[Bug 2171043] ProcCpuinfo.txt

apport information ** Attachment added: "ProcCpuinfo.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010486/+files/ProcCpuinfo.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2171043] Lsusb-v.txt

apport information ** Attachment added: "Lsusb-v.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010485/+files/Lsusb-v.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2171043] Lsusb-t.txt

apport information ** Attachment added: "Lsusb-t.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010484/+files/Lsusb-t.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2171043] Lsusb.txt

apport information ** Attachment added: "Lsusb.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010483/+files/Lsusb.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2171043] Lspci-vt.txt

apport information ** Attachment added: "Lspci-vt.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010482/+files/Lspci-vt.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2170886] Re: [Linux Perf] [DF PMC] MCM IOD (two IOD per socket)

Thank you very much for reporting this issue. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2170886 Title: [Linux Perf] [DF PMC] MCM IOD (two IOD per socket) Status in linux package in Ubuntu: Fix Committed Bug description: Will be having 2 IODs per socket. This is reported via CPUID_Fn8000001E.ECX[10:8] which is supposed to indicate the "Nodes per Processor/Socket". As per the PPR for WH SP7 , this value can be (0, 1, 3) which respective refer to 1 Nodes Per Processor, 2 Nodes Per Processor, 4 Nodes Per Processor. Further the IOD ID can be obtained by considering the MSB of the 4-bit DIE ID obtained via CPUID_Fn80000026 On the kernel side, we need to audit the PMC code paths which would need the IOD ID to compute read the values of DF PMCs associated with those IODs. The patch has landed in the mainline kernel. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=67d27727854def4a7e2b386429941f5c4741ccc4 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170886/+subscriptions

[Bug 2171043] Re: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs

Thank you very much for reporting this issue. Could you please provide more information? Please boot into the Ubuntu kernel and run the following command in a terminal to collect debugging information and attach it to this report. $ sudo apport-collect 2171043 ** Changed in: linux (Ubuntu) Status: New => Incomplete -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions

[Bug 2170415] Re: ASUS Zenbook 14 UM3405GA: internal speakers silent, CS35L41 amps probed but not bound (ALC294, subsystem 1043:19f4)

It may need a quirk ALC294_FIXUP_CS35L41_I2C_2 for this machine. Could you post the output file of `sudo alsa-info` so the descriptive “ALSA/HDA dmesg” would help further information? Thanks -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2170415 Title: ASUS Zenbook 14 UM3405GA: internal speakers silent, CS35L41 amps probed but not bound (ALC294, subsystem 1043:19f4) Status in linux package in Ubuntu: Confirmed Status in linux-firmware-misc package in Ubuntu: Confirmed Bug description: Claude wrote this after some testing. Hardware: ASUS Zenbook 14 UM3405GA, Ryzen AI 9 465 OS: Ubuntu 26.04 LTS, kernel 7.0.0-38-generic BIOS version: UM3405GA.304 Problem: Internal speakers produce no sound. Headphone jack, HDMI audio and Bluetooth audio work. Findings: - Codec: Realtek ALC294, Subsystem ID 0x104319f4 - ACPI device CSC3551 is present. dmesg shows two Cirrus Logic CS35L41 amps (Revision B2) detected by cs35l41-hda: cs35l41-hda i2c-CSC3551:00-cs35l41-hda.0: Cirrus Logic CS35L41 (35a40), Revision: B2 cs35l41-hda i2c-CSC3551:00-cs35l41-hda.1: Reset line busy, assuming shared reset cs35l41-hda i2c-CSC3551:00-cs35l41-hda.1: Cirrus Logic CS35L41 (35a40), Revision: B2 - The codec driver logs "picked fixup (pin match)", meaning no model-specific quirk is applied. - The kernel already contains ALC294_FIXUP_CS35L41_I2C_2, which looks like the right fixup, but 0x104319f4 doesn't appear to be in the quirk table. - linux-firmware 20260319 has no cs35l41-dsp1-spk-prot-104319f4 tuning files. - speaker-test -D hw:1,0 is silent. alsamixer shows nothing muted except headphones. PipeWire shows a correct default sink. - fwupd has no System Firmware update for this model. Request: please consider adding a quirk entry for 1043:19f4 using the CS35L41 I2C fixup, and tuning files if available. I can test patches or test kernels. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-38-generic 7.0.0-38.38 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: user13 5480 F.... wireplumber /dev/snd/controlC0: user13 5480 F.... wireplumber /dev/snd/seq: user13 5461 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Fri Oct 9 22:23:21 2026 InstallationDate: Installed on 2026-10-10 (0 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: ASUS Zenbook 14 UM3405GA ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 03/13/2026 dmi.bios.release: 5.35 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: UM3405GA.304 dmi.board.asset.tag: ATN12345678901234567 dmi.board.name: UM3405GA dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: 1.0 dmi.chassis.asset.tag: No Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: ASUSTeK COMPUTER INC. dmi.chassis.version: 1.0 dmi.ec.firmware.release: 3.3 dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvrUM3405GA.304:bd03/13/2026:br5.35:efr3.3:svnASUS:pnZenbook14UM3405GA:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnUM3405GA:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku:pfaZenbook14: dmi.product.family: Zenbook 14 dmi.product.name: Zenbook 14 UM3405GA dmi.product.version: 1.0 dmi.sys.vendor: ASUS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170415/+subscriptions

[Bug 2171046] Re: Firmware-less serdev device returns ENODEV for modalias, breaking sysfs enumeration

