Bug 194833 - Invoke WVPO/WMPV with wrong arguments - HP Probook 430 G4
Summary: Invoke WVPO/WMPV with wrong arguments - HP Probook 430 G4
Status: RESOLVED DOCUMENTED
Alias: None
Product: Platform Specific/Hardware
Classification: Unclassified
Component: x86-64 (show other bugs)
Hardware: Intel Linux
: P1 normal
Assignee: platform_x86_64@kernel-bugs.osdl.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-03-09 20:48 UTC by Andreas Radke
Modified: 2017-06-26 02:15 UTC (History)
3 users (show)

See Also:
Kernel Version: 4.10.1
Tree: Mainline
Regression: No


Attachments
acpidump (913.63 KB, text/plain)
2017-03-10 15:34 UTC, Andreas Radke
Details

Description Andreas Radke 2017-03-09 20:48:29 UTC
My pretty new HP Probook 430 G4 notebook is affected by Bug 191561 and later shows these errors in the logs. I'm not sure to what component they belong if they can be ignored or should be fixed:

[    5.193114] Bluetooth: BNEP socket layer initialized
[    5.243658] (NULL device *): hwmon_device_register() is deprecated. Please convert the driver to use hwmon_device_register_with_info().
[    5.325603] ACPI Error: Needed [Buffer/String/Package], found [Integer] ffff880414af1dc8 (20160930/exresop-594)
[    5.325615] ACPI Exception: AE_AML_OPERAND_TYPE, While resolving operands for [OpcodeName unavailable] (20160930/dswexec-461)
[    5.325625] ACPI Error: Method parse/execution failed [\_SB.WMIV.WVPO] (Node ffff88041f8b2438), AE_AML_OPERAND_TYPE (20160930/psparse-543)
[    5.325637] ACPI Error: Method parse/execution failed [\_SB.WMIV.WMPV] (Node ffff88041f8b2550), AE_AML_OPERAND_TYPE (20160930/psparse-543)
[    5.326933] ACPI Error: Needed [Buffer/String/Package], found [Integer] ffff88041a129ca8 (20160930/exresop-594)
[    5.326943] ACPI Exception: AE_AML_OPERAND_TYPE, While resolving operands for [OpcodeName unavailable] (20160930/dswexec-461)
[    5.326952] ACPI Error: Method parse/execution failed [\_SB.WMIV.WVPO] (Node ffff88041f8b2438), AE_AML_OPERAND_TYPE (20160930/psparse-543)
[    5.326964] ACPI Error: Method parse/execution failed [\_SB.WMIV.WMPV] (Node ffff88041f8b2550), AE_AML_OPERAND_TYPE (20160930/psparse-543)
[    5.327956] ACPI Error: Needed [Buffer/String/Package], found [Integer] ffff88041a1293a8 (20160930/exresop-594)
[    5.327965] ACPI Exception: AE_AML_OPERAND_TYPE, While resolving operands for [OpcodeName unavailable] (20160930/dswexec-461)
[    5.327974] ACPI Error: Method parse/execution failed [\_SB.WMIV.WVPO] (Node ffff88041f8b2438), AE_AML_OPERAND_TYPE (20160930/psparse-543)
[    5.327985] ACPI Error: Method parse/execution failed [\_SB.WMIV.WMPV] (Node ffff88041f8b2550), AE_AML_OPERAND_TYPE (20160930/psparse-543)
[    5.328050] input: HP WMI hotkeys as /devices/virtual/input/input15
[    5.331265] ACPI Error: Attempt to CreateField of length zero (20160930/dsopcode-168)
[    5.331274] ACPI Error: Method parse/execution failed [\_SB.WMIV.WVPI] (Node ffff88041f8b2f00), AE_AML_OPERAND_VALUE (20160930/psparse-543)
[    5.331287] ACPI Error: Method parse/execution failed [\_SB.WMIV.WMPV] (Node ffff88041f8b2550), AE_AML_OPERAND_VALUE (20160930/psparse-543)
[    5.369565] thermal LNXTHERM:00: registered as thermal_zone2
[    5.369567] ACPI: Thermal Zone [CPUZ] (46 C)
[    5.519984] iwlwifi 0000:02:00.0 wlp2s0: renamed from wlan0
[    5.633606] iwlwifi 0000:02:00.0: L1 Enabled - LTR Enabled
[    5.634273] iwlwifi 0000:02:00.0: L1 Enabled - LTR Enabled
[    5.701178] iwlwifi 0000:02:00.0: L1 Enabled - LTR Enabled
[    5.701740] iwlwifi 0000:02:00.0: L1 Enabled - LTR Enabled
[    5.727371] IPv6: ADDRCONF(NETDEV_UP): wlp2s0: link is not ready
[    5.737254] psmouse serio3: synaptics: queried max coordinates: x [..5654], y [..4702]
[    5.768307] psmouse serio3: synaptics: queried min coordinates: x [1288..], y [1150..]
[    5.826305] psmouse serio3: synaptics: Touchpad model: 1, fw: 8.2, id: 0x1e2b1, caps: 0xf00123/0x840300/0x12e800/0x0, board id: 3245, fw id: 2368862
[    5.863412] input: SynPS/2 Synaptics TouchPad as /devices/platform/i8042/serio3/input/input14
[    5.888540] thermal LNXTHERM:01: registered as thermal_zone3
[    5.888544] ACPI: Thermal Zone [GFXZ] (0 C)
[    6.247933] thermal LNXTHERM:02: registered as thermal_zone4
[    6.247940] ACPI: Thermal Zone [EXTZ] (40 C)
[    6.255157] thermal LNXTHERM:03: registered as thermal_zone5
[    6.255159] ACPI: Thermal Zone [LOCZ] (40 C)
[    6.262152] thermal LNXTHERM:04: registered as thermal_zone6
[    6.262154] ACPI: Thermal Zone [BATZ] (31 C)
[    6.262549] thermal LNXTHERM:05: registered as thermal_zone7
[    6.262550] ACPI: Thermal Zone [PCHZ] (127 C)
[    6.280207] input: ST LIS3LV02DL Accelerometer as /devices/platform/lis3lv02d/input/input17
[    6.287149] ACPI: Video Device [GFX0] (multi-head: yes  rom: no  post: no)


