Regression: Kernel Update in 16.04 from last days renders nvidia driver unusable

[Benjamin Geese]

I am running Ubuntu 16.04 since at least four months, always with the nvidia proprietary drivers (installed from the repository). I used nvidia-361 for a while with no issues (and i need it for steam gaming). However, an update installed on my machine yesterday breaks the nvidia drivers. I tried purging the driver, rebooting and reinstalling and i tried a newer version for the ubuntu-drivers ppa. Nothing helps: With the nvidia driver installed, i get a low-resolution login screen, but cannot login due to missing 3d acceleration. Running on nouveau works fine.

This seems very strange to since everything worked until this afternoon. Yesterday, i was happily playing games on steam, installed some updates and now, my graphics are broken.

$ lspci | grep NVIDIA
01:00.0 VGA compatible controller: NVIDIA Corporation GM107 [GeForce GTX 750] (rev a2)
01:00.1 Audio device: NVIDIA Corporation Device 0fbc (rev a1)

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: xorg 1:7.7+13ubuntu3
ProcVersionSignature: Ubuntu 4.4.0-21.37-generic 4.4.6
Uname: Linux 4.4.0-21-generic x86_64
.tmp.unity_support_test.0:

ApportVersion: 2.20.1-0ubuntu2
Architecture: amd64
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CompositorRunning: compiz
CompositorUnredirectDriverBlacklist: '(nouveau|Intel).*Mesa 8.0'
CompositorUnredirectFSW: true
Date: Mon Apr 25 17:45:12 2016
DistUpgraded: 2016-03-11 21:34:38,175 DEBUG enabling apt cron job
DistroCodename: xenial
DistroVariant: ubuntu
DkmsStatus:
 bbswitch, 0.8, 4.4.0-21-generic, x86_64: installed
 virtualbox, 5.0.18, 4.4.0-18-generic, x86_64: installed
 virtualbox, 5.0.18, 4.4.0-21-generic, x86_64: installed
EcryptfsInUse: Yes
ExtraDebuggingInterest: Yes, if not too technical
GraphicsCard:
 NVIDIA Corporation GM107 [GeForce GTX 750] [10de:1381] (rev a2) (prog-if 00 [VGA controller])
   Subsystem: Palit Microsystems Inc. GM107 [GeForce GTX 750] [1569:1381]
InstallationDate: Installed on 2016-01-05 (110 days ago)
InstallationMedia: Ubuntu 15.10 "Wily Werewolf" - Release amd64 (20151021)
MachineType: To Be Filled By O.E.M. To Be Filled By O.E.M.
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.4.0-21-generic.efi.signed root=UUID=ed669b2d-c3af-4570-9eb7-2978557208ae ro quiet splash vt.handoff=7
SourcePackage: xorg
Symptom: display
Title: Xorg crash
UpgradeStatus: Upgraded to xenial on 2016-03-11 (44 days ago)
dmi.bios.date: 05/18/2015
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: P2.30
dmi.board.name: H97 Performance
dmi.board.vendor: ASRock
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: To Be Filled By O.E.M.
dmi.chassis.version: To Be Filled By O.E.M.
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrP2.30:bd05/18/2015:svnToBeFilledByO.E.M.:pnToBeFilledByO.E.M.:pvrToBeFilledByO.E.M.:rvnASRock:rnH97Performance:rvr:cvnToBeFilledByO.E.M.:ct3:cvrToBeFilledByO.E.M.:
dmi.product.name: To Be Filled By O.E.M.
dmi.product.version: To Be Filled By O.E.M.
dmi.sys.vendor: To Be Filled By O.E.M.
version.compiz: compiz 1:0.9.12.2+16.04.20160415-0ubuntu1
version.ia32-libs: ia32-libs N/A
version.libdrm2: libdrm2 2.4.67-1
version.libgl1-mesa-dri: libgl1-mesa-dri 11.2.0-1ubuntu2
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 11.2.0-1ubuntu2
version.xserver-xorg-core: xserver-xorg-core 2:1.18.3-1ubuntu2
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.10.1-1ubuntu2
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:7.7.0-1
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.99.917+git20160325-1ubuntu1
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:1.0.12-1build2
xserver.bootTime: Mon Apr 25 17:44:29 2016
xserver.configfile: default
xserver.logfile: /var/log/Xorg.0.log
xserver.version: 2:1.18.3-1ubuntu2
xserver.video_driver: modeset

[Benjamin Geese (ben-8409)]

