Kernel: PEFILE: Unsigned PE binary

Our Neighbors Asahi Linux Ask Asahi
1

hi everyone,

while i were checking my messages log found some errors :

kernel: brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4387c2-pcie.apple,maldives-TPHN-u-4.7-X3.bin failed with error

kernel: Internal error: Oops: 0000000096000005 [#1] SMP

detected fb_set_par error, error code: -16

these lines caught my attention:

asahiLinux  kernel: block dm-0: the capability attribute has been deprecated.
asahiLinux  kernel: kexec_file: kernel: 00000000ba2a0d92 kernel_size: 0x41b0000
asahiLinux  kernel: PEFILE: Unsigned PE binary
asahiLinux  kernel: ima: kexec measurement buffer for the loaded kernel at 0x103bd3fc000.

can anyone explain what that means ?

2

this is the most interesting log line. There should be interesting log messages in the following line (and maybe in the preceding lines).

Did you try to use kexec? If not did you try to run anything in particular at the time the kexec log messages are printed? Those are not expected to be seen on Fedora-Asahi-Remix boots.
kexec is not tested because it is hard (or impossible) to support with all the firmware based hardware in Apple silicon systems. It’s unkown if or how the GPU can be shutdown once it is initialized. So kexec is not supported on asahi ssytems.

3

i didn’t make any change to my system, can i share more logs/configs that can help?

4

kernel: Internal error: Oops: 0000000096000005 [#1] SMP
kernel: Modules linked in: binfmt_misc uinput rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject brcmfmac_wcc ip_set qrtr nf_conntrack_netlink nft_queue nft_chain_nat nf_nat nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 bnep nf_tables nfnetlink_queue nfnetlink cdc_mbim cdc_wdm sunrpc cdc_ncm brcmfmac cdc_ether brcmutil hci_bcm4377 usbnet cfg80211 mii bluetooth rfkill apple_isp snd_soc_macaudio videobuf2_dma_sg ofpart videobuf2_memops snd_soc_cs42l84 spi_nor videobuf2_v4l2 snd_soc_tas2764 snd_soc_apple_mca videodev snd_soc_core mtd videobuf2_common snd_compress ac97_bus mc macsmc_hid apple_soc_cpufreq leds_pwm joydev squashfs loop zram dm_crypt hid_logitech_hidpp hid_logitech_dj onboard_usb_dev sdhci_pci cqhci sdhci hid_apple tps6598x nvmem_spmi_mfd spi_hid_apple_of spi_hid_apple crct10dif_ce polyval_ce rtc_macsmc macsmc_hwmon macsmc_reboot macsmc_power polyval_generic gpio_macsmc simple_mfd_spmi
kernel: ghash_ce appledrm sha3_ce asahi dwc3 sha512_ce apple_dcp sha512_arm64 i2c_pasemi_platform ulpi i2c_pasemi_core spi_apple udc_core drm_dma_helper pwm_apple apple_admac apple_sio snd_pcm_dmaengine snd_pcm snd_timer snd phy_apple_atc clk_apple_nco soundcore typec macsmc_rtkit spmi_apple_controller apple_dart mux_apple_display_crossbar nvmem_apple_efuses pinctrl_apple_gpio apple_wdt macsmc mux_core xhci_plat_hcd vfat fat nvme_apple apple_sart nvme_core nvme_auth scsi_dh_rdac scsi_dh_emc scsi_dh_alua fuse dm_multipath i2c_dev
kernel: CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Kdump: loaded Tainted: G S 6.11.0-400.asahi.fc39.aarch64+16k #1
kernel: Tainted: [S]=CPU_OUT_OF_SPEC
kernel: Hardware name: Apple MacBook Pro (14-inch, M1 Pro, 2021) (DT)
kernel: Workqueue: events hidpp_connect_event [hid_logitech_hidpp]
kernel: pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=–)
kernel: pc : __srcu_read_lock+0x48/0x98
kernel: lr : dispatch_hid_bpf_raw_requests+0x8c/0x160
kernel: sp : ffff800080197a20
kernel: x29: ffff800080197a20 x28: 0000000000000000 x27: ffff7bcf23847e40
kernel: x26: ffff7bcf0f32ac90 x25: 0000000000000011 x24: 0000000000000000
kernel: x23: 0000000000000009 x22: ffff7bcf23847e10 x21: 0000000000000001
kernel: x20: ffff7bcf23846000 x19: 0000000000000001 x18: 0000000000000000
kernel: x17: 0000000000000000 x16: ffffa27cc2868178 x15: 0000000000000000
kernel: x14: 0000000000000001 x13: 0000000000000001 x12: ffffa27cc4aaf2f0
kernel: x11: 0000000000000000 x10: 0000000000000004 x9 : ffffa27cc2862784
kernel: x8 : ffff7bcf0a452400 x7 : 0000000000000000 x6 : 0000000000000000
kernel: x5 : 0000000000000009 x4 : 0000000000000001 x3 : 0000000000000014
kernel: x2 : 0000000000000001 x1 : 0000000000000008 x0 : ffffd95609c38008
kernel: Call trace:
kernel: __srcu_read_lock+0x48/0x98
kernel: dispatch_hid_bpf_raw_requests+0x8c/0x160
kernel: hid_hw_raw_request+0x74/0xe8
kernel: __do_hidpp_send_message_sync+0x150/0x300 [hid_logitech_hidpp]
kernel: hidpp_send_message_sync+0x64/0xd8 [hid_logitech_hidpp]
kernel: hidpp_send_fap_command_sync+0xcc/0x158 [hid_logitech_hidpp]
kernel: hidpp20_query_battery_info_1004+0x1d0/0x2b8 [hid_logitech_hidpp]
kernel: hidpp_initialize_battery.isra.0+0x214/0x270 [hid_logitech_hidpp]
kernel: hidpp_connect_event+0xf0/0x600 [hid_logitech_hidpp]
kernel: process_one_work+0x180/0x420
kernel: worker_thread+0x258/0x368
kernel: kthread+0xf4/0x108
kernel: ret_from_fork+0x10/0x20
kernel: Code: d53cd040 8b020021 d2800022 8b000020 (f822001f)
kernel: —[ end trace 0000000000000000 ]—
kernel: note: kworker/0:1[10] exited with preempt_count 1

5

That looks like a bug in the hid_logitech_hidpp driver (or possibly in hid_bpf?). That shouldn’t be related to the platform, so you might want to ask in a more general place.

The kexec stuff is something you configured/installed, as we do not use kexec for anything or configure it by default, and it is not expected to work on this platform.

No idea about the detected fb_set_par error, error code: -16 message but it sounds like possibly something triggered by unusual userspace trying to use the system framebuffer or something else you’re doing that isn’t on by default.

The brcmfmac stuff is normal. It tries multiple filenames for firmware.

6

thanks for your replay , i didn’t install or configure for Kexec , could you please tell me how to check that configurations, even how to disable it ?

im newbie on kernel’s stuff , is running unsigned pe could be a malware or malicious modification of my system?

7

It could be kdump if you installed that, try systemctl disable kdump.service. The unsigned PE thing is probably normal/harmless when kexec is used like this.