Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #65455 > unrolled thread

Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec")

Back to article view | Back to linux.debian.kernel

Contents

  Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Josh Triplett <josh@joshtriplett.org> - 2019-10-22 21:00 +0200
    Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Tomas Janousek <tomi@nomi.cz> - 2019-10-23 00:20 +0200
      Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Tomas Janousek <tomi@nomi.cz> - 2019-10-23 09:40 +0200
        Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Tomas Janousek <tomi@nomi.cz> - 2019-10-23 17:30 +0200
          Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Ben Hutchings <ben@decadent.org.uk> - 2019-10-25 04:00 +0200
            Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Ansgar <ansgar@43-1.org> - 2019-10-25 09:50 +0200
              Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Tomas Janousek <tomi@nomi.cz> - 2019-10-25 10:00 +0200
                Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Ansgar <ansgar@43-1.org> - 2019-10-25 11:10 +0200
                  Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Tomas Janousek <tomi@nomi.cz> - 2019-10-25 11:30 +0200
                    Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Ansgar <ansgar@43-1.org> - 2019-10-25 12:00 +0200
            Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Ansgar Burchardt <ansgar@debian.org> - 2019-10-25 10:30 +0200
              Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec") Ben Hutchings <ben@decadent.org.uk> - 2019-10-25 15:20 +0200
    Bug#942881: Confirming bug on Dell XPS 13 9360R Wilhelm Westermark <wilhelm@westermark.org> - 2019-10-23 01:20 +0200

#65455 — Bug#942881: Audio on Lenovo X1 Carbon 5th generation stopped working after upgrade to linux-image-5.3.0-1-amd64 ("No response from codec")

Package: src:linux
Version: 5.3.7-1
Severity: normal

After upgrading to linux-image-5.3.0-1-amd64, I get messages like those
seen in the log ("No response from codec, resetting bus" and "Unable to
sync register"), and eventually a WARN. The mixer doesn't show the audio
device at all.

This didn't happen with the previous kernel, namely:
Oct 21 21:04:28 s kernel: Linux version 5.2.0-3-amd64 (debian-kernel@lists.debian.org) (gcc version 8.3.0 (Debian 8.3.0-23)) #1 SMP Debian 5.2.17-1 (2019-10-06)

-- Package-specific info:
** Version:
Linux version 5.3.0-1-amd64 (debian-kernel@lists.debian.org) (gcc version 9.2.1 20191008 (Debian 9.2.1-9)) #1 SMP Debian 5.3.7-1 (2019-10-19)