I'm using pci=noaer to avoid this error but this is probably a different one:
Feb 21 16:09:01 laptop64 kernel: pcieport 0000:00:1d.0: PCIe Bus Error: severity=Corrected, type=Physical Layer, id=00e8(Receiver ID)
Feb 21 16:09:01 laptop64 kernel: pcieport 0000:00:1d.0:   device [8086:9d18] error status/mask=00000001/00002000
Feb 21 16:09:01 laptop64 kernel: pcieport 0000:00:1d.0:    [ 0] Receiver Error         (First)
Comment 1 Robert Moore 2017-03-10 03:54:06 UTC
Please post the acpidump for this machine, thanks.
Comment 2 Andreas Radke 2017-03-10 15:34:45 UTC
Created attachment 255169 [details]
acpidump
Comment 3 Robert Moore 2017-03-10 17:57:21 UTC
I don't see where WMPV is being called from anywhere within the static ACPI tables, nor is it called from Linux.

Perhaps it is in a dynamically loaded SSDT (via Load operator).

$ grep -n WMPV *.dsl
dsdt.dsl:3728:        Method (WMPV, 3, Serialized)

$ grep -n Load *.dsl
ssdt13.dsl:266:                    Load (CST0, HC0) /* \_PR_.CPU0.HC0_ */
ssdt13.dsl:274:                Load (IST0, HI0) /* \_PR_.CPU0.HI0_ */
ssdt13.dsl:285:                        Load (HWP0, HW0) /* \_PR_.CPU0.HW0_ */
ssdt13.dsl:289:                            Load (HWPL, HW2) /* \_PR_.CPU0.HW2_ */
ssdt13.dsl:376:                Load (CST1, HC1) /* \_PR_.CPU1.HC1_ */
ssdt13.dsl:386:                Load (IST1, HI1) /* \_PR_.CPU1.HI1_ */
ssdt13.dsl:398:                    Load (HWP1, HW1) /* \_PR_.CPU1.HW1_ */

I think there is a way to grab the dynamically loaded SSDTs on Linux, but I don't know how to do it.
Comment 4 Robert Moore 2017-03-10 21:47:13 UTC
Anyway, it looks like somewhere, WMPV is being called with an incorrect argument, and the runtime typechecking is catching it.
Comment 5 Lv Zheng 2017-03-14 03:49:57 UTC
> I don't see where WMPV is being called from anywhere within the static ACPI
> tables, nor is it called from Linux.

WMPV should have been invoked by OS WMI driver.

> Anyway, it looks like somewhere, WMPV is being called with an incorrect
> argument, and the runtime typechecking is catching it.

Is the typechecking wrong?
Is the OS invocation itself wrong?
Comment 6 Lv Zheng 2017-03-14 05:09:04 UTC
Please ask WMI driver maintainers first.
It's maintained in platform specific driver category.