** Tags added: jira-somerville-5744 oem-priority -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171046 Title: Firmware-less serdev device returns ENODEV for modalias, breaking sysfs enumeration Status in OEM Priority Project: New Status in linux package in Ubuntu: New Status in linux source package in Resolute: New Bug description: The Dell UART backlight driver creates a  serial0-0  serdev device without ACPI or Device Tree firmware metadata. When userspace reads its  modalias  sysfs file, serdev tries to generate an alias from ACPI and OF data; both lookups return  -ENODEV , which serdev incorrectly propagates as a read failure. The modalias should instead be readable with empty content, because this manually created device has no firmware alias. Returning  -ENODEV  makes sysfs enumeration fail and causes Checkbox  dkms_info_attachment  to abort. To manage notifications about this bug go to: https://bugs.launchpad.net/oem-priority/+bug/2171046/+subscriptions

[Bug 2171359] Re: resolute: enable CONFIG_XFS_ONLINE_SCRUB (upstream default y since Linux 6.18)

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171359 Title: resolute: enable CONFIG_XFS_ONLINE_SCRUB (upstream default y since Linux 6.18) Status in linux package in Ubuntu: New Bug description: The Ubuntu kernels for 26.04 are built without XFS online scrub, so xfs_scrub (xfsprogs) cannot check a mounted XFS filesystem. Expected: CONFIG_XFS_ONLINE_SCRUB=y, as in the upstream defconfig since Linux 6.18. Darrick Wong's Kconfig change made it default y: "Online fsck has been a part of upstream for over a year now without any serious problems. Turn it on by default in time for the 2025 LTS kernel". Actual: $ grep XFS_ONLINE_SCRUB /boot/config-7.0.0-31-generic # CONFIG_XFS_ONLINE_SCRUB is not set The same setting is in the configs shipped in linux- modules-7.0.0-38-generic and linux-modules-7.0.0-1015-oem, so no 26.04 flavour has it. Steps to reproduce: 1. On Ubuntu 26.04, create and mount any XFS v5 filesystem. 2. systemctl start xfs_scrub_all.service (the unit the package's weekly timer runs) 3. journalctl -u 'xfs_scrub_media@*' shows, for each filesystem: "Error: <mount>: Kernel metadata scrubbing facility is not available." "Info: <mount>: Scrub aborted after phase 1." Versions: Ubuntu 26.04.1 LTS Ubuntu 7.0.0-31.31-generic 7.0.14 (linux-image-7.0.0-31-generic 7.0.0-31.31) xfsprogs 6.18.0-3 Related: LP: #1810293 (the same request for an older release; expired 2026-04-13, reopened 2026-05-10, no triage). The bot's expiry comment asks for a new report against a supported kernel, which this is. Impact: xfsprogs ships xfs_scrub_all.timer enabled, so every 26.04 system with XFS runs a weekly check that cannot work on this kernel. That part is filed separately against xfsprogs; I will link it in a comment. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171359/+subscriptions

[Bug 2171313] Re: mt7925e can't connect to Wi-Fi 7 (MLO) access points when the BIOS disables 802.11be for the country (Canada)