** Command line:
BOOT_IMAGE=/vmlinuz-5.3.0-1-amd64 root=UUID=121586a4-bf8c-49a4-9a72-ed70fcf72772 ro quiet

** Tainted: W (512)
 * Taint on warning.

** Kernel log:
[   59.442968] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20170500
[   60.448988] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270500
[   61.454722] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370500
[   62.460306] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x201f0500
[   63.493654] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20170500
[   64.498615] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270500
[   65.507773] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370500
[   66.516498] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x201f0500
[   67.557305] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20170500
[   68.569978] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270500
[   69.578573] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370500
[   70.587072] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x201f0500
[   71.627548] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20170500
[   72.635462] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270500
[   73.639361] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370500
[   74.651383] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x201f0500
[   75.687274] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20170500
[   76.691051] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270500
[   77.694902] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370500
[   78.702874] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x201f0500
[   79.734778] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20170500
[   80.738684] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270500
[   81.742564] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370500
[   82.746472] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x201f0500
[   83.786414] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20170500
[   84.798403] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270500
[   85.810293] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370500
[   86.822260] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x201f0500
[   87.862207] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20170500
[   88.866163] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270500
[   89.874103] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370500
[   90.885985] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x201f0500
[   91.926013] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20170500
[   92.929911] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270500
[   93.938042] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370500
[   94.945841] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x201f0500
[   95.981858] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370740
[   96.985920] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20370740
[   97.997872] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270d80
[   97.997891] snd_hda_codec_generic hdaudioC0D2: Unable to sync register 0x2f0d00. -11
[   99.009847] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270d80
[   99.009867] snd_hda_codec_generic hdaudioC0D2: Unable to sync register 0x2f0d00. -11
[  100.013646] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x203f0900
[  101.025736] snd_hda_intel 0000:00:1f.3: No response from codec, resetting bus: last cmd=0x20270d81
[  102.033630] ------------[ cut here ]------------
[  102.033636] snd_hda_intel 0000:00:1f.3: azx_get_response timeout, switching to single_cmd mode: last cmd=0x20270d81
[  102.033713] WARNING: CPU: 3 PID: 550 at sound/pci/hda/hda_controller.c:878 azx_rirb_get_response+0x1d0/0x240 [snd_hda_codec]
[  102.033715] Modules linked in: ctr ccm fuse intel_rapl_msr intel_rapl_common iwlmvm snd_soc_skl btusb snd_soc_hdac_hda snd_hda_codec_conexant btrtl snd_hda_ext_core btbcm x86_pkg_temp_thermal mac80211 snd_hda_codec_generic intel_powerclamp btintel snd_soc_skl_ipc libarc4 coretemp snd_soc_sst_ipc bluetooth snd_soc_sst_dsp snd_soc_acpi_intel_match snd_soc_acpi uvcvideo kvm_intel snd_soc_core videobuf2_vmalloc snd_compress videobuf2_memops snd_hda_intel iwlwifi joydev kvm videobuf2_v4l2 i915 snd_hda_codec irqbypass cdc_mbim drbg videobuf2_common cdc_wdm intel_cstate cdc_ncm evdev snd_hda_core qcserial snd_hwdep iTCO_wdt intel_uncore usb_wwan ansi_cprng usbnet videodev iTCO_vendor_support ecdh_generic cfg80211 drm_kms_helper intel_rapl_perf ecc mii usbserial rmi_smbus serio_raw mc rtsx_pci_ms snd_pcm wmi_bmof intel_wmi_thunderbolt rmi_core watchdog snd_timer memstick ucsi_acpi thinkpad_acpi drm mei_me tpm_crb typec_ucsi nvram mei i2c_algo_bit ledtrig_audio intel_pch_thermal tpm_tis typec snd
[  102.033805]  tpm_tis_core soundcore ac rfkill tpm battery rng_core acpi_pad button parport_pc ppdev lp parport ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_generic dm_crypt dm_mod crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel rtsx_pci_sdmmc mmc_core aesni_intel xhci_pci xhci_hcd aes_x86_64 crypto_simd e1000e psmouse cryptd glue_helper usbcore ptp pps_core nvme rtsx_pci i2c_i801 nvme_core mfd_core usb_common wmi i2c_hid hid video
[  102.033856] CPU: 3 PID: 550 Comm: pulseaudio Not tainted 5.3.0-1-amd64 #1 Debian 5.3.7-1
[  102.033859] Hardware name: LENOVO 20HRCTO1WW/20HRCTO1WW, BIOS N1MET41W (1.26 ) 11/09/2017
[  102.033879] RIP: 0010:azx_rirb_get_response+0x1d0/0x240 [snd_hda_codec]
[  102.033884] Code: 45 8b b6 e0 03 00 00 4c 8b 6f 50 4d 85 ed 74 41 e8 65 1f 0d de 44 89 f1 4c 89 ea 48 c7 c7 88 ed c8 c0 48 89 c6 e8 be 99 bf dd <0f> 0b 41 80 8c 24 04 06 00 00 04 4c 89 e7 41 80 a4 24 50 05 00 00
[  102.033888] RSP: 0018:ffff9b75807d7ba0 EFLAGS: 00010286
[  102.033892] RAX: 0000000000000000 RBX: 0000000000000c09 RCX: 0000000000000006
[  102.033895] RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff8d7baa797680
[  102.033897] RBP: ffff8d7ba0c8647c R08: 000000000000039a R09: 0000000000000004
[  102.033900] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8d7ba0c86000
[  102.033902] R13: ffff8d7ba8b63440 R14: 0000000020270d81 R15: 0000000000000000
[  102.033907] FS:  00007f7a98983c80(0000) GS:ffff8d7baa780000(0000) knlGS:0000000000000000
[  102.033910] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  102.033912] CR2: 00007f1f200bf128 CR3: 000000022460a001 CR4: 00000000003606e0
[  102.033915] Call Trace:
[  102.033938]  snd_hdac_bus_exec_verb_unlocked+0x9c/0x180 [snd_hda_core]
[  102.033956]  codec_exec_verb+0x72/0x110 [snd_hda_codec]
[  102.033971]  hda_reg_write+0xf3/0x300 [snd_hda_core]
[  102.033982]  regmap_write+0x38/0x60
[  102.033996]  snd_hdac_regmap_write_raw+0x84/0xa0 [snd_hda_core]
[  102.034009]  snd_hdac_regmap_update_raw+0x56/0x80 [snd_hda_core]
[  102.034025]  set_dig_out+0x21/0x60 [snd_hda_codec]
[  102.034040]  snd_hda_spdif_out_switch_put+0xad/0x130 [snd_hda_codec]
[  102.034055]  snd_ctl_elem_write+0xe2/0x190 [snd]
[  102.034065]  ? __kmalloc_track_caller+0x16e/0x260
[  102.034076]  ? snd_ctl_ioctl+0x100/0x740 [snd]
[  102.034083]  ? __check_object_size+0x136/0x147
[  102.034089]  ? _copy_from_user+0x37/0x60
[  102.034099]  snd_ctl_ioctl+0x142/0x740 [snd]
[  102.034110]  do_vfs_ioctl+0x40e/0x670
[  102.034119]  ? set_close_on_exec+0x2f/0x70
[  102.034127]  ksys_ioctl+0x5e/0x90
[  102.034134]  __x64_sys_ioctl+0x16/0x20
[  102.034143]  do_syscall_64+0x53/0x140
[  102.034154]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  102.034159] RIP: 0033:0x7f7a996d65d7
[  102.034165] Code: 00 00 90 48 8b 05 b9 78 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 89 78 0c 00 f7 d8 64 89 01 48
[  102.034167] RSP: 002b:00007fffc927dcc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  102.034172] RAX: ffffffffffffffda RBX: 00005572786c9360 RCX: 00007f7a996d65d7
[  102.034174] RDX: 00005572786ca570 RSI: 00000000c4c85513 RDI: 0000000000000010
[  102.034177] RBP: 0000000000000000 R08: 00005572786c8ef0 R09: 0000000000000000
[  102.034179] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001
[  102.034181] R13: 00005572786c7730 R14: 00007f7a946ca940 R15: 0000000000000001
[  102.034187] ---[ end trace b498550a25b34f76 ]---
[  102.035387] snd_hda_codec_conexant hdaudioC0D0: Unable to sync register 0x10b8000. -5
[  102.035976] snd_hda_codec_conexant hdaudioC0D0: Unable to sync register 0x10b8000. -5
[  102.077913] snd_hda_intel 0000:00:1f.3: spurious response 0x0:0x0, last cmd=0x1120031
[  102.206444] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[  102.206444] Bluetooth: BNEP filters: protocol multicast
[  102.206448] Bluetooth: BNEP socket layer initialized
[  109.097425] azx_single_send_cmd: 75 callbacks suppressed
[  217.479450] [drm:intel_cpu_fifo_underrun_irq_handler [i915]] *ERROR* CPU pipe A FIFO underrun

** Model information
sys_vendor: LENOVO
product_name: 20HRCTO1WW
product_version: ThinkPad X1 Carbon 5th
chassis_vendor: LENOVO
chassis_version: None
bios_vendor: LENOVO
bios_version: N1MET41W (1.26 )
board_vendor: LENOVO
board_name: 20HRCTO1WW
board_version: SDK0J40709 WIN

