test Plan] Power off and power on the machine 60 times (full power loss, not reboot): $ sudo systemctl poweroff After each boot check: $ journalctl -b -k | grep -E "Controller in error state|Soft Reset failed" $ hciconfig hci0 | grep "UP RUNNING" Without patch: 10 of 60 boots show "Controller in error state" and the Soft Reset failure. 4 of 60 leave hci0 down. With patch: 0 of 60 boots show an error. hci0 is UP RUNNING every time. On 7 of 60 boots the new line shows up and the controller works: Bluetooth: hci0: Controller device warning (boot_stage: 0xa0db1003) [Where problems could occur] Could break error handling in the btintel_pcie driver. If a real fatal error ever sets only bit 12, the driver will no longer treat it as an error. It will not run the error path or the soft reset. Bluetooth would then fail later (command timeouts, hci0 not coming up) instead of at the first error. Errors that set bit 13 (abort handler) are handled as before. The change only touches btintel_pcie.c and btintel_pcie.h. It does not touch other Intel Bluetooth transports (btusb). To manage notifications about this bug go to: https://bugs.launchpad.net/hwe-next/+bug/2170908/+subscriptions

[Bug 2171437] Re: Ubuntu 26.10: desktop freezes during video playback when opening overview or switching workspaces on AMD Strix / Wayland

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171437 Title: Ubuntu 26.10: desktop freezes during video playback when opening overview or switching workspaces on AMD Strix / Wayland Status in linux package in Ubuntu: New Bug description: After upgrading to Ubuntu 26.10, the desktop freezes when I use a touchpad gesture to open the GNOME overview or switch workspaces while a video is playing. This occurs with video playback in both a browser and Celluloid video player. Logging out and logging back in restores the desktop. A subsequent GNOME update seemed to reduce the problem, but did not eliminate it. Steps to reproduce 1. Log into the Ubuntu GNOME Wayland session. 2. Start playing a video in a browser or Celluloid. 3. Use a touchpad gesture to open the overview or switch to another workspace. 4. The desktop may freeze. Logging out and logging back in restores it. Audio remains responsive during the freeze. Expected result The overview / workspace animation completes normally and video playback continues without freezing the desktop. Actual result The desktop freezes and requires logging out and logging back in to recover. System information - Ubuntu 26.10 (stonking), x86_64. - Lenovo 83SG / LNVNB161216; BIOS T5CN20WW, 2026-01-30. - GPU: AMD Strix, reported by lspci as Radeon 880M / 890M, PCI ID 1002:150e, subsystem 17aa:3818; kernel driver amdgpu. - Kernel: 7.3.0-9-generic; /proc/version_signature: Ubuntu 7.3.0-9.9-generic 7.3.0-rc6. - Session: Wayland; desktop: ubuntu:GNOME. - gnome-shell: 51.0-2ubuntu3. - mutter-common: 51.0-1ubuntu3. - libgl1-mesa-dri: 26.2.4-1ubuntu1. - Celluloid: 0.29-3. - Enabled GNOME extensions reported by gsettings: ding@rastersoft.com, ubuntu-dock@ubuntu.com, tiling-assistant@ubuntu.com. Reproduction with extensions disabled has not been tested. - amdgpu dcdebugmask: 0 (no proposed Replay workaround applied). Potentially relevant kernel warning The journal contains repeated warnings from the AMD display Replay code: ```text WARNING: drivers/gpu/drm/amd/amdgpu/../display/modules/power/power_replay.c:69 at mod_power_set_replay_event+0x3ea/0x440 [amdgpu], CPU#3: KMS thread/8148 ``` The warning was recorded at the following local times (UTC+03:00): - 2026-10-18 22:59:37 - 2026-10-19 00:26:44 - 2026-10-19 19:08:58 The last warning's stack includes: ```text amdgpu_dm_replay_set_event amdgpu_dm_mod_power_update_streams amdgpu_dm_commit_streams amdgpu_dm_atomic_commit_tail drm_atomic_helper_commit drm_atomic_commit drm_mode_atomic_ioctl ``` No GPU reset, ring timeout, out-of-memory kill or GNOME Shell crash was found in the journals examined since the upgrade on 2026-10-18. All of this started happening after upgrading to 26.10 from 26.04 ProblemType: Bug DistroRelease: Ubuntu 26.10 Package: linux-image-7.3.0-9-generic 7.3.0-9.9 ProcVersionSignature: Ubuntu 7.3.0-9.9-generic 7.3.0-rc6 Uname: Linux 7.3.0-9-generic x86_64 ApportVersion: 2.36.0-0ubuntu1 Architecture: amd64 CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Mon Oct 19 21:52:43 2026 InstallationDate: Installed on 2026-06-14 (127 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: LENOVO 83SG ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.3.0-9-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: Upgraded to stonking on 2026-10-18 (1 days ago) dmi.bios.date: 01/30/2026 dmi.bios.release: 1.20 dmi.bios.vendor: LENOVO dmi.bios.version: T5CN20WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: SDK0T76577 WIN dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: XiaoXinPro 14GT AGP11 dmi.ec.firmware.release: 1.20 dmi.modalias: dmi:bvnLENOVO:bvrT5CN20WW:bd01/30/2026:br1.20:efr1.20:svnLENOVO:pn83SG:pvrXiaoXinPro14GTAGP11:rvnLENOVO:rnLNVNB161216:rvrSDK0T76577WIN:cvnLENOVO:ct10:cvrXiaoXinPro14GTAGP11:skuLENOVO_MT_83SG_BU_idea_FM_XiaoXinPro14GTAGP11:pfaXiaoXinPro14GTAGP11: dmi.product.family: XiaoXinPro 14GT AGP11 dmi.product.name: 83SG dmi.product.sku: LENOVO_MT_83SG_BU_idea_FM_XiaoXinPro 14GT AGP11 dmi.product.version: XiaoXinPro 14GT AGP11 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171437/+subscriptions