Thanks
Lv
Comment 7 Robert Moore 2017-03-14 14:37:52 UTC
It looks like there is another issue in the DSDT:

ACPI Warning: Unsupported module-level executable opcode 0x70
at table offset 0xC655 (20170303/psloop-347)

Here is the code that causes the warning:

    Name (GF17, Zero)
    GF17 = \_SB.GGOV (0x02050011)

The code is at module level, and the assignment to GF17 is a Store() operation (opcode 0x70).
Comment 8 Robert Moore 2017-03-14 16:00:26 UTC
After some more analysis, this is starting to look like some kind of bug in the ASL, or even possibly a hardware issue.

The bottom line is that the code ends up attempting to take an Index() on an Integer, which is in fact illegal.


Attempt to trace the sequence below.


It looks like the interface to WMPV is:
Arg0 - Integer
Arg1 - Integer
Arg2 - Buffer

        Method (WMPV, 3, Serialized)
        {
/* return from WVPI is a package */

            Local4 = WVPI (Arg0, Arg1, Arg2)
            Local0 = DerefOf (Local4 [Zero])
            Local3 = DerefOf (Local4 [One])


            Local1 = WVPO (Local3, Local2)


        Method (WVPI, 3, Serialized)
        {
/* There is a path through WPVI where return value is a package {0, 1} */

            Local1 = Package (0x02)
                {
                    Zero, 
                    Zero
                }

            If ((FDAS > 0x1060))
            {
                RTCD = 0x05
                Local1 [Zero] = One
            }
            Else
            {
            }
            Return (Local1)
        }

Interface to WVPO is:
Arg0 - Integer
Arg1 - Package with 2 elements, returned from WVPI

        Method (WVPO, 2, Serialized)
        {

            If ((ObjectType (Arg1) == Zero))
            {
                FRTC = RTCD /* \RTCD */
                Local0 = DASO /* \DASO */
            }
            Else
            {
                FRTC = DerefOf (Arg1 [Zero]) /* ERROR HERE */

Here, Arg1 is not a package, it is an integer, apparently incorrectly returned from WPVI

This causes the runtime error, because Index() is not allowed on an integer.



ACPI Error: Needed [Buffer/String/Package], found [Integer] 00555DA0 (20170303/exresop-724)
ACPI Exception: AE_AML_OPERAND_TYPE, While resolving operands for [Index] (20170303/dswexec-608)
[AcpiExec] Exception AE_AML_OPERAND_TYPE during execution of method [WVPO] Opcode [Index] @34
[WVPO] @00031 #0088:  Index (Arg1, Zero)
Comment 9 Lv Zheng 2017-03-16 08:25:33 UTC
(In reply to Robert Moore from comment #7)
> It looks like there is another issue in the DSDT:
> 
> ACPI Warning: Unsupported module-level executable opcode 0x70
> at table offset 0xC655 (20170303/psloop-347)
> 
> Here is the code that causes the warning:
> 
>     Name (GF17, Zero)
>     GF17 = \_SB.GGOV (0x02050011)
> 
> The code is at module level, and the assignment to GF17 is a Store()
> operation (opcode 0x70).

This is trivial, and is not related to this bug.
This issue can be fixed after we enable acpi_gbl_parse_table_as_term_list.
Comment 10 Lv Zheng 2017-03-16 08:26:06 UTC
(In reply to Robert Moore from comment #8)
> After some more analysis, this is starting to look like some kind of bug in
> the ASL, or even possibly a hardware issue.
> 
> The bottom line is that the code ends up attempting to take an Index() on an
> Integer, which is in fact illegal.
> 
> 
> Attempt to trace the sequence below.
> 
> 
> It looks like the interface to WMPV is:
> Arg0 - Integer
> Arg1 - Integer
> Arg2 - Buffer
> 
>         Method (WMPV, 3, Serialized)
>         {
> /* return from WVPI is a package */
> 
>             Local4 = WVPI (Arg0, Arg1, Arg2)
>             Local0 = DerefOf (Local4 [Zero])
>             Local3 = DerefOf (Local4 [One])
> 
> 
>             Local1 = WVPO (Local3, Local2)
> 
> 
>         Method (WVPI, 3, Serialized)
>         {
> /* There is a path through WPVI where return value is a package {0, 1} */
> 
>             Local1 = Package (0x02)
>                 {
>                     Zero, 
>                     Zero
>                 }
> 
>             If ((FDAS > 0x1060))
>             {
>                 RTCD = 0x05
>                 Local1 [Zero] = One
>             }
>             Else
>             {
>             }
>             Return (Local1)
>         }
> 
> Interface to WVPO is:
> Arg0 - Integer
> Arg1 - Package with 2 elements, returned from WVPI
> 
>         Method (WVPO, 2, Serialized)
>         {
> 
>             If ((ObjectType (Arg1) == Zero))
>             {
>                 FRTC = RTCD /* \RTCD */
>                 Local0 = DASO /* \DASO */
>             }
>             Else
>             {
>                 FRTC = DerefOf (Arg1 [Zero]) /* ERROR HERE */
> 
> Here, Arg1 is not a package, it is an integer, apparently incorrectly
> returned from WPVI
> 
> This causes the runtime error, because Index() is not allowed on an integer.
> 
> 
> 
> ACPI Error: Needed [Buffer/String/Package], found [Integer] 00555DA0
> (20170303/exresop-724)
> ACPI Exception: AE_AML_OPERAND_TYPE, While resolving operands for [Index]
> (20170303/dswexec-608)
> [AcpiExec] Exception AE_AML_OPERAND_TYPE during execution of method [WVPO]
> Opcode [Index] @34
> [WVPO] @00031 #0088:  Index (Arg1, Zero)