** Loaded modules:
bnep
ctr
ccm
fuse
intel_rapl_msr
intel_rapl_common
iwlmvm
snd_soc_skl
btusb
snd_soc_hdac_hda
snd_hda_codec_conexant
btrtl
snd_hda_ext_core
btbcm
x86_pkg_temp_thermal
mac80211
snd_hda_codec_generic
intel_powerclamp
btintel
snd_soc_skl_ipc
libarc4
coretemp
snd_soc_sst_ipc
bluetooth
snd_soc_sst_dsp
snd_soc_acpi_intel_match
snd_soc_acpi
uvcvideo
kvm_intel
snd_soc_core
videobuf2_vmalloc
snd_compress
videobuf2_memops
snd_hda_intel
iwlwifi
joydev
kvm
videobuf2_v4l2
i915
snd_hda_codec
irqbypass
cdc_mbim
drbg
videobuf2_common
cdc_wdm
intel_cstate
cdc_ncm
evdev
snd_hda_core
qcserial
snd_hwdep
iTCO_wdt
intel_uncore
usb_wwan
ansi_cprng
usbnet
videodev
iTCO_vendor_support
ecdh_generic
cfg80211
drm_kms_helper
intel_rapl_perf
ecc
mii
usbserial
rmi_smbus
serio_raw
mc
rtsx_pci_ms
snd_pcm
wmi_bmof
intel_wmi_thunderbolt
rmi_core
watchdog
snd_timer
memstick
ucsi_acpi
thinkpad_acpi
drm
mei_me
tpm_crb
typec_ucsi
nvram
mei
i2c_algo_bit
ledtrig_audio
intel_pch_thermal
tpm_tis
typec
snd
tpm_tis_core
soundcore
ac
rfkill
tpm
battery
rng_core
acpi_pad
button
parport_pc
ppdev
lp
parport
ip_tables
x_tables
autofs4
ext4
crc16
mbcache
jbd2
crc32c_generic
dm_crypt
dm_mod
crct10dif_pclmul
crc32_pclmul
crc32c_intel
ghash_clmulni_intel
rtsx_pci_sdmmc
mmc_core
aesni_intel
xhci_pci
xhci_hcd
aes_x86_64
crypto_simd
e1000e
psmouse
cryptd
glue_helper
usbcore
ptp
pps_core
nvme
rtsx_pci
i2c_i801
nvme_core
mfd_core
usb_common
wmi
i2c_hid
hid
video

** PCI devices:
00:00.0 Host bridge [0600]: Intel Corporation Xeon E3-1200 v6/7th Gen Core Processor Host Bridge/DRAM Registers [8086:5904] (rev 02)
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Capabilities: <access denied>
	Kernel driver in use: skl_uncore

00:02.0 VGA compatible controller [0300]: Intel Corporation HD Graphics 620 [8086:5916] (rev 02) (prog-if 00 [VGA controller])
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 143
	Region 0: Memory at e1000000 (64-bit, non-prefetchable) [size=16M]
	Region 2: Memory at d0000000 (64-bit, prefetchable) [size=256M]
	Region 4: I/O ports at e000 [size=64]
	[virtual] Expansion ROM at 000c0000 [disabled] [size=128K]
	Capabilities: <access denied>
	Kernel driver in use: i915
	Kernel modules: i915

00:08.0 System peripheral [0880]: Intel Corporation Xeon E3-1200 v5/v6 / E3-1500 v5 / 6th/7th Gen Core Processor Gaussian Mixture Model [8086:1911]
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Interrupt: pin A routed to IRQ 255
	Region 0: Memory at e2348000 (64-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>

00:14.0 USB controller [0c03]: Intel Corporation Sunrise Point-LP USB 3.0 xHCI Controller [8086:9d2f] (rev 21) (prog-if 30 [XHCI])
	Subsystem: Lenovo Sunrise Point-LP USB 3.0 xHCI Controller [17aa:224f]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 129
	Region 0: Memory at e2320000 (64-bit, non-prefetchable) [size=64K]
	Capabilities: <access denied>
	Kernel driver in use: xhci_hcd
	Kernel modules: xhci_pci

00:14.2 Signal processing controller [1180]: Intel Corporation Sunrise Point-LP Thermal subsystem [8086:9d31] (rev 21)
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Interrupt: pin C routed to IRQ 18
	Region 0: Memory at e2349000 (64-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: intel_pch_thermal
	Kernel modules: intel_pch_thermal

00:16.0 Communication controller [0780]: Intel Corporation Sunrise Point-LP CSME HECI #1 [8086:9d3a] (rev 21)
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 134
	Region 0: Memory at e234a000 (64-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: mei_me
	Kernel modules: mei_me

00:1c.0 PCI bridge [0604]: Intel Corporation Sunrise Point-LP PCI Express Root Port #1 [8086:9d10] (rev f1) (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 122
	Bus: primary=00, secondary=02, subordinate=02, sec-latency=0
	I/O behind bridge: None
	Memory behind bridge: e2200000-e22fffff [size=1M]
	Prefetchable memory behind bridge: None
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
	BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: <access denied>
	Kernel driver in use: pcieport

00:1c.2 PCI bridge [0604]: Intel Corporation Sunrise Point-LP PCI Express Root Port #3 [8086:9d12] (rev f1) (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin C routed to IRQ 123
	Bus: primary=00, secondary=04, subordinate=04, sec-latency=0
	I/O behind bridge: None
	Memory behind bridge: e2100000-e21fffff [size=1M]
	Prefetchable memory behind bridge: None
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
	BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: <access denied>
	Kernel driver in use: pcieport

00:1c.4 PCI bridge [0604]: Intel Corporation Sunrise Point-LP PCI Express Root Port #5 [8086:9d14] (rev f1) (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 124
	Bus: primary=00, secondary=05, subordinate=05, sec-latency=0
	I/O behind bridge: None
	Memory behind bridge: e2000000-e20fffff [size=1M]
	Prefetchable memory behind bridge: None
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
	BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: <access denied>
	Kernel driver in use: pcieport

00:1d.0 PCI bridge [0604]: Intel Corporation Sunrise Point-LP PCI Express Root Port #9 [8086:9d18] (rev f1) (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 125
	Bus: primary=00, secondary=06, subordinate=70, sec-latency=0
	I/O behind bridge: 00002000-00002fff [size=4K]
	Memory behind bridge: e0000000-e01fffff [size=2M]
	Prefetchable memory behind bridge: 00000000cc800000-00000000cc9fffff [size=2M]
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
	BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: <access denied>
	Kernel driver in use: pcieport

00:1f.0 ISA bridge [0601]: Intel Corporation Sunrise Point-LP LPC Controller [8086:9d58] (rev 21)
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0