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171313 Title: mt7925e can't connect to Wi-Fi 7 (MLO) access points when the BIOS disables 802.11be for the country (Canada) Status in linux package in Ubuntu: New Bug description: SUMMARY On a Lenovo IdeaPad Slim 5 16AGP11 (MediaTek MT7925, driver mt7925e) in Canada, Ubuntu 26.04 can't connect to any Wi-Fi network whose access point advertises a Wi-Fi 7 Basic Multi-Link element. The kernel refuses every authentication attempt before a single frame is sent, and wpa_supplicant never falls back to a normal (non-MLO) connection. These networks are therefore unusable. About 30 other devices connect to the same access point without trouble, including other Ubuntu laptops. This laptop connects normally to networks that don't advertise a Multi-Link element. Cause, in short: the BIOS disables 802.11be (Wi-Fi 7) for Canada in its ACPI MTCL table, so mt7925e marks every channel NO_EHT. But mt7925e still advertises MLO support (WIPHY_FLAG_SUPPORTS_MLO), and its EHT capabilities stay advertised too. wpa_supplicant therefore requests an MLO authentication. mac80211 drops the connection to HE because of NO_EHT, stops seeing the AP's Multi-Link element, and rejects the request with "Rejecting MLO as it is not supported by AP". HARDWARE AND SOFTWARE - Lenovo IdeaPad Slim 5 16AGP11, machine type 83S2, BIOS TGCN13WW (02/28/2026) - MEDIATEK MT7925 802.11be PCIe [14c3:7925], subsystem Lenovo [17aa:e0ff], driver mt7925e - Ubuntu 26.04.1 LTS - Kernels: 7.0.0-30-generic (7.0.0-30.30, upstream 7.0.12) and 7.0.0-38-generic (7.0.0-38.38, upstream 7.0.14). Both are affected. - Firmware: linux-firmware-mediatek 20260319.git217ca6e4-0ubuntu1.2 (WM firmware build 20260605184805). The newer upstream build 20260813113118 fails the same way. - wpasupplicant 2:2.11-0ubuntu5, network-manager 1.54.3-2ubuntu3.1 - Regulatory domain: CA, set by the driver ("CTRL-EVENT-REGDOM-CHANGE init=DRIVER type=COUNTRY alpha2=CA") - Access point: a Wi-Fi 7 router with a Basic Multi-Link element on every SSID. <SSID-1> is a separate single-link MLD per band (5745 MHz and 2432 MHz). <SSID-2> is one 2-link MLD (link 0 on 5745 MHz, link 1 on 2432 MHz). STEPS TO REPRODUCE 1. Use this laptop (BIOS TGCN13WW) somewhere the regulatory country becomes CA ("iw reg get" shows "country CA"). 2. With the default NetworkManager + wpa_supplicant, connect to a Wi-Fi 7 access point that advertises a Multi-Link element (an MLO SSID, or a single-link MLD). 3. Watch "journalctl -f". EXPECTED RESULT The laptop connects: with MLO if Wi-Fi 7 is allowed, otherwise as a normal non-MLO Wi-Fi 6 (HE) connection. iwd does the latter on the same machine. ACTUAL RESULT No connection. Each BSS fails within about 60 ms: the kernel logs "regulatory prevented using AP config, downgraded" and "Rejecting MLO as it is not supported by AP", then wpa_supplicant logs "SME: Authentication request to the driver failed". No authentication frame is sent. wpa_supplicant ignore-lists the BSSID, tries the next one (again with MLO), and after that temporarily disables the network. This repeats on every attempt, on both kernels and with both firmware builds. LOGS (redacted) 7.0.0-38-generic, 2-link MLD SSID: [ 259.994810] wpa_supplicant[6403]: wlo1: SME: Trying to authenticate with <BSSID-2a> (SSID='<SSID-2>' freq=5745 MHz) [ 260.060118] kernel: wlo1: [link 0] regulatory prevented using AP config, downgraded [ 260.060318] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 260.063602] wpa_supplicant[6403]: wlo1: SME: Authentication request to the driver failed [ 260.063628] wpa_supplicant[6403]: wlo1: Added BSSID <BSSID-2a> into ignore list, ignoring for 10 seconds [ 260.367503] wpa_supplicant[6403]: wlo1: SME: Trying to authenticate with <BSSID-2b> (SSID='<SSID-2>' freq=2432 MHz) [ 260.418124] kernel: wlo1: [link 1] regulatory prevented using AP config, downgraded [ 260.418326] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 260.421295] wpa_supplicant[6403]: wlo1: SME: Authentication request to the driver failed [ 260.421316] wpa_supplicant[6403]: wlo1: Added BSSID <BSSID-2b> into ignore list, ignoring for 10 seconds 7.0.0-30-generic, SSID with a single-link MLD per band: [ 4.284069] kernel: mt7925e 0000:03:00.0: WM Firmware Version: ____000000, Build Time: 20260605184805 [ 9.670529] wpa_supplicant[1611]: wlo1: CTRL-EVENT-REGDOM-CHANGE init=DRIVER type=COUNTRY alpha2=CA [ 13.698595] wpa_supplicant[1611]: wlo1: SME: Trying to authenticate with <BSSID-1a> (SSID='<SSID-1>' freq=5745 MHz) [ 13.762101] kernel: wlo1: [link 0] regulatory prevented using AP config, downgraded [ 13.762266] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 13.769397] wpa_supplicant[1611]: wlo1: SME: Authentication request to the driver failed [ 14.077020] wpa_supplicant[1611]: wlo1: SME: Trying to authenticate with <BSSID-1b> (SSID='<SSID-1>' freq=2432 MHz) [ 14.139096] kernel: wlo1: [link 0] regulatory prevented using AP config, downgraded [ 14.139250] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 14.142303] wpa_supplicant[1611]: wlo1: SME: Authentication request to the driver failed 7.0.0-38-generic with upstream firmware build 20260813113118: the same sequence. Driver state while affected (7.0.0-30-generic): - "iw reg get": country CA: DFS-FCC, both global and for phy#0 - Channel flags read through nl80211: NO_EHT on 14/14 2.4 GHz, 28/28 5 GHz and 59/59 6 GHz channels; NO_HE on none - "iw phy": "EHT Iftypes: managed" is still listed in all three bands ANALYSIS (from the v7.0.12 source; the logic is the same in mainline v7.3-rc7, wireless-next and the mt76 tree) 1. mt792x_acpi_get_mtcl_conf() reads the BIOS ACPI MTCL v3 table. CA is in cc_list_be, and its 802.11be bits (4-5) are 0, so mt7925_regd_be_ctrl() sets dev->has_eht = false. The firmware's CLC BE_CTRL list is HK ZA IQ UA RU PK, without CA, so the restriction comes from the BIOS. 2. mt7925_regd_channel_update() then sets IEEE80211_CHAN_NO_EHT on every channel. 3. mt7925_init_mlo_caps() sets WIPHY_FLAG_SUPPORTS_MLO at registration, and nothing clears it. mt7925_init_eht_caps() returns early without clearing the EHT capabilities set earlier, so those stay advertised too. 4. wpa_supplicant sees MLO support and the AP's Multi-Link element, and requests an MLD authentication. 5. In mac80211, ieee80211_determine_chan_mode() lowers the mode from EHT to HE because of NO_EHT and re-parses the AP's elements without the Multi-Link element. ieee80211_prep_channel() then returns -EINVAL ("Rejecting MLO as it is not supported by AP"). 6. wpa_supplicant 2.11 has no fallback to a non-MLO connection for this case. Suggested fixes (sent upstream): mt7925 shouldn't advertise MLO or EHT while has_eht is false. mac80211 and/or wpa_supplicant should fall back to a non-MLO association when EHT can't be used on the channel. WORKAROUND Switch NetworkManager to the iwd backend. iwd 3.10 never requests MLO and connects as Wi-Fi 6 (HE, 80 MHz). sudo apt install iwd network-manager-iwd sudo systemctl mask --now wpa_supplicant /etc/iwd/main.conf (both lines were needed with this chip; the first keeps the wlo1 interface that the saved NetworkManager profiles are tied to, and the second avoids about 10% packet loss and about 380 ms latency with power save on): [DriverQuirks] DefaultInterface=mt7925e PowerSaveDisable=mt7925e /etc/NetworkManager/conf.d/90-wifi-backend-iwd.conf: [device] wifi.backend=iwd Then: sudo systemctl enable --now iwd sudo systemctl restart NetworkManager Note: with the iwd backend, NetworkManager only matched a WPA3-only (SAE) profile after its key-mgmt was changed to wpa-psk. iwd still uses SAE for it. UPSTREAM AND RELATED - Upstream report: linux-wireless@vger.kernel.org, <lore.kernel.org link> - Lenovo has been asked whether a BIOS update enables 802.11be for Canada in the MTCL table. - Related: LP: #2121342 (Enable Wi-Fi 7 MLO on MTK MT7925) - Not tested on a mainline kernel build; the relevant code is unchanged in v7.3-rc7. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-30-generic 7.0.0-30.30 ProcVersionSignature: Ubuntu 7.0.0-30.30-generic 7.0.12 Uname: Linux 7.0.0-30-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME CurrentDmesg: Error: command ['pkexec', 'dmesg'] failed with exit code 1: skipped: root access not used when collecting this report Date: Fri Oct 16 12:31:24 2026 InstallationDate: Installed on 2026-10-15 (1 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: LENOVO 83S2 ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, user) SHELL=/bin/bash XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-30-generic root=UUID=<uuid> ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) acpidump: Error: command ['pkexec', '/usr/share/apport/dump_acpi_tables.py'] failed with exit code 1: skipped: root access not used when collecting this report dmi.bios.date: 02/28/2026 dmi.bios.release: 1.13 dmi.bios.vendor: LENOVO dmi.bios.version: TGCN13WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: SDK0T76574 WIN dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: IdeaPad Slim 5 16AGP11 dmi.ec.firmware.release: 1.13 dmi.modalias: dmi:bvnLENOVO:bvrTGCN13WW:bd02/28/2026:br1.13:efr1.13:svnLENOVO:pn83S2:pvrIdeaPadSlim516AGP11:rvnLENOVO:rnLNVNB161216:rvrSDK0T76574WIN:cvnLENOVO:ct10:cvrIdeaPadSlim516AGP11:skuLENOVO_MT_83S2_BU_idea_FM_IdeaPadSlim516AGP11:pfaIdeaPadSlim516AGP11: dmi.product.family: IdeaPad Slim 5 16AGP11 dmi.product.name: 83S2 dmi.product.sku: LENOVO_MT_83S2_BU_idea_FM_IdeaPad Slim 5 16AGP11 dmi.product.version: IdeaPad Slim 5 16AGP11 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171313/+subscriptions

