https://bugzilla.kernel.org/show_bug.cgi?id=221847
--- Comment #1 from David Bue Pedersen ([email protected]) --- Update 2026-08-12: additional isolation of the trigger, a minimal clean workaround, and two platform findings relevant to reproduction. 1. The colliding Device objects are vestigial. A sweep of every table on the system (acpidump -b, all tables disassembled, grepped) finds IC03/IC04 referenced in exactly three places: the DSDT (the IC00-IC07 integer field declarations that SOD3 consumes) and the two 96-byte SSDTs declaring Device(IC03) and Device(IC04) (disassemblies already attached to this report). The devices carry _HID "HPIC0003"/"HPIC0004" and a constant _STA returning 0x0F, no _CRS, no other methods, and nothing references them. Dead code, shipped enabled. 2. Replacing the two SSDTs with header-only stubs eliminates the crash entirely; the name collision is necessary and sufficient. Two 36-byte tables were supplied via CONFIG_ACPI_TABLE_UPGRADE (initrd), cloning the twins' identity ("SSDT" / "HPQOEM" / "SLIC-CPC") with bumped OEM revisions. Complete source of the workaround: DefinitionBlock ("", "SSDT", 1, "HPQOEM", "SLIC-CPC", 0x00000002) { } DefinitionBlock ("", "SSDT", 1, "HPQOEM", "SLIC-CPC", 0x00000003) { } Result on kernel 7.1.6-arch1-1 / ACPICA 20251212, stock DSDT and all other tables untouched: [ 0.008780] ACPI: Table Upgrade: override [SSDT-HPQOEM-SLIC-CPC] [ 0.008785] ACPI: Table Upgrade: override [SSDT-HPQOEM-SLIC-CPC] The HPIC000x devices no longer enumerate, there are zero AE_AML_OPERAND_TYPE aborts, and the intermittent oopses are gone (previously ~50% of boots). Since removing only the two Device declarations removes the crash with everything else stock, the SSDT-vs-DSDT name collision is isolated as the trigger. This also suggests a compact synthetic reproducer for the corrupting abort path: a DSDT declaring integer FieldUnits plus a <100-byte SSDT declaring a same-named Device should exercise the identical path under QEMU. 3. The firmware POST-patches the DSDT per installed hardware. Swapping the discrete GPU (RTX 3060 -> Arc A380, 8086:56a5) changed 7 payload bytes in the published DSDT -- cmp -l offsets (1-based) 8595, 8687, 9710, 17390, 17438, 31837, 34753, each 0x93 (3060) vs 0x95 (A380) -- plus the header checksum. Two implications: (a) the acpidump attached to this report is specific to the hardware configuration it was captured under; (b) a DSDT-override workaround on this platform is only valid for the configuration it was dumped under (a mismatched override dies pre-console). The SSDT-stub workaround above is unaffected: it discards the stubbed tables' content and leaves the DSDT alone. 4. Taint status. The out-of-tree nvidia modules disclosed at filing are no longer present; the machine now runs the Arc A380 on in-tree i915. The original crash remains reproducible on demand (~50% of boots) by booting the unmodified firmware tables, now on an untainted kernel. Fresh untainted crash dmesg, or a KASAN-instrumented trace of the corrupting abort, available on request. Platform recap: HP Pavilion Gaming Desktop TG01-2xxx, BIOS F.24 (originally also reproduced on F.21). -- You may reply to this email to add a comment. You are receiving this mail because: You are watching the assignee of the bug. _______________________________________________ acpi-bugzilla mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/acpi-bugzilla