00:1f.2 Memory controller [0580]: Intel Corporation Sunrise Point-LP PMC [8086:9d21] (rev 21)
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Region 0: Memory at e2344000 (32-bit, non-prefetchable) [size=16K]

00:1f.3 Audio device [0403]: Intel Corporation Sunrise Point-LP HD Audio [8086:9d71] (rev 21)
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 64
	Interrupt: pin A routed to IRQ 16
	Region 0: Memory at e2340000 (64-bit, non-prefetchable) [size=16K]
	Region 4: Memory at e2330000 (64-bit, non-prefetchable) [size=64K]
	Capabilities: <access denied>
	Kernel driver in use: snd_hda_intel
	Kernel modules: snd_hda_intel, snd_soc_skl

00:1f.4 SMBus [0c05]: Intel Corporation Sunrise Point-LP SMBus [8086:9d23] (rev 21)
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Interrupt: pin A routed to IRQ 16
	Region 0: Memory at e234b000 (64-bit, non-prefetchable) [size=256]
	Region 4: I/O ports at efa0 [size=32]
	Kernel driver in use: i801_smbus
	Kernel modules: i2c_i801

00:1f.6 Ethernet controller [0200]: Intel Corporation Ethernet Connection (4) I219-V [8086:15d8] (rev 21)
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 128
	Region 0: Memory at e2300000 (32-bit, non-prefetchable) [size=128K]
	Capabilities: <access denied>
	Kernel driver in use: e1000e
	Kernel modules: e1000e

02:00.0 Unassigned class [ff00]: Realtek Semiconductor Co., Ltd. RTS525A PCI Express Card Reader [10ec:525a] (rev 01)
	Subsystem: Lenovo ThinkPad X1 Carbon 5th Gen [17aa:224f]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 126
	Region 1: Memory at e2200000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: rtsx_pci
	Kernel modules: rtsx_pci

04:00.0 Network controller [0280]: Intel Corporation Wireless 8265 / 8275 [8086:24fd] (rev 88)
	Subsystem: Intel Corporation Dual Band Wireless-AC 8265 [8086:1130]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 142
	Region 0: Memory at e2100000 (64-bit, non-prefetchable) [size=8K]
	Capabilities: <access denied>
	Kernel driver in use: iwlwifi
	Kernel modules: iwlwifi

05:00.0 Non-Volatile memory controller [0108]: Samsung Electronics Co Ltd NVMe SSD Controller SM961/PM961 [144d:a804] (prog-if 02 [NVM Express])
	Subsystem: Samsung Electronics Co Ltd NVMe SSD Controller SM961/PM961 [144d:a801]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 16
	NUMA node: 0
	Region 0: Memory at e2000000 (64-bit, non-prefetchable) [size=16K]
	Capabilities: <access denied>
	Kernel driver in use: nvme
	Kernel modules: nvme


** USB devices:
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 138a:0097 Validity Sensors, Inc. 
Bus 001 Device 003: ID 04f2:b5ce Chicony Electronics Co., Ltd Integrated Camera
Bus 001 Device 005: ID 1199:9079 Sierra Wireless, Inc. Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub


-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.3.0-1-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_WARN
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages linux-image-5.3.0-1-amd64 depends on:
ii  initramfs-tools [linux-initramfs-tool]  0.135
ii  kmod                                    26-3
ii  linux-base                              4.6

Versions of packages linux-image-5.3.0-1-amd64 recommends:
pn  apparmor             <none>
ii  firmware-linux-free  3.4

Versions of packages linux-image-5.3.0-1-amd64 suggests:
pn  debian-kernel-handbook  <none>
ii  grub-pc                 2.04-3
pn  linux-doc-5.3           <none>

Versions of packages linux-image-5.3.0-1-amd64 is related to:
pn  firmware-amd-graphics     <none>
pn  firmware-atheros          <none>
pn  firmware-bnx2             <none>
pn  firmware-bnx2x            <none>
pn  firmware-brcm80211        <none>
pn  firmware-cavium           <none>
pn  firmware-intel-sound      <none>
pn  firmware-intelwimax       <none>
pn  firmware-ipw2x00          <none>
pn  firmware-ivtv             <none>
ii  firmware-iwlwifi          20190502-1
pn  firmware-libertas         <none>
pn  firmware-linux-nonfree    <none>
ii  firmware-misc-nonfree     20190502-1
pn  firmware-myricom          <none>
pn  firmware-netxen           <none>
pn  firmware-qlogic           <none>
pn  firmware-realtek          <none>
pn  firmware-samsung          <none>
pn  firmware-siano            <none>
pn  firmware-ti-connectivity  <none>
pn  xen-hypervisor            <none>

-- no debconf information

[toc] | [next] | [standalone]

#65458

Hi,

On Tue, Oct 22, 2019 at 09:47:32PM +0300, Josh Triplett wrote:
> After upgrading to linux-image-5.3.0-1-amd64, I get messages like those
> seen in the log ("No response from codec, resetting bus" and "Unable to
> sync register"), and eventually a WARN. The mixer doesn't show the audio
> device at all.
> 
> This didn't happen with the previous kernel, namely:
> Oct 21 21:04:28 s kernel: Linux version 5.2.0-3-amd64 (debian-kernel@lists.debian.org) (gcc version 8.3.0 (Debian 8.3.0-23)) #1 SMP Debian 5.2.17-1 (2019-10-06)

I can confirm the same behaviour with ThinkPad T25.

There seems to be a workaround:

    options snd_hda_intel probe_mask=1

I'm not getting errors with this and audio works. I have a feeling that HDMI
audio will not work, however, because there's no "input: HDA Intel PCH HDMI"
in dmesg any more. :-(

-- 
Tomáš Janoušek, a.k.a. Pivník, a.k.a. Liskni_si, http://work.lisk.in/

[toc] | [prev] | [next] | [standalone]

#65463

Hi again,

On Tue, Oct 22, 2019 at 11:59:03PM +0200, Tomas Janousek wrote:
> There seems to be a workaround:
> 
>     options snd_hda_intel probe_mask=1
> 
> I'm not getting errors with this and audio works. I have a feeling that HDMI
> audio will not work, however, because there's no "input: HDA Intel PCH HDMI"
> in dmesg any more. :-(

We got a reply from https://bugzilla.kernel.org/show_bug.cgi?id=205293:

> Do you have HDMI HD-audio codec driver module available on your system?
> The log message (showing "Generic") indicate that it's the generic driver
> being bound, not the HDMI codec driver.