[Bug 2171449] Re: nouveau GF119 (GeForce 410M): HDMI-Audio ohne ELD, monitor_present 0

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171449 Title: nouveau GF119 (GeForce 410M): HDMI-Audio ohne ELD, monitor_present 0 Status in linux package in Ubuntu: New Bug description: Ubuntu 26.04, Kernel 7.0.0-38-generic, Sony VAIO VPCEH2Z1E, NVIDIA GF119M (GeForce 410M), Treiber nouveau. HDMI-Ton funktioniert nicht. Der HDMI-Ausgang ist an der NVIDIA-GPU, der Monitor wird erkannt und zeigt ein Bild (connected/enabled). Das EDID des Monitors meldet Audio (Basic audio support, Audio Data Block). Trotzdem: - /proc/asound/card1/eld#0.0: monitor_present 0, eld_valid 0 - Codec Node 0x05: Pin-ctls 0x00, auch waehrend der Wiedergabe - PipeWire-Sink vorhanden, Pegel schlaegt aus, am Monitor kommt kein Ton Bereits probiert, ohne Wirkung: Kernel 6.8.0-147 (gleiches Verhalten), nouveau.runpm=0, nouveau.config=NvAudio=1, Unbind/Bind von 0000:01:00.1, Monitor aus-/einschalten in den Anzeigeeinstellungen. Unter einer frueheren Ubuntu-Version funktionierte der Ton. Ausgaben (ELD, EDID, dmesg) siehe Anhang. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-38-generic 7.0.0-38.38 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: bernhard 2154 F.... wireplumber /dev/snd/controlC0: bernhard 2154 F.... wireplumber /dev/snd/seq: bernhard 2142 F.... pipewire CRDA: N/A CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Tue Oct 20 00:23:10 2026 MachineType: Sony Corporation VPCEH2Z1E ProcFB: 0 nouveaudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=744f7259-4a94-44e0-b0fe-4ffac9d42ecc ro quiet splash nouveau.runpm=0 nouveau.config=NvAudio=1 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-10-16 (4 days ago) dmi.bios.date: 04/28/2011 dmi.bios.release: 1.80 dmi.bios.vendor: INSYDE dmi.bios.version: R0180Z9 dmi.board.asset.tag: N/A dmi.board.name: VAIO dmi.board.vendor: Sony Corporation dmi.board.version: N/A dmi.chassis.asset.tag: N/A dmi.chassis.type: 10 dmi.chassis.vendor: Sony Corporation dmi.chassis.version: N/A dmi.ec.firmware.release: 1.80 dmi.modalias: dmi:bvnINSYDE:bvrR0180Z9:bd04/28/2011:br1.80:efr1.80:svnSonyCorporation:pnVPCEH2Z1E:pvrC106GEGD:rvnSonyCorporation:rnVAIO:rvrN/A:cvnSonyCorporation:ct10:cvrN/A:skuN/A:pfaVAIO: dmi.product.family: VAIO dmi.product.name: VPCEH2Z1E dmi.product.sku: N/A dmi.product.version: C106GEGD dmi.sys.vendor: Sony Corporation To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171449/+subscriptions

[Bug 2170957] Re: Upstream stable patch causes build failure when CONFIG_SENSORS_RASPBERRYPI_HWMON is enabled