It seems to be related to this update, i suspect the kernel update:
$ less /var/log/apt/history.log | grep 'Start-Date: 2016-04-24' --after 5
Start-Date: 2016-04-24 15:25:07
Commandline: apt full-upgrade
Requested-By: benjamin (1000)
Install: linux-signed-image-4.4.0-21-generic:amd64 (4.4.0-21.37, automatic), linux-image-4.4.0-21-generic:amd64 (4.4.0-21.37, automatic), linux-image-extra-4.4.0-21-generic:amd64 (4.4.0-21.37, automatic), linux-headers-4.4.0-21:amd64 (4.4.0-21.37, automatic), linux-headers-4.4.0-21-generic:amd64 (4.4.0-21.37, automatic), ubuntu-software:amd64 (3.20.1+git20160420.1.ca63436.ubuntu-xenial-0ubuntu2, automatic), fwupdate-signed:amd64 (1.11+0.5-2ubuntu4, automatic)
Upgrade: libsemanage1:amd64 (2.3-1build2, 2.3-1build3), linux-headers-generic:amd64 (4.4.0.18.19, 4.4.0.21.22), linux-libc-dev:amd64 (4.4.0-18.34, 4.4.0-21.37), libgrilo-0.2-1:amd64 (0.2.14-1, 0.2.15-1), appstream:amd64 (0.9.3-1, 0.9.4-1), imagemagick:amd64 (8:6.8.9.9-7ubuntu4, 8:6.8.9.9-7ubuntu5), onboard:amd64 (1.2.0-0ubuntu4, 1.2.0-0ubuntu5), linux-image-generic:amd64 (4.4.0.18.19, 4.4.0.21.22), snapd:amd64 (2.0.1, 2.0.2), libmagickwand-6.q16-2:amd64 (8:6.8.9.9-7ubuntu4, 8:6.8.9.9-7ubuntu5), linux-signed-image-generic:amd64 (4.4.0.18.19, 4.4.0.21.22), gnome-software:amd64 (3.20.1+git20160415.1.9c08d97.ubuntu-xenial-0ubuntu1, 3.20.1+git20160420.1.ca63436.ubuntu-xenial-0ubuntu2), ubuntu-standard:amd64 (1.360, 1.361), console-setup-linux:amd64 (1.108ubuntu14, 1.108ubuntu15), ubuntu-desktop:amd64 (1.360, 1.361), virtualbox-dkms:amd64 (5.0.16-dfsg-3, 5.0.18-dfsg-2build1), console-setup:amd64 (1.108ubuntu14, 1.108ubuntu15), example-content:amd64 (48, 49), grilo-plugins-0.2-base:amd64 (0.2.17-0ubuntu1, 0.2.17-0ubuntu2), virtualbox:amd64 (5.0.16-dfsg-3, 5.0.18-dfsg-2build1), linux-signed-generic:amd64 (4.4.0.18.19, 4.4.0.21.22), libsemanage-common:amd64 (2.3-1build2, 2.3-1build3), ubuntu-minimal:amd64 (1.360, 1.361), cups-filters:amd64 (1.8.3-2ubuntu2, 1.8.3-2ubuntu3), imagemagick-6.q16:amd64 (8:6.8.9.9-7ubuntu4, 8:6.8.9.9-7ubuntu5), libcupsfilters1:amd64 (1.8.3-2ubuntu2, 1.8.3-2ubuntu3), liblz4-1:amd64 (0.0~r131-2, 0.0~r131-2ubuntu2), libfontembed1:amd64 (1.8.3-2ubuntu2, 1.8.3-2ubuntu3), libmagickcore-6.q16-2:amd64 (8:6.8.9.9-7ubuntu4, 8:6.8.9.9-7ubuntu5), keyboard-configuration:amd64 (1.108ubuntu14, 1.108ubuntu15), software-center:amd64 (16.01+16.04.20160217, 16.01+16.04.20160420), cups-filters-core-drivers:amd64 (1.8.3-2ubuntu2, 1.8.3-2ubuntu3), ubuntu-snappy-cli:amd64 (2.0.1, 2.0.2), virtualbox-qt:amd64 (5.0.16-dfsg-3, 5.0.18-dfsg-2build1), imagemagick-common:amd64 (8:6.8.9.9-7ubuntu4, 8:6.8.9.9-7ubuntu5), gnome-user-share:amd64 (3.14.2-2ubuntu3, 3.14.2-2ubuntu4), libappstream3:amd64 (0.9.3-1, 0.9.4-1), accountsservice:amd64 (0.6.40-2ubuntu9, 0.6.40-2ubuntu10), onboard-data:amd64 (1.2.0-0ubuntu4, 1.2.0-0ubuntu5), gnome-software-common:amd64 (3.20.1+git20160415.1.9c08d97.ubuntu-xenial-0ubuntu1, 3.20.1+git20160420.1.ca63436.ubuntu-xenial-0ubuntu2), linux-generic:amd64 (4.4.0.18.19, 4.4.0.21.22), libaccountsservice0:amd64 (0.6.40-2ubuntu9, 0.6.40-2ubuntu10), cups-browsed:amd64 (1.8.3-2ubuntu2, 1.8.3-2ubuntu3), tzdata:amd64 (2016c-1, 2016d-0ubuntu0.16.04)
End-Da...