However unlikely that suggestion sounds, it's spot on:

    # modprobe snd-hda-codec-hdmi
    modprobe: ERROR: could not insert 'snd_hda_codec_hdmi': Key was rejected by service

Indeed, when I modprobe --force snd-hda-codec-hdmi and then rmmod/modprobe
snd-hda-intel, everything's fine again, including HDMI profiles.

So the new modprobe.d workaround is:

    install snd-hda-codec-hdmi /sbin/modprobe --ignore-install --force-modversion snd-hda-codec-hdmi

And there's something horribly wrong with the Debian build of modules, it
seems. I wonder what else is broken on this system because of a badly signed
module... :-/

-- 
Tomáš Janoušek, a.k.a. Pivník, a.k.a. Liskni_si, http://work.lisk.in/

[toc] | [prev] | [next] | [standalone]

#65470

Hi all,

On Wed, Oct 23, 2019 at 09:24:50AM +0200, Tomas Janousek wrote:
> And there's something horribly wrong with the Debian build of modules, it
> seems. I wonder what else is broken on this system because of a badly signed
> module... :-/

I tried to investigate what's wrong with the module signature with some help
from https://unix.stackexchange.com/a/496800/11549:

preparation (extract signing public key):

$ /tmp/modules-5.3
$ /usr/src/linux-2.6/scripts/extract-vmlinux /boot/vmlinuz-5.3.0-1-amd64 >vmlinux-5.3.0-1-amd64
$ /usr/src/linux-2.6/scripts/extract-sys-certs.pl -s /boot/System.map-5.3.0-1-amd64 /tmp/modules-5.3/vmlinux-5.3.0-1-amd64 cert.x509
$ dd if=cert.x509 bs=1 skip=$(openssl asn1parse -inform der -in cert.x509 | grep ':d=0' | tail +2 | cut -d: -f1 | xargs) of=cert2.x509

test if ./checkmodsig.pl works:

$ ./checkmodsig.pl /tmp/modules-5.3/cert2.x509 /lib/modules/5.3.0-1-amd64/kernel/sound/pci/hda/snd-hda-intel.ko
OK /lib/modules/5.3.0-1-amd64/kernel/sound/pci/hda/snd-hda-intel.ko
$ ./checkmodsig.pl /tmp/modules-5.3/cert2.x509 /lib/modules/5.3.0-1-amd64/kernel/sound/pci/hda/snd-hda-codec-hdmi.ko
RSA operation error
139736462386368:error:0407008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding:../crypto/rsa/rsa_pk1.c:66:
139736462386368:error:04067072:rsa routines:rsa_ossl_public_decrypt:padding check failed:../crypto/rsa/rsa_ossl.c:588:
status 256 at ./checkmodsig.pl line 12, <GEN6> line 1.

verify signatures manually so that we can experiment more later:

$ /usr/src/linux-2.6/scripts/extract-module-sig.pl -s /lib/modules/5.3.0-1-amd64/kernel/sound/pci/hda/snd-hda-intel.ko >snd-hda-intel.sig
Read 100988 bytes from module file
Found magic number at 100988
Found PKCS#7/CMS encapsulation
Found 396 bytes of signature [3082018806092a864886f70d010702a0]
$ openssl asn1parse -inform der -in snd-hda-intel.sig | tail -1
  136:d=5  hl=4 l= 256 prim: OCTET STRING      [HEX DUMP]:8DA6777C21575F4535E64F559B1B6399CFF0627D77CA5001D0B3124AA8435F2E767B4631DA842F989C57057F11EA0B51C65FCAEA032353520D5E3476EC1A7AF32D83D39F1652401AA5EC5B8EEE7DD663DFB4365EF9DE2C4109AE94378C3D5877AE9046DE5C54F572827403A3D7677C5DABB661789F4453F396D5D647C7233FEA3F4C21E14B7663E2D0D41564D5D220168BD3AFABC90CC451D3B1BE0F9E012B24282C52FCEB97501A42F776D4CFBDBDE8E9837DFCA380CCBD423B73522AD6C256FD91342760B71140A04BABC32E1D05EF77A1A4F031CB8A4131C0DE87AAEA2E653EBF6AE9373AC76694FD42CB622DAEDD6E4061FB865F49C94CBB22C003047F67
$ openssl asn1parse -inform der -in snd-hda-intel.sig | perl -ne '/\[HEX DUMP\]:(.*)/ && print $1' | xxd -r -p | openssl rsautl -verify -pubin -inkey pubkey2.pem -asn1parse
    0:d=0  hl=2 l=  49 cons: SEQUENCE
    2:d=1  hl=2 l=  13 cons:  SEQUENCE
    4:d=2  hl=2 l=   9 prim:   OBJECT            :sha256
   15:d=2  hl=2 l=   0 prim:   NULL
   17:d=1  hl=2 l=  32 prim:  OCTET STRING
      0000 - f2 da 77 a3 32 76 18 2b-66 a8 20 2c 07 a2 81 fb   ..w.2v.+f. ,....
      0010 - 28 a9 9e 17 c6 87 f3 d7-c1 21 f7 8a bb f0 ee 2e   (........!......