[Bug 2169313] Re: amdgpu: horizontal tearing/corruption in windows on RX 9070 with 7.0.0-38, not on 7.0.0-34

Corroborating datapoint on a different AMD platform (Strix Halo APU Radeon 8060s, not RX 9070): same -34 -> -38 regression window, same symptom. Hardware: BOSGAME M5 (board: Sixunited AXB35-02), AMD Ryzen AI Max+ 395, Radeon 8060S (gfx1151), DCN 3.5.1, BIOS 3.10 (2026-03-09). OS: Linux Mint 22.3 (Ubuntu 24.04 "noble" base), X11. Symptom: intermittent horizontal "purple" lines flashing randomly across both external displays (2x 2560x1440). No amdgpu errors in dmesg. Reproduces on native DisplayPort, native HDMI, and via a USB-C (DP-alt) dock. Regression window: - BAD: linux-image-7.0.0-38-generic (7.0.0-38.38~24.04.4) - GOOD: linux-image-7.0.0-34-generic (7.0.0-34.34~24.04.1) - GOOD: linux-image-6.17.0-1033-oem Booting 7.0.0-34 makes the line artifacts disappear, matching the original report. Ruled out on this machine: - memtest86+ full pass (memory) - monitors, cables and ports swapped between DP/HDMI; no change - amdgpu.dcdebugmask=0x4 (DSC disabled): no effect - amdgpu.dcdebugmask=0x84E (DSC + stutter + clock gating + MPO + IPS disabled): no effect - PSR not applicable (external displays only; sinks report PSR support 0) Happy to attach dmesg / drm debug logs from either kernel if that helps. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2169313 Title: amdgpu: horizontal tearing/corruption in windows on RX 9070 with 7.0.0-38, not on 7.0.0-34 Status in linux package in Ubuntu: Confirmed Bug description: After upgrading from 7.0.0-34 to 7.0.0-38, windows (Chrome while scrolling, Nautilus, desktop) intermittently show horizontal slicing/pixel corruption. No amdgpu errors in dmesg. Booting 7.0.0-34 makes the problem go away. GPU: RX 9070, Mesa 26.0.8, GNOME Wayland, 4K @ 120 Hz over DisplayPort, 133% scaling. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-34-generic 7.0.0-34.34 ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14 Uname: Linux 7.0.0-34-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC2: alexander 6520 F.... wireplumber /dev/snd/controlC0: alexander 6520 F.... wireplumber /dev/snd/controlC1: alexander 6520 F.... wireplumber /dev/snd/seq: alexander 6495 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Fri Oct 2 13:08:49 2026 InstallationDate: Installed on 2026-08-14 (50 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: Micro Computer (HK) Tech Limited DeskMini Series ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-34-generic root=UUID=d9b5ca69-c01b-4738-b254-a9ce7a16fc74 ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M RfKill: 0: hci0: Bluetooth Soft blocked: no Hard blocked: no SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 01/05/2026 dmi.bios.release: 5.29 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: 1.15 dmi.board.asset.tag: Default string dmi.board.name: DRFXL dmi.board.vendor: Meigao Innovation Technology (Shen Zhen) Co., Ltd dmi.board.version: 1.0 dmi.chassis.asset.tag: Default string dmi.chassis.type: 3 dmi.chassis.vendor: Default string dmi.chassis.version: Default string dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvr1.15:bd01/05/2026:br5.29:svnMicroComputer(HK)TechLimited:pnDeskMiniSeries:pvr1.0:rvnMeigaoInnovationTechnology(ShenZhen)Co.,Ltd:rnDRFXL:rvr1.0:cvnDefaultstring:ct3:cvrDefaultstring:skuMGDRFXL:pfaMINISFORUM: dmi.product.family: MINISFORUM dmi.product.name: DeskMini Series dmi.product.sku: MGDRFXL dmi.product.version: 1.0 dmi.sys.vendor: Micro Computer (HK) Tech Limited To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169313/+subscriptions