[Brad Figg (brad-figg)]

This change was made by a bot.

[Andy Whitcroft (apw)]

What does a manual "modprobe nvidia" (or whatever the failing driver is called) say.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Johnny Arthur (ubuntu-hwbqs69)]

I just upgraded to 16.04 and can't log in any longer with the latest (default) kernel 4.4.0-21. If i select an older kernel (4.2.0-35) everything works fine. Trying to load nvidia drivers manually say something like 'required key missing' (i would have to reboot with the latest kernel to see the exact wording however).

[Johnny Arthur (ubuntu-hwbqs69)]

The problem seems to be due to uefi secure boot option now checking also the keys of modules, which the nvidia driver obviously does not provide. Disabling secure boot solved the problem for me, but completely disabling it just because there is no signature for the nvidia driver seems to be a really bad option!
Shouldn't there be an option to install signatures for third party drivers, that are supported (nvidia, virtualbox etc)?
I think this bug rather affects the package 'shim'...

[Tim Gardner (timg-tpi)]

Here is a rough example for how to support 3rd party modules in a secure boot environment. Note that you have to have Xenial linux 4.4.0-22.38 or better.

https://docs.google.com/document/d/1Z1_jR3MmxuvqolQH4PORkJCgENkb2Tlw4FVA-sHqdMw

[Johnny Arthur (ubuntu-hwbqs69)]

Thank you for this description. But it seems to be rather complicated for a normal desktop user, who has been locked out from his system after the upgrade to 16.04 (unity refuses to start without 3D-Acceleration!). Couldn't this be done automatically for modules installed as ubuntu packages?

[Tim Gardner (timg-tpi)]

That is the goal. I'm surprised that you didn't get a dialog on upgrade that requested a decision on secure boot mode. You might if you remove and reinstall the nVidia driver.

[Johnny Arthur (ubuntu-hwbqs69)]

First of all, thank you for your fast response! It is amazing!

Yes, there was a question about secure boot, but - just as other users who experienced the same problem - I was not aware about the significant change in the handling of secure boot and the consequences thereof. Formerly Ubuntu worked with secure boot enabled, hence I saw no reason to disable it. There was some explanation about 3rd-Party-modules on that dialog, yes, but because I do not use any other sources other than those provided by Ubuntu, I didn't feel concerned. Maybe the German translation is even more misleading (however I do not recall the exact wording of the dialog on upgrade), because the section in the control panel is called "Zusätzlich Treiber" and it mentions "Proprietäre Treiber" in the text in the control panel, but not 3rd Party Software, what I think was the term used on the upgrade dialog (though I am not quite sure about that). And since everything worked when I selected the older Kernel 4.2.0-35 I did not think about this at all any longer :-( and it took quite a while to figure out the reason of the problem...

If those modules get signed automatically in the future, this will help a lot... Maybe meanwhile the Dialog on Upgrade could be made a little bit more clear about the problems and that those using nvidia drivers will not be able to log in after upgrade?

I uninstalled nvidia, booted with secure boot enabled and installed nvidia again (using the control panel -> "Zusätzliche Treiber" = "additional drivers"), but there was no message about secure boot there. After reboot I couldn't log in again as expected.

For me it is ok now that I know the reason. But I think a lot of people might run into severe troubles...

[morryis (morryis)]

This bug should be mentioned in the release notes

[Tuomas Lähteenmäki (lahtis)]

I have similar big problem with kernel and latest nvidia drivers but i do not secure boot in my machine. When Ubuntu install new kernel and boot. nvidia drivers not loaded in kernel. And system crashing.

Error! Could not locate dkms.conf file.
File: does not exist.

using nvidia 390 drivers.

lspci | grep NVIDIA
01:00.0 VGA compatible controller: NVIDIA Corporation GK104 [GeForce GTX 770] (rev a1)

modprobe nvidia
modprobe: ERROR: could not insert 'nvidia_390': Operation not permitted

apt list dkms -a
Listing... ok
dkms/xenial-updates,xenial-updates,now 2.2.0.3-2ubuntu11.5 all [installed]
dkms/xenial,xenial 2.2.0.3-2ubuntu11 all

ls -la dkms.conf
-rw-r--r-- 1 root root 1197 kesä 19 18:17 dkms.conf

 lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.4 LTS
Release: 16.04
Codename: xenial

uname -a
Linux valvoja-System-Product-Name 4.4.0-128-generic #154-Ubuntu SMP Fri May 25 14:15:18 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

[Steve Langasek (vorlon)]

This bug has just had a xenial bug task added to it, but the issue described here has been resolved for some time. Current versions of dkms-based module packages prompt users to enroll a machine owner key in firmware to allow loading of modules not signed by the kernel's key. Marking this bug fixed.