(let's skip the hash comparison, that's useless now)

same thing with snd-hda-codec-hdmi

$ /usr/src/linux-2.6/scripts/extract-module-sig.pl -s /lib/modules/5.3.0-1-amd64/kernel/sound/pci/hda/snd-hda-codec-hdmi.ko >snd-hda-codec-hdmi.sig
Read 133153 bytes from module file
Found magic number at 133153
Found PKCS#7/CMS encapsulation
Found 393 bytes of signature [3082018506092a864886f70d010702a0]
$ openssl asn1parse -inform der -in snd-hda-codec-hdmi.sig | tail -1
  136:d=5  hl=3 l= 254 prim: OCTET STRING      [HEX DUMP]:8204A68D4EDDC44A0FB89998D7D0FF2A37351C3E9A76D42C015BD868E7A579F95F95C145D61C73F3EC54B314A297DA7E9AE9CACFBD01C0E489E35A3D05F882B01FCEA25754D704F83672841416B69C52760C758A60AF2A38B5706FC02CBEA8AAB1D6F4E82B3C9F0E163B41C0F06E9DFDC166531BBB25BECBFCD3F01097C4ABD32D90A84F3F07DDE5C508F6CCD56CA5BB5467C4D70BB5AC64D432478C4454654F4D77F9DB6EC957F3A70CF818268643F84C64E49DE88624D588B6ED6CCFF2AE8DBF1D8D724BE5EBFCFCAB96E0E47B7B70553268A5BAAC41CBA8AFA8E4A65B5F229038283D99CD2A2D13931D891DF911EF298F8BDC9488E4D07A29AD810330

it's just 254 bytes, that's weird, but it's a valid asn1 and the magic string
in .ko is after that, so it's not like the .ko was trimmed or anything, it's
the actual signature that's short... let's try to verify it

$ openssl asn1parse -inform der -in snd-hda-codec-hdmi.sig | perl -ne '/\[HEX DUMP\]:(.*)/ && print $1' | xxd -r -p | openssl rsautl -verify -pubin -inkey pubkey2.pem
RSA operation error
139750929511616:error:0407008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding:../crypto/rsa/rsa_pk1.c:66:
139750929511616:error:04067072:rsa routines:rsa_ossl_public_decrypt:padding check failed:../crypto/rsa/rsa_ossl.c:588:

nope. okay, let's disable padding...

$ openssl asn1parse -inform der -in snd-hda-intel.sig | perl -ne '/\[HEX DUMP\]:(.*)/ && print $1' | xxd -r -p | openssl rsautl -verify -pubin -inkey pubkey2.pem -raw | xxd
00000000: 0001 ffff ffff ffff ffff ffff ffff ffff  ................
00000010: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000020: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000030: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000040: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000050: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000060: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000070: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000080: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000090: ffff ffff ffff ffff ffff ffff ffff ffff  ................
000000a0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
000000b0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
000000c0: ffff ffff ffff ffff ffff ffff 0030 3130  .............010
000000d0: 0d06 0960 8648 0165 0304 0201 0500 0420  ...`.H.e.......
000000e0: f2da 77a3 3276 182b 66a8 202c 07a2 81fb  ..w.2v.+f. ,....
000000f0: 28a9 9e17 c687 f3d7 c121 f78a bbf0 ee2e  (........!......

this is pkcs#1 padding and then valid asn1, now snd-hda-codec-hdmi:

$ openssl asn1parse -inform der -in snd-hda-codec-hdmi.sig | perl -ne '/\[HEX DUMP\]:(.*)/ && print $1' | xxd -r -p | openssl rsautl -verify -pubin -inkey pubkey2.pem -raw | xxd
00000000: b146 76ac 5776 8650 048c ed44 6805 7e06  .Fv.Wv.P...Dh.~.
00000010: 39cb bc02 ddf1 20a3 fa6a 8b7c 9a39 f40a  9..... ..j.|.9..
00000020: 20c5 667d bb7b 29b4 560c c8f2 08dd e483   .f}.{).V.......
00000030: 6759 9e52 c5b7 7e9a ef61 08de 57e9 a001  gY.R..~..a..W...
00000040: 774b 8fb5 e501 9a72 9ff0 ebc2 48f2 9c9b  wK.....r....H...
00000050: 8682 e2dc d0a0 2b6f c26a 06cc 87ac 03db  ......+o.j......
00000060: 5b68 5b79 5daa c4e1 891c 5ae1 d67d d1c4  [h[y].....Z..}..
00000070: 4b3c 07b9 ae0c c9bf 9b07 fdcd d4ab cb1c  K<..............
00000080: fab7 ca91 e6b2 7215 5f3d 4806 266b 6f38  ......r._=H.&ko8
00000090: 76dd 600a e4bd 665c 88c0 64a9 7a00 9d1f  v.`...f\..d.z...
000000a0: c680 90fe e979 fcce 100b 43f2 690d 8f27  .....y....C.i..'
000000b0: e17e 12ab db62 2d86 2bf4 a468 b75d 914d  .~...b-.+..h.].M
000000c0: 0b7c 6a1d d45a 9df7 9f3f 7972 8d05 873c  .|j..Z...?yr...<
000000d0: c0e9 e5b2 65ad f818 2cdb 942b 317d 3c89  ....e...,..+1}<.
000000e0: 5e67 2676 e7fe 8419 a464 9cbb b890 8d20  ^g&v.....d.....
000000f0: 63ad e66e 4b31 18ea 1dee 9d86 ccfc fc9b  c..nK1..........

random encrypted whatever :-(
but it was 2 bytes shorter, so maybe if we pad it with zeros from either side
it'll be fine... or let's just try all possible 2 byte paddings from either
side:

$ openssl asn1parse -inform der -in snd-hda-codec-hdmi.sig | perl -ne '/\[HEX DUMP\]:(.*)/ && print $1' | xxd -r -p >snd-hda-codec-hdmi.sig2
$ for i in $(seq 0 65535); do (printf "%0.4x\n" $i | xxd -r -p; cat snd-hda-codec-hdmi.sig2; ) | openssl rsautl -verify -raw -pubin -inkey pubkey2.pem | xxd -p; done | grep ffffffff
$ for i in $(seq 0 65535); do (cat snd-hda-codec-hdmi.sig2; printf "%0.4x\n" $i | xxd -r -p; ) | openssl rsautl -verify -raw -pubin -inkey pubkey2.pem | xxd -p; done | grep ffffffff

nope, that's not it

At this point I'm out of ideas. It doesn't seem to be a padding issue, and I
don't how to investigate this further. The signature, however, does seem to be
deterministic (there's no salt, just sha256 in asn1, pkcs#1 padding and the
result is encrypted using RSA), so if someone has access to the Debian Secure
Boot Signer private key, they should be able to replicate the output.

Oh and one last thing: I checked all modules in
/lib/modules/5.3.0-1-amd64/kernel using ./checkmodsig.pl and
snd-hda-codec-hdmi is the only one affected.