So this is a BIOS bug and we can move it to that category.

Thanks
Lv
Comment 11 Robert Moore 2017-03-16 14:52:25 UTC
Yes, a BIOS bug.

Could be exposed due to some hardware issue that forces a different code path through the ASL.
Comment 12 Kamil Iskra 2017-06-22 21:51:30 UTC
I'm seeing the same error messages with HP EliteBook 820 G4.  I tracked them down to CONFIG_HP_WMI (drivers/platform/x86/hp-wmi.c).

So fair enough, the driver may be triggering a BIOS bug, but I guess it's really an indication that HP has changed their APIs and the driver needs to be updated. For all intents and purposes, the driver does not work *at all* on these new HP laptops right now (kernel 4.11).

Andreas, which special keys [do not] work on your system?  I'm particularly interested to hear about Wifi, Volume mute, and Microphone mute (both keys and lights).
Comment 13 Andreas Radke 2017-06-23 18:13:38 UTC
Microphone mute (Fn+f10) doens't work here. Volume mute and Wifi/BT hardware switch (two extra keys above keyboard) seem to work well. Nothing in the log when hitting "Mute" or "Mic mute" but Wifi switch gives:


Jun 23 20:08:03 laptop64 kernel: atkbd serio0: Unknown key pressed (translated set 2, code 0xf8 on isa0060/serio0).
Jun 23 20:08:03 laptop64 kernel: atkbd serio0: Use 'setkeycodes e078 <keycode>' to make it known.
Jun 23 20:08:03 laptop64 systemd[1]: Starting Load/Save RF Kill Switch Status...
Jun 23 20:08:03 laptop64 systemd[1]: Started Load/Save RF Kill Switch Status.
Jun 23 20:08:03 laptop64 kernel: wlp2s0: deauthenticating from c4:6e:1f:ea:da:f9 by local choice (Reason: 3=DEAUTH_LEAVING)
Jun 23 20:08:03 laptop64 kernel: iwlwifi 0000:02:00.0: Failed to find station
Jun 23 20:08:03 laptop64 kernel: wlp2s0: failed to remove key (1, ff:ff:ff:ff:ff:ff) from hardware (-22)
Jun 23 20:08:03 laptop64 avahi-daemon[268]: Interface wlp2s0.IPv6 no longer relevant for mDNS.
Jun 23 20:08:03 laptop64 avahi-daemon[268]: Leaving mDNS multicast group on interface wlp2s0.IPv6 with address 2a02:8109:953f:ed90:7eb0:c2ff:fe33:946f.
Jun 23 20:08:03 laptop64 avahi-daemon[268]: Interface wlp2s0.IPv4 no longer relevant for mDNS.
Jun 23 20:08:03 laptop64 avahi-daemon[268]: Leaving mDNS multicast group on interface wlp2s0.IPv4 with address 192.168.1.110.
Jun 23 20:08:03 laptop64 avahi-daemon[268]: Withdrawing address record for 2a02:8109:953f:ed90:7eb0:c2ff:fe33:946f on wlp2s0.
Jun 23 20:08:03 laptop64 avahi-daemon[268]: Withdrawing address record for 192.168.1.110 on wlp2s0.
Jun 23 20:08:04 laptop64 kernel: atkbd serio0: Unknown key released (translated set 2, code 0xf8 on isa0060/serio0).
Jun 23 20:08:04 laptop64 kernel: atkbd serio0: Use 'setkeycodes e078 <keycode>' to make it known.

Its functionality seems to work though. I hope this helps.
Comment 14 Lv Zheng 2017-06-26 02:15:19 UTC
Let's re-assign this bug to hp-wmi maintainers.
Feel free to re-open it under platform specific hardware.

Note You need to log in before you can comment on or make changes to this bug.