** Also affects: linux-oracle (Ubuntu) Importance: Undecided Status: New ** Changed in: linux-oracle (Ubuntu) Status: New => Invalid ** Changed in: linux-oracle (Ubuntu Noble) Status: New => Fix Committed ** Changed in: linux-oracle (Ubuntu Noble) Assignee: (unassigned) => Manuel Diewald (diewald) -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2170957 Title: Upstream stable patch causes build failure when CONFIG_SENSORS_RASPBERRYPI_HWMON is enabled Status in linux package in Ubuntu: Invalid Status in linux-aws package in Ubuntu: Invalid Status in linux-oracle package in Ubuntu: Invalid Status in linux source package in Noble: In Progress Status in linux-aws source package in Noble: Fix Committed Status in linux-oracle source package in Noble: Fix Committed Bug description: SRU Justification: [Impact] This upstream stable patch from v6.12.111 425ad79932035 ("hwmon: (raspberrypi) Fix delayed-work teardown race") should not have been included in noble because disable_delayed_work_sync() is not available. The patch causes the build to break when CONFIG_SENSORS_RASPBERRYPI_HWMON is turned on: error: implicit declaration of function 'disable_delayed_work_sync' The generic kernel has this config option turned off, so build tests for the noble upstream stable patchset didn't catch this issue after the patch applied cleanly to our tree. [Fix] Revert the patch in the generic noble kernel. [Test Plan] Build the kernel with CONFIG_SENSORS_RASPBERRYPI_HWMON turned on (or build noble:linux-aws). [Where problems could occur] Issues would be localized to the Raspberry Pi voltage monitor driver. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170957/+subscriptions

[Bug 2171449] [NEW] nouveau GF119 (GeForce 410M): HDMI-Audio ohne ELD, monitor_present 0