In /lib/modules/5.2.0-3-amd64/kernel/ everything's okay.

Uff. :-)

-- 
Tomáš Janoušek, a.k.a. Pivník, a.k.a. Liskni_si, http://work.lisk.in/

[toc] | [prev] | [next] | [standalone]

#65495

[Multipart message — attachments visible in raw view] — view raw

On Wed, 23 Oct 2019 17:24:22 +0200 Tomas Janousek <tomi@nomi.cz> wrote:
> Hi all,
> 
> On Wed, Oct 23, 2019 at 09:24:50AM +0200, Tomas Janousek wrote:
> > And there's something horribly wrong with the Debian build of modules, it
> > seems. I wonder what else is broken on this system because of a badly signed
> > module... :-/
> 
> I tried to investigate what's wrong with the module signature with some help
> from https://unix.stackexchange.com/a/496800/11549:

Thanks for taking the time to investigate this!

[...]
> $ /usr/src/linux-2.6/scripts/extract-module-sig.pl -s /lib/modules/5.3.0-1-amd64/kernel/sound/pci/hda/snd-hda-codec-hdmi.ko >snd-hda-codec-hdmi.sig
> Read 133153 bytes from module file
> Found magic number at 133153
> Found PKCS#7/CMS encapsulation
> Found 393 bytes of signature [3082018506092a864886f70d010702a0]
> $ openssl asn1parse -inform der -in snd-hda-codec-hdmi.sig | tail -1
>   136:d=5  hl=3 l= 254 prim: OCTET STRING      [HEX DUMP]:8204A68D4EDDC44A0FB89998D7D0FF2A37351C3E9A76D42C015BD868E7A579F95F95C145D61C73F3EC54B314A297DA7E9AE9CACFBD01C0E489E35A3D05F882B01FCEA25754D704F83672841416B69C52760C758A60AF2A38B5706FC02CBEA8AAB1D6F4E82B3C9F0E163B41C0F06E9DFDC166531BBB25BECBFCD3F01097C4ABD32D90A84F3F07DDE5C508F6CCD56CA5BB5467C4D70BB5AC64D432478C4454654F4D77F9DB6EC957F3A70CF818268643F84C64E49DE88624D588B6ED6CCFF2AE8DBF1D8D724BE5EBFCFCAB96E0E47B7B70553268A5BAAC41CBA8AFA8E4A65B5F229038283D99CD2A2D13931D891DF911EF298F8BDC9488E4D07A29AD810330
[...]

You can also find the detached signatures in the source package,
linux-signed-amd64.  For this module, the signature is:

debian/signatures/linux-image-5.3.0-1-amd64-unsigned/lib/modules/5.3.0-1-amd64/kernel/sound/pci/hda/snd-hda-codec-hdmi.ko.sig

and the content of that seems to match the final signed module.  So the
error occurred during creation of that source package by our code
signing service, not during the following build process.

The code signing service logs every file it signs, along with a hash of
the detached signature, but I don't know where the logs are so I can't
comapre with that.

So far as I can see, all file I/O in the code signing process is
checked so an error would cause the source package creation to fail. 
My suspicion is that something may have gone wrong in communication
with the HSM which wasn't caught by the driver.  It might be worth
adding verification to the code signing service so we can catch this if
it happens again.  We could alternately verify signatures at the point
we attach them to binaries, but that would need to be implemented in
multiple places.

Ben.

-- 
Ben Hutchings
Humans are not rational beings; they are rationalising beings.

[toc] | [prev] | [next] | [standalone]

#65497

Hi,

Ben Hutchings writes:
> You can also find the detached signatures in the source package,
> linux-signed-amd64.  For this module, the signature is:
>
> debian/signatures/linux-image-5.3.0-1-amd64-unsigned/lib/modules/5.3.0-1-amd64/kernel/sound/pci/hda/snd-hda-codec-hdmi.ko.sig

Tomas Janousek suggested in https://bugs.debian.org/942881#41 that the
file might be truncated and two bytes missing.  I think that might be
the problem, but with three bytes missing:

src:linux-signed-amd64/5.3.7+1 has for linux-image-5.3.0-1-amd64 a total
of 3568 detached signatures: one is 1378 bytes (kernel itself), then
3566 module signatures at 396 bytes each, then one module signature for
snd-hda-codec-hdmi.ko.sig which is only 393 bytes.  That is very
suspicious...

> It might be worth
> adding verification to the code signing service so we can catch this if
> it happens again.  We could alternately verify signatures at the point
> we attach them to binaries, but that would need to be implemented in
> multiple places.

Ack; validating the signatures when attaching them might notice when the
process of attaching them causes bugs, but I'm not sure how likely that
is.  But then signing stuff producing truncated files also shouldn't
happen...

Ansgar

[toc] | [prev] | [next] | [standalone]

#65498

Hi,

On Fri, Oct 25, 2019 at 09:45:55AM +0200, Ansgar wrote:
> Tomas Janousek suggested in https://bugs.debian.org/942881#41 that the
> file might be truncated and two bytes missing.  I think that might be
> the problem, but with three bytes missing:
> 
> src:linux-signed-amd64/5.3.7+1 has for linux-image-5.3.0-1-amd64 a total
> of 3568 detached signatures: one is 1378 bytes (kernel itself), then
> 3566 module signatures at 396 bytes each, then one module signature for
> snd-hda-codec-hdmi.ko.sig which is only 393 bytes.  That is very
> suspicious...

Not really. That's just the ASN.1. For 256 byte octet string, the length field
is one byte longer than for 255 or 254 bytes.

Yesterday I got one more idea: we've ruled out padding, but maybe a zero byte
in the middle would somehow get lost. So I tried all the ways one could place
two zero bytes into the 254 byte string, and got nothing.