[Bug 2171313] [NEW] mt7925e can't connect to Wi-Fi 7 (MLO) access points when the BIOS disables 802.11be for the country (Canada)

Public bug reported: SUMMARY On a Lenovo IdeaPad Slim 5 16AGP11 (MediaTek MT7925, driver mt7925e) in Canada, Ubuntu 26.04 can't connect to any Wi-Fi network whose access point advertises a Wi-Fi 7 Basic Multi-Link element. The kernel refuses every authentication attempt before a single frame is sent, and wpa_supplicant never falls back to a normal (non-MLO) connection. These networks are therefore unusable. About 30 other devices connect to the same access point without trouble, including other Ubuntu laptops. This laptop connects normally to networks that don't advertise a Multi-Link element. Cause, in short: the BIOS disables 802.11be (Wi-Fi 7) for Canada in its ACPI MTCL table, so mt7925e marks every channel NO_EHT. But mt7925e still advertises MLO support (WIPHY_FLAG_SUPPORTS_MLO), and its EHT capabilities stay advertised too. wpa_supplicant therefore requests an MLO authentication. mac80211 drops the connection to HE because of NO_EHT, stops seeing the AP's Multi-Link element, and rejects the request with "Rejecting MLO as it is not supported by AP". HARDWARE AND SOFTWARE - Lenovo IdeaPad Slim 5 16AGP11, machine type 83S2, BIOS TGCN13WW (02/28/2026) - MEDIATEK MT7925 802.11be PCIe [14c3:7925], subsystem Lenovo [17aa:e0ff], driver mt7925e - Ubuntu 26.04.1 LTS - Kernels: 7.0.0-30-generic (7.0.0-30.30, upstream 7.0.12) and 7.0.0-38-generic (7.0.0-38.38, upstream 7.0.14). Both are affected. - Firmware: linux-firmware-mediatek 20260319.git217ca6e4-0ubuntu1.2 (WM firmware build 20260605184805). The newer upstream build 20260813113118 fails the same way. - wpasupplicant 2:2.11-0ubuntu5, network-manager 1.54.3-2ubuntu3.1 - Regulatory domain: CA, set by the driver ("CTRL-EVENT-REGDOM-CHANGE init=DRIVER type=COUNTRY alpha2=CA") - Access point: a Wi-Fi 7 router with a Basic Multi-Link element on every SSID. <SSID-1> is a separate single-link MLD per band (5745 MHz and 2432 MHz). <SSID-2> is one 2-link MLD (link 0 on 5745 MHz, link 1 on 2432 MHz). STEPS TO REPRODUCE 1. Use this laptop (BIOS TGCN13WW) somewhere the regulatory country becomes CA ("iw reg get" shows "country CA"). 2. With the default NetworkManager + wpa_supplicant, connect to a Wi-Fi 7 access point that advertises a Multi-Link element (an MLO SSID, or a single-link MLD). 3. Watch "journalctl -f". EXPECTED RESULT The laptop connects: with MLO if Wi-Fi 7 is allowed, otherwise as a normal non-MLO Wi-Fi 6 (HE) connection. iwd does the latter on the same machine. ACTUAL RESULT No connection. Each BSS fails within about 60 ms: the kernel logs "regulatory prevented using AP config, downgraded" and "Rejecting MLO as it is not supported by AP", then wpa_supplicant logs "SME: Authentication request to the driver failed". No authentication frame is sent. wpa_supplicant ignore-lists the BSSID, tries the next one (again with MLO), and after that temporarily disables the network. This repeats on every attempt, on both kernels and with both firmware builds. LOGS (redacted) 7.0.0-38-generic, 2-link MLD SSID: [ 259.994810] wpa_supplicant[6403]: wlo1: SME: Trying to authenticate with <BSSID-2a> (SSID='<SSID-2>' freq=5745 MHz) [ 260.060118] kernel: wlo1: [link 0] regulatory prevented using AP config, downgraded [ 260.060318] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 260.063602] wpa_supplicant[6403]: wlo1: SME: Authentication request to the driver failed [ 260.063628] wpa_supplicant[6403]: wlo1: Added BSSID <BSSID-2a> into ignore list, ignoring for 10 seconds [ 260.367503] wpa_supplicant[6403]: wlo1: SME: Trying to authenticate with <BSSID-2b> (SSID='<SSID-2>' freq=2432 MHz) [ 260.418124] kernel: wlo1: [link 1] regulatory prevented using AP config, downgraded [ 260.418326] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 260.421295] wpa_supplicant[6403]: wlo1: SME: Authentication request to the driver failed [ 260.421316] wpa_supplicant[6403]: wlo1: Added BSSID <BSSID-2b> into ignore list, ignoring for 10 seconds 7.0.0-30-generic, SSID with a single-link MLD per band: [ 4.284069] kernel: mt7925e 0000:03:00.0: WM Firmware Version: ____000000, Build Time: 20260605184805 [ 9.670529] wpa_supplicant[1611]: wlo1: CTRL-EVENT-REGDOM-CHANGE init=DRIVER type=COUNTRY alpha2=CA [ 13.698595] wpa_supplicant[1611]: wlo1: SME: Trying to authenticate with <BSSID-1a> (SSID='<SSID-1>' freq=5745 MHz) [ 13.762101] kernel: wlo1: [link 0] regulatory prevented using AP config, downgraded [ 13.762266] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 13.769397] wpa_supplicant[1611]: wlo1: SME: Authentication request to the driver failed [ 14.077020] wpa_supplicant[1611]: wlo1: SME: Trying to authenticate with <BSSID-1b> (SSID='<SSID-1>' freq=2432 MHz) [ 14.139096] kernel: wlo1: [link 0] regulatory prevented using AP config, downgraded [ 14.139250] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 14.142303] wpa_supplicant[1611]: wlo1: SME: Authentication request to the driver failed 7.0.0-38-generic with upstream firmware build 20260813113118: the same sequence. Driver state while affected (7.0.0-30-generic): - "iw reg get": country CA: DFS-FCC, both global and for phy#0 - Channel flags read through nl80211: NO_EHT on 14/14 2.4 GHz, 28/28 5 GHz and 59/59 6 GHz channels; NO_HE on none - "iw phy": "EHT Iftypes: managed" is still listed in all three bands ANALYSIS (from the v7.0.12 source; the logic is the same in mainline v7.3-rc7, wireless-next and the mt76 tree) 1. mt792x_acpi_get_mtcl_conf() reads the BIOS ACPI MTCL v3 table. CA is in cc_list_be, and its 802.11be bits (4-5) are 0, so mt7925_regd_be_ctrl() sets dev->has_eht = false. The firmware's CLC BE_CTRL list is HK ZA IQ UA RU PK, without CA, so the restriction comes from the BIOS. 2. mt7925_regd_channel_update() then sets IEEE80211_CHAN_NO_EHT on every channel. 3. mt7925_init_mlo_caps() sets WIPHY_FLAG_SUPPORTS_MLO at registration, and nothing clears it. mt7925_init_eht_caps() returns early without clearing the EHT capabilities set earlier, so those stay advertised too. 4. wpa_supplicant sees MLO support and the AP's Multi-Link element, and requests an MLD authentication. 5. In mac80211, ieee80211_determine_chan_mode() lowers the mode from EHT to HE because of NO_EHT and re-parses the AP's elements without the Multi-Link element. ieee80211_prep_channel() then returns -EINVAL ("Rejecting MLO as it is not supported by AP"). 