Public bug reported: Ubuntu 26.04, Kernel 7.0.0-38-generic, Sony VAIO VPCEH2Z1E, NVIDIA GF119M (GeForce 410M), Treiber nouveau. HDMI-Ton funktioniert nicht. Der HDMI-Ausgang ist an der NVIDIA-GPU, der Monitor wird erkannt und zeigt ein Bild (connected/enabled). Das EDID des Monitors meldet Audio (Basic audio support, Audio Data Block). Trotzdem: - /proc/asound/card1/eld#0.0: monitor_present 0, eld_valid 0 - Codec Node 0x05: Pin-ctls 0x00, auch waehrend der Wiedergabe - PipeWire-Sink vorhanden, Pegel schlaegt aus, am Monitor kommt kein Ton Bereits probiert, ohne Wirkung: Kernel 6.8.0-147 (gleiches Verhalten), nouveau.runpm=0, nouveau.config=NvAudio=1, Unbind/Bind von 0000:01:00.1, Monitor aus-/einschalten in den Anzeigeeinstellungen. Unter einer frueheren Ubuntu-Version funktionierte der Ton. Ausgaben (ELD, EDID, dmesg) siehe Anhang. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-38-generic 7.0.0-38.38 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: bernhard 2154 F.... wireplumber /dev/snd/controlC0: bernhard 2154 F.... wireplumber /dev/snd/seq: bernhard 2142 F.... pipewire CRDA: N/A CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Tue Oct 20 00:23:10 2026 MachineType: Sony Corporation VPCEH2Z1E ProcFB: 0 nouveaudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=744f7259-4a94-44e0-b0fe-4ffac9d42ecc ro quiet splash nouveau.runpm=0 nouveau.config=NvAudio=1 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-10-16 (4 days ago) dmi.bios.date: 04/28/2011 dmi.bios.release: 1.80 dmi.bios.vendor: INSYDE dmi.bios.version: R0180Z9 dmi.board.asset.tag: N/A dmi.board.name: VAIO dmi.board.vendor: Sony Corporation dmi.board.version: N/A dmi.chassis.asset.tag: N/A dmi.chassis.type: 10 dmi.chassis.vendor: Sony Corporation dmi.chassis.version: N/A dmi.ec.firmware.release: 1.80 dmi.modalias: dmi:bvnINSYDE:bvrR0180Z9:bd04/28/2011:br1.80:efr1.80:svnSonyCorporation:pnVPCEH2Z1E:pvrC106GEGD:rvnSonyCorporation:rnVAIO:rvrN/A:cvnSonyCorporation:ct10:cvrN/A:skuN/A:pfaVAIO: dmi.product.family: VAIO dmi.product.name: VPCEH2Z1E dmi.product.sku: N/A dmi.product.version: C106GEGD dmi.sys.vendor: Sony Corporation ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute wayland-session ** Attachment added: "Hdmi Report" https://bugs.launchpad.net/bugs/2171449/+attachment/6010750/+files/hdmi-audio-bericht.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171449 Title: nouveau GF119 (GeForce 410M): HDMI-Audio ohne ELD, monitor_present 0 Status in linux package in Ubuntu: New Bug description: Ubuntu 26.04, Kernel 7.0.0-38-generic, Sony VAIO VPCEH2Z1E, NVIDIA GF119M (GeForce 410M), Treiber nouveau. HDMI-Ton funktioniert nicht. Der HDMI-Ausgang ist an der NVIDIA-GPU, der Monitor wird erkannt und zeigt ein Bild (connected/enabled). Das EDID des Monitors meldet Audio (Basic audio support, Audio Data Block). Trotzdem: - /proc/asound/card1/eld#0.0: monitor_present 0, eld_valid 0 - Codec Node 0x05: Pin-ctls 0x00, auch waehrend der Wiedergabe - PipeWire-Sink vorhanden, Pegel schlaegt aus, am Monitor kommt kein Ton Bereits probiert, ohne Wirkung: Kernel 6.8.0-147 (gleiches Verhalten), nouveau.runpm=0, nouveau.config=NvAudio=1, Unbind/Bind von 0000:01:00.1, Monitor aus-/einschalten in den Anzeigeeinstellungen. Unter einer frueheren Ubuntu-Version funktionierte der Ton. Ausgaben (ELD, EDID, dmesg) siehe Anhang. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-38-generic 7.0.0-38.38 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: bernhard 2154 F.... wireplumber /dev/snd/controlC0: bernhard 2154 F.... wireplumber /dev/snd/seq: bernhard 2142 F.... pipewire CRDA: N/A CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Tue Oct 20 00:23:10 2026 MachineType: Sony Corporation VPCEH2Z1E ProcFB: 0 nouveaudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=744f7259-4a94-44e0-b0fe-4ffac9d42ecc ro quiet splash nouveau.runpm=0 nouveau.config=NvAudio=1 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-10-16 (4 days ago) dmi.bios.date: 04/28/2011 dmi.bios.release: 1.80 dmi.bios.vendor: INSYDE dmi.bios.version: R0180Z9 dmi.board.asset.tag: N/A dmi.board.name: VAIO dmi.board.vendor: Sony Corporation dmi.board.version: N/A dmi.chassis.asset.tag: N/A dmi.chassis.type: 10 dmi.chassis.vendor: Sony Corporation dmi.chassis.version: N/A dmi.ec.firmware.release: 1.80 dmi.modalias: dmi:bvnINSYDE:bvrR0180Z9:bd04/28/2011:br1.80:efr1.80:svnSonyCorporation:pnVPCEH2Z1E:pvrC106GEGD:rvnSonyCorporation:rnVAIO:rvrN/A:cvnSonyCorporation:ct10:cvrN/A:skuN/A:pfaVAIO: dmi.product.family: VAIO dmi.product.name: VPCEH2Z1E dmi.product.sku: N/A dmi.product.version: C106GEGD dmi.sys.vendor: Sony Corporation To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171449/+subscriptions

[Bug 2171043] ProcCpuinfo.txt

apport information ** Attachment added: "ProcCpuinfo.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010486/+files/ProcCpuinfo.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2171043] Lsusb-v.txt

apport information ** Attachment added: "Lsusb-v.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010485/+files/Lsusb-v.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2171043] Lsusb-t.txt

apport information ** Attachment added: "Lsusb-t.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010484/+files/Lsusb-t.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2171043] Lsusb.txt

apport information ** Attachment added: "Lsusb.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010483/+files/Lsusb.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2171043] Lspci-vt.txt

apport information ** Attachment added: "Lspci-vt.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010482/+files/Lspci-vt.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2170886] Re: [Linux Perf] [DF PMC] MCM IOD (two IOD per socket)

Thank you very much for reporting this issue. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2170886 Title: [Linux Perf] [DF PMC] MCM IOD (two IOD per socket) Status in linux package in Ubuntu: Fix Committed Bug description: Will be having 2 IODs per socket. This is reported via CPUID_Fn8000001E.ECX[10:8] which is supposed to indicate the "Nodes per Processor/Socket". As per the PPR for WH SP7 , this value can be (0, 1, 3) which respective refer to 1 Nodes Per Processor, 2 Nodes Per Processor, 4 Nodes Per Processor. Further the IOD ID can be obtained by considering the MSB of the 4-bit DIE ID obtained via CPUID_Fn80000026 On the kernel side, we need to audit the PMC code paths which would need the IOD ID to compute read the values of DF PMCs associated with those IODs. The patch has landed in the mainline kernel. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=67d27727854def4a7e2b386429941f5c4741ccc4 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170886/+subscriptions