-- 
Tomáš Janoušek, a.k.a. Pivník, a.k.a. Liskni_si, http://work.lisk.in/

[toc] | [prev] | [next] | [standalone]

#65501

Tomas Janousek writes:
> On Fri, Oct 25, 2019 at 09:45:55AM +0200, Ansgar wrote:
>> Tomas Janousek suggested in https://bugs.debian.org/942881#41 that the
>> file might be truncated and two bytes missing.  I think that might be
>> the problem, but with three bytes missing:
>> 
>> src:linux-signed-amd64/5.3.7+1 has for linux-image-5.3.0-1-amd64 a total
>> of 3568 detached signatures: one is 1378 bytes (kernel itself), then
>> 3566 module signatures at 396 bytes each, then one module signature for
>> snd-hda-codec-hdmi.ko.sig which is only 393 bytes.  That is very
>> suspicious...
>
> Not really. That's just the ASN.1. For 256 byte octet string, the length field
> is one byte longer than for 255 or 254 bytes.

Ah, I see: the asn1parse output has hl=2 vs. hl=3.

> Yesterday I got one more idea: we've ruled out padding, but maybe a zero byte
> in the middle would somehow get lost. So I tried all the ways one could place
> two zero bytes into the 254 byte string, and got nothing.

I tried running `sign-file` manually and can reproduce the truncated
file with Debian's production key.  I also tried signing the same key
with a test key instead of the production key: then the signature is 256
bytes long, just as with any other file...

`strace -e write sign-file` reports only a single call to `write()`
which writes the entire file in one go.  The return value also matches
the number of bytes asked to be written in every case.

Ansgar

[toc] | [prev] | [next] | [standalone]

#65502

Hi Ansgar,

On Fri, Oct 25, 2019 at 10:59:09AM +0200, Ansgar wrote:
> I tried running `sign-file` manually and can reproduce the truncated
> file with Debian's production key.  I also tried signing the same key
> with a test key instead of the production key: then the signature is 256
> bytes long, just as with any other file...
> 
> `strace -e write sign-file` reports only a single call to `write()`
> which writes the entire file in one go.  The return value also matches
> the number of bytes asked to be written in every case.

Cool, thanks for reproducing the issue! Just one question: when you say
production key, does that mean a hardware security module like Ben mentioned,
or can you reproduce this with a fully software implementation?

Provided the latter, that means there exists an input to sign-file that
produces an invalid (shorter) signature, and it's likely we can find another
combination of key/module that also fails, and that can be made public (as
opposed to the Debian production key). I don't have the computing resources
for this, but if we're sure the reproducer exists, someone at LKML might.

Otherwise I'm afraid you might need to dig a bit deeper. :-)

-- 
Tomáš Janoušek, a.k.a. Pivník, a.k.a. Liskni_si, http://work.lisk.in/

[toc] | [prev] | [next] | [standalone]

#65503

On Fri, 2019-10-25 at 11:21 +0200, Tomas Janousek wrote:
> Cool, thanks for reproducing the issue! Just one question: when you say
> production key, does that mean a hardware security module like Ben mentioned,
> or can you reproduce this with a fully software implementation?

The production key is on a YubiKey, i.e. a hardware security module. 
Trying with the test key (software) didn't show the problem.

> Provided the latter, that means there exists an input to sign-file that
> produces an invalid (shorter) signature, and it's likely we can find another
> combination of key/module that also fails, and that can be made public (as
> opposed to the Debian production key). I don't have the computing resources
> for this, but if we're sure the reproducer exists, someone at LKML might.
> 
> Otherwise I'm afraid you might need to dig a bit deeper. :-)

Sadly it looks like this requires more digging.  I'll try later :/

At least it is an interesting problem.

Ansgar

[toc] | [prev] | [next] | [standalone]

#65500

Ben Hutchings writes:
> The code signing service logs every file it signs, along with a hash of
> the detached signature, but I don't know where the logs are so I can't
> comapre with that.

I checked the audit log, but I don't think it will help much.  It
currently records that:

 - 2019-10-21 07:20:03.898781:
   decided to sign linux-image-5.3.0-1-amd64-unsigned_5.3.7-1_amd64/[...]/snd-hda-codec-hdmi.ko
   with sha256sum 3fe77a308b28825f0d18717e073b411246aea9bb753f76f6071b3fc4e60c6005

 - 2019-10-21 07:20:04.175379:
   signature for the file logged
   with sha256sum c2a36f35867ae92b8664f4bd2193e70370eb3b92013ea53f3573d2508d3da4cb
   (which matches snd-hda-codec-hdmi.ko.sig in src:linux-signed-amd64)

So linux' sign-file likely produced a truncated file for some reason;
note that ftp-master still uses linux-kbuild-4.9/4.9.189-3+deb9u1.

Ansgar

[toc] | [prev] | [next] | [standalone]

#65504

[Multipart message — attachments visible in raw view] — view raw

On Fri, 2019-10-25 at 10:22 +0200, Ansgar Burchardt wrote:
> Ben Hutchings writes:
> > The code signing service logs every file it signs, along with a hash of
> > the detached signature, but I don't know where the logs are so I can't
> > comapre with that.
> 
> I checked the audit log, but I don't think it will help much.  It
> currently records that:
> 
>  - 2019-10-21 07:20:03.898781:
>    decided to sign linux-image-5.3.0-1-amd64-unsigned_5.3.7-1_amd64/[...]/snd-hda-codec-hdmi.ko
>    with sha256sum 3fe77a308b28825f0d18717e073b411246aea9bb753f76f6071b3fc4e60c6005
> 
>  - 2019-10-21 07:20:04.175379:
>    signature for the file logged
>    with sha256sum c2a36f35867ae92b8664f4bd2193e70370eb3b92013ea53f3573d2508d3da4cb
>    (which matches snd-hda-codec-hdmi.ko.sig in src:linux-signed-amd64)

Thanks.

> So linux' sign-file likely produced a truncated file for some reason;
> note that ftp-master still uses linux-kbuild-4.9/4.9.189-3+deb9u1.

sign-file has only changed very slightly since then, and the changes
don't affect its use of OpenSSL.  So this version should still be fine.

Ben.

-- 
Ben Hutchings
Humans are not rational beings; they are rationalising beings.

[toc] | [prev] | [next] | [standalone]

#65461 — Bug#942881: Confirming bug on Dell XPS 13 9360R

Can confirm that this bug affects more people. Same symptoms and same 
message in syslog

Platform: Dell XPS 13 9360R running the same kernel

Can be reverted by shutting down and booting in to an older kernel 
(5.2.17-1+b1)

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web