6. wpa_supplicant 2.11 has no fallback to a non-MLO connection for this case. Suggested fixes (sent upstream): mt7925 shouldn't advertise MLO or EHT while has_eht is false. mac80211 and/or wpa_supplicant should fall back to a non-MLO association when EHT can't be used on the channel. WORKAROUND Switch NetworkManager to the iwd backend. iwd 3.10 never requests MLO and connects as Wi-Fi 6 (HE, 80 MHz). sudo apt install iwd network-manager-iwd sudo systemctl mask --now wpa_supplicant /etc/iwd/main.conf (both lines were needed with this chip; the first keeps the wlo1 interface that the saved NetworkManager profiles are tied to, and the second avoids about 10% packet loss and about 380 ms latency with power save on): [DriverQuirks] DefaultInterface=mt7925e PowerSaveDisable=mt7925e /etc/NetworkManager/conf.d/90-wifi-backend-iwd.conf: [device] wifi.backend=iwd Then: sudo systemctl enable --now iwd sudo systemctl restart NetworkManager Note: with the iwd backend, NetworkManager only matched a WPA3-only (SAE) profile after its key-mgmt was changed to wpa-psk. iwd still uses SAE for it. UPSTREAM AND RELATED - Upstream report: linux-wireless@vger.kernel.org, <lore.kernel.org link> - Lenovo has been asked whether a BIOS update enables 802.11be for Canada in the MTCL table. - Related: LP: #2121342 (Enable Wi-Fi 7 MLO on MTK MT7925) - Not tested on a mainline kernel build; the relevant code is unchanged in v7.3-rc7. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-30-generic 7.0.0-30.30 ProcVersionSignature: Ubuntu 7.0.0-30.30-generic 7.0.12 Uname: Linux 7.0.0-30-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME CurrentDmesg: Error: command ['pkexec', 'dmesg'] failed with exit code 1: skipped: root access not used when collecting this report Date: Fri Oct 16 12:31:24 2026 InstallationDate: Installed on 2026-10-15 (1 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: LENOVO 83S2 ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, user) SHELL=/bin/bash XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-30-generic root=UUID=<uuid> ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) acpidump: Error: command ['pkexec', '/usr/share/apport/dump_acpi_tables.py'] failed with exit code 1: skipped: root access not used when collecting this report dmi.bios.date: 02/28/2026 dmi.bios.release: 1.13 dmi.bios.vendor: LENOVO dmi.bios.version: TGCN13WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: SDK0T76574 WIN dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: IdeaPad Slim 5 16AGP11 dmi.ec.firmware.release: 1.13 dmi.modalias: dmi:bvnLENOVO:bvrTGCN13WW:bd02/28/2026:br1.13:efr1.13:svnLENOVO:pn83S2:pvrIdeaPadSlim516AGP11:rvnLENOVO:rnLNVNB161216:rvrSDK0T76574WIN:cvnLENOVO:ct10:cvrIdeaPadSlim516AGP11:skuLENOVO_MT_83S2_BU_idea_FM_IdeaPadSlim516AGP11:pfaIdeaPadSlim516AGP11: dmi.product.family: IdeaPad Slim 5 16AGP11 dmi.product.name: 83S2 dmi.product.sku: LENOVO_MT_83S2_BU_idea_FM_IdeaPad Slim 5 16AGP11 dmi.product.version: IdeaPad Slim 5 16AGP11 dmi.sys.vendor: LENOVO ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute wayland-session -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171313 Title: mt7925e can't connect to Wi-Fi 7 (MLO) access points when the BIOS disables 802.11be for the country (Canada) Status in linux package in Ubuntu: New Bug description: SUMMARY On a Lenovo IdeaPad Slim 5 16AGP11 (MediaTek MT7925, driver mt7925e) in Canada, Ubuntu 26.04 can't connect to any Wi-Fi network whose access point advertises a Wi-Fi 7 Basic Multi-Link element. The kernel refuses every authentication attempt before a single frame is sent, and wpa_supplicant never falls back to a normal (non-MLO) connection. These networks are therefore unusable. About 30 other devices connect to the same access point without trouble, including other Ubuntu laptops. This laptop connects normally to networks that don't advertise a Multi-Link element. Cause, in short: the BIOS disables 802.11be (Wi-Fi 7) for Canada in its ACPI MTCL table, so mt7925e marks every channel NO_EHT. But mt7925e still advertises MLO support (WIPHY_FLAG_SUPPORTS_MLO), and its EHT capabilities stay advertised too. wpa_supplicant therefore requests an MLO authentication. mac80211 drops the connection to HE because of NO_EHT, stops seeing the AP's Multi-Link element, and rejects the request with "Rejecting MLO as it is not supported by AP". HARDWARE AND SOFTWARE - Lenovo IdeaPad Slim 5 16AGP11, machine type 83S2, BIOS TGCN13WW (02/28/2026) - MEDIATEK MT7925 802.11be PCIe [14c3:7925], subsystem Lenovo [17aa:e0ff], driver mt7925e - Ubuntu 26.04.1 LTS - Kernels: 7.0.0-30-generic (7.0.0-30.30, upstream 7.0.12) and 7.0.0-38-generic (7.0.0-38.38, upstream 7.0.14). Both are affected. - Firmware: linux-firmware-mediatek 20260319.git217ca6e4-0ubuntu1.2 (WM firmware build 20260605184805). The newer upstream build 20260813113118 fails the same way. - wpasupplicant 2:2.11-0ubuntu5, network-manager 1.54.3-2ubuntu3.1 - Regulatory domain: CA, set by the driver ("CTRL-EVENT-REGDOM-CHANGE init=DRIVER type=COUNTRY alpha2=CA") - Access point: a Wi-Fi 7 router with a Basic Multi-Link element on every SSID. <SSID-1> is a separate single-link MLD per band (5745 MHz and 2432 MHz). <SSID-2> is one 2-link MLD (link 0 on 5745 MHz, link 1 on 2432 MHz). STEPS TO REPRODUCE 1. Use this laptop (BIOS TGCN13WW) somewhere the regulatory country becomes CA ("iw reg get" shows "country CA"). 2. With the default NetworkManager + wpa_supplicant, connect to a Wi-Fi 7 access point that advertises a Multi-Link element (an MLO SSID, or a single-link MLD). 3. Watch "journalctl -f". EXPECTED RESULT The laptop connects: with MLO if Wi-Fi 7 is allowed, otherwise as a normal non-MLO Wi-Fi 6 (HE) connection. iwd does the latter on the same machine. ACTUAL RESULT No connection. Each BSS fails within about 60 ms: the kernel logs "regulatory prevented using AP config, downgraded" and "Rejecting MLO as it is not supported by AP", then wpa_supplicant logs "SME: Authentication request to the driver failed". No authentication frame is sent. wpa_supplicant ignore-lists the BSSID, tries the next one (again with MLO), and after that temporarily disables the network. This repeats on every attempt, on both kernels and with both firmware builds. LOGS (redacted) 7.0.0-38-generic, 2-link MLD SSID: [ 259.994810] wpa_supplicant[6403]: wlo1: SME: Trying to authenticate with <BSSID-2a> (SSID='<SSID-2>' freq=5745 MHz) [ 260.060118] kernel: wlo1: [link 0] regulatory prevented using AP config, downgraded [ 260.060318] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 260.063602] wpa_supplicant[6403]: wlo1: SME: Authentication request to the driver failed [ 260.063628] wpa_supplicant[6403]: wlo1: Added BSSID <BSSID-2a> into ignore list, ignoring for 10 seconds [ 260.367503] wpa_supplicant[6403]: wlo1: SME: Trying to authenticate with <BSSID-2b> (SSID='<SSID-2>' freq=2432 MHz) [ 260.418124] kernel: wlo1: [link 1] regulatory prevented using AP config, downgraded [ 260.418326] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 260.421295] wpa_supplicant[6403]: wlo1: SME: Authentication request to the driver failed [ 260.421316] wpa_supplicant[6403]: wlo1: Added BSSID <BSSID-2b> into ignore list, ignoring for 10 seconds 7.0.0-30-generic, SSID with a single-link MLD per band: [ 4.284069] kernel: mt7925e 0000:03:00.0: WM Firmware Version: ____000000, Build Time: 20260605184805 [ 9.670529] wpa_supplicant[1611]: wlo1: CTRL-EVENT-REGDOM-CHANGE init=DRIVER type=COUNTRY alpha2=CA [ 13.698595] wpa_supplicant[1611]: wlo1: SME: Trying to authenticate with <BSSID-1a> (SSID='<SSID-1>' freq=5745 MHz) [ 13.762101] kernel: wlo1: [link 0] regulatory prevented using AP config, downgraded [ 13.762266] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 13.769397] wpa_supplicant[1611]: wlo1: SME: Authentication request to the driver failed [ 14.077020] wpa_supplicant[1611]: wlo1: SME: Trying to authenticate with <BSSID-1b> (SSID='<SSID-1>' freq=2432 MHz) [ 14.139096] kernel: wlo1: [link 0] regulatory prevented using AP config, downgraded [ 14.139250] kernel: wlo1: Rejecting MLO as it is not supported by AP [ 14.142303] wpa_supplicant[1611]: wlo1: SME: Authentication request to the driver failed 7.0.0-38-generic with upstream firmware build 20260813113118: the same sequence. Driver state while affected (7.0.0-30-generic): - "iw reg get": country CA: DFS-FCC, both global and for phy#0 - Channel flags read through nl80211: NO_EHT on 14/14 2.4 GHz, 28/28 5 GHz and 59/59 6 GHz channels; NO_HE on none - "iw phy": "EHT Iftypes: managed" is still listed in all three bands ANALYSIS (from the v7.0.12 source; the logic is the same in mainline v7.3-rc7, wireless-next and the mt76 tree) 1. mt792x_acpi_get_mtcl_conf() reads the BIOS ACPI MTCL v3 table. CA is in cc_list_be, and its 802.11be bits (4-5) are 0, so mt7925_regd_be_ctrl() sets dev->has_eht = false. The firmware's CLC BE_CTRL list is HK ZA IQ UA RU PK, without CA, so the restriction comes from the BIOS. 2. mt7925_regd_channel_update() then sets IEEE80211_CHAN_NO_EHT on every channel. 3. mt7925_init_mlo_caps() sets WIPHY_FLAG_SUPPORTS_MLO at registration, and nothing clears it. mt7925_init_eht_caps() returns early without clearing the EHT capabilities set earlier, so those stay advertised too. 4. wpa_supplicant sees MLO support and the AP's Multi-Link element, and requests an MLD authentication. 5. In mac80211, ieee80211_determine_chan_mode() lowers the mode from EHT to HE because of NO_EHT and re-parses the AP's elements without the Multi-Link element. ieee80211_prep_channel() then returns -EINVAL ("Rejecting MLO as it is not supported by AP"). 6. wpa_supplicant 2.11 has no fallback to a non-MLO connection for this case. Suggested fixes (sent upstream): mt7925 shouldn't advertise MLO or EHT while has_eht is false. mac80211 and/or wpa_supplicant should fall back to a non-MLO association when EHT can't be used on the channel. WORKAROUND Switch NetworkManager to the iwd backend. iwd 3.10 never requests MLO and connects as Wi-Fi 6 (HE, 80 MHz). sudo apt install iwd network-manager-iwd sudo systemctl mask --now wpa_supplicant /etc/iwd/main.conf (both lines were needed with this chip; the first keeps the wlo1 interface that the saved NetworkManager profiles are tied to, and the second avoids about 10% packet loss and about 380 ms latency with power save on): [DriverQuirks] DefaultInterface=mt7925e PowerSaveDisable=mt7925e /etc/NetworkManager/conf.d/90-wifi-backend-iwd.conf: [device] wifi.backend=iwd Then: sudo systemctl enable --now iwd sudo systemctl restart NetworkManager Note: with the iwd backend, NetworkManager only matched a WPA3-only (SAE) profile after its key-mgmt was changed to wpa-psk. iwd still uses SAE for it. UPSTREAM AND RELATED - Upstream report: linux-wireless@vger.kernel.org, <lore.kernel.org link> - Lenovo has been asked whether a BIOS update enables 802.11be for Canada in the MTCL table. - Related: LP: #2121342 (Enable Wi-Fi 7 MLO on MTK MT7925) - Not tested on a mainline kernel build; the relevant code is unchanged in v7.3-rc7. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-30-generic 7.0.0-30.30 ProcVersionSignature: Ubuntu 7.0.0-30.30-generic 7.0.12 Uname: Linux 7.0.0-30-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME CurrentDmesg: Error: command ['pkexec', 'dmesg'] failed with exit code 1: skipped: root access not used when collecting this report Date: Fri Oct 16 12:31:24 2026 InstallationDate: Installed on 2026-10-15 (1 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: LENOVO 83S2 ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, user) SHELL=/bin/bash XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-30-generic root=UUID=<uuid> ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) acpidump: Error: command ['pkexec', '/usr/share/apport/dump_acpi_tables.py'] failed with exit code 1: skipped: root access not used when collecting this report dmi.bios.date: 02/28/2026 dmi.bios.release: 1.13 dmi.bios.vendor: LENOVO dmi.bios.version: TGCN13WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: SDK0T76574 WIN dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: IdeaPad Slim 5 16AGP11 dmi.ec.firmware.release: 1.13 dmi.modalias: dmi:bvnLENOVO:bvrTGCN13WW:bd02/28/2026:br1.13:efr1.13:svnLENOVO:pn83S2:pvrIdeaPadSlim516AGP11:rvnLENOVO:rnLNVNB161216:rvrSDK0T76574WIN:cvnLENOVO:ct10:cvrIdeaPadSlim516AGP11:skuLENOVO_MT_83S2_BU_idea_FM_IdeaPadSlim516AGP11:pfaIdeaPadSlim516AGP11: dmi.product.family: IdeaPad Slim 5 16AGP11 dmi.product.name: 83S2 dmi.product.sku: LENOVO_MT_83S2_BU_idea_FM_IdeaPad Slim 5 16AGP11 dmi.product.version: IdeaPad Slim 5 16AGP11 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171313/+subscriptions