The AML interpreter finished to ACPI 6.5: Load and _OSC, the namespace initialised, every address space, every event, and the bounds stated

issues/the-amd-benchs-ec-reg-and-psr-are-refused-for-a-write-to-the-root-complexs-index.md

@@ -0,0 +1,55 @@
+---
+status: open
+kind: defect
+opened: 2026-10-13
+---
+
+# The AMD bench's controller `_REG` and adapter `_PSR` are refused for a write to the root complex's index
+
+On the AMD bench the server's evaluation of the embedded controller's
+`_REG(3, 1)` and of the AC adapter's `_PSR` are each refused `ConfigWrite`:
+both reach AMD's `ALIB` method in SSDT1, whose mailbox (`A011`) first writes
+a DWord through a SystemMemory region over the ECAM window to function
+00:00.0, offset 0xB8, and then reads and writes offset 0xBC as `BankField`s
+selected by the value written there (ACPI 6.5 §19.6.7). The kernel refuses
+every configuration write the claim's holder asks
+(`toyos_userbound::firmware::config`).
+
+**Ruled** (owner's orchestrator, 2026-10-12, #875 comment 6131125468): the
+write stays refused. 00:00.0 offset 0xB8 is the root complex's index, and
+through it AML reaches every register of the SoC, the IOMMU's configuration
+among them; passing it, or every write past the standard header of a
+function nothing claims, would put the server in the trusted base, against
+"isolation is non-negotiable".
+
+**What it costs**, read on the bench at #875's `b3bfc9742`
+(`ToyOSOrg/evidence` `pr-875`, `round3/amd-acpi_tables_loaded.log`, and
+the terms by offset in `round3/amd-aml-chain.txt`):
+
+- `_REG(3, 1)` is refused after it has stored `OKEC` and `BASC` and
+  notified the battery, at its call of `^VPC0.NDPC`, so the census reads
+  `no _REG run` and whatever `NDPC` would tell the firmware of the
+  controller is not told;
+- `_PSR` is refused at its `ALIB (One, …)`, so the adapter's state is
+  absent: the battery reads `AC unknown`;
+- each later evaluation that reaches `ALIB` is refused the same way. The
+  battery's own `_BIX` and `_BST` are read.
+
+**What AMD documents.** AMD's PPR for Family 17h Model 60h (55922-A1
+rev 3.06) names 00:00.0, vendor 1022h device 1630h, the Root Complex
+(§1.8.1, Table 13), the function the bench's kernel enumerates there, and
+documents no register at its offsets 0xB8 or 0xBC nor anything the values
+the mailbox writes to 0xB8 select: its register namespaces are the cores',
+IO, MCA, SBTSI and SMU::THM alone (List of Namespaces; Memory Map - Main
+Memory). So no documented register map exists yet to mediate that index by.
+
+Owner: the AML track
+(`issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md`).
+
+## Exit condition
+
+A design the owner accepts that mediates writes through 00:00.0's 0xB8 and
+0xBC by a register map AMD documents, built, with the AMD bench's
+`acpi_tables_loaded` reading `_REG(3, 1)` run and `_PSR` answered, and the
+expectation in `tests/toyos.rs` moved to it. Until then the refusal stays,
+and the row expects it.

issues/the-amd-benchs-ssdt8-scopes-a-controller-no-table-defines.md

@@ -0,0 +1,34 @@
+---
+status: open
+kind: defect
+opened: 2026-10-12
+---
+
+# The AMD bench's SSDT8 scopes a controller no table defines, and is refused whole
+
+The AMD bench's eighth SSDT ends in `Scope (\_SB.PCI0.LPC0.EC0)`, and no
+table of the bench defines `EC0_`: its controller is `EC__`. ACPI 6.5
+§19.6.120 reads "The object referred to by Location must already exist in
+the namespace", so the block breaks a rule of the specification, and
+`toyos-aml` refuses it whole with `NotFound`, keeping nothing of it.
+
+**Ruled** (owner, 2026-10-12, on #875 in comment 6121646183): "Refuse the
+table whole", by name; SSDT11's two calls into it fail by name too.
+
+What the refusal costs, measured outside the tree on the bench's dump
+(#875's M1, part 7): cut before the `Scope`, the block loads seven more
+objects, one for each of its methods, and nothing else changes; SSDT11's
+`M009` and `M010` call two of them, `M038` and `M039`, and any evaluation
+that reaches either is refused by name. Neither is reached by the server's
+start (#875's check outside the tree, `ToyOSOrg/evidence` `pr-875`).
+
+Owner: the AML track
+(`issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md`).
+
+## Exit condition
+
+The bench's firmware ships an SSDT8 whose `Scope` names an object its tables
+define, read loaded on the bench's `acpi_tables_loaded` row with the
+expectation in `tests/toyos.rs` moved to 17 of 17; or the owner rules that a
+block is kept short of a term that breaks a rule, and the interpreter does
+so with a host test of it.

issues/the-t14s-controller-and-hotkey-ini-are-refused-for-writes-outside-the-map.md

@@ -0,0 +1,68 @@
+---
+status: open
+kind: defect
+opened: 2026-10-13
+---
+
+# The T14's controller `_INI` and hotkey `_INI` are refused for writes outside the map
+
+On the T14 the server's namespace walk has two `_INI`s refused `MemoryType`,
+"a SystemMemory write the kernel refused MemoryType, in unlisted firmware
+memory": the embedded controller's (`\_SB.PC00.LPCB.EC._INI`) and its
+hotkey device's (`EC.HKEY._INI`). The kernel refuses every write the claim's
+holder asks at an address the firmware's memory map does not list
+(`toyos_userbound::firmware`).
+
+**Ruled** (owner, 2026-10-12, #875): a memory write outside every range the
+map describes is refused by name and recorded, not admitted. Ruled again on
+the two writes read below (#875, comment 6135767889): both stay refused
+under that ruling, since a write outside the firmware's map reaches a device
+another driver may own, the GPIO community for the pad and MCHBAR for the
+hotkey device's, so isolation decides. The T14 row expects both `_INI`s
+refused by path and the census's count of two (`T14` in `tests/toyos.rs`).
+
+**The controller's write**, read on the T14 at #875's `ddc243eaf` and
+reproduced on the host by the T14's own tables (`ToyOSOrg/evidence`
+`pr-875`, `round5/`): `EC._INI` calls `HKEY.WGIN`, which stores what the
+firmware's SMI answers for `WGSV(1)` and, where `WIN8` is set and that
+answer is not zero, calls `BPWC(1)`; `BPWC` calls `\_SB.SGOV(0x0902000D, 1)`
+where the answer has bit 4 set and bit 7 clear. That is byte 0x01 at
+0xFD6E0A70: `\SBRG` (SBREG_BAR, 0xFD000000) + Port ID 0x6E << 16 + 0xA70,
+which Intel's 500 Series Chipset On-Package PCH datasheet vol. 2
+(631120-002) §27.1.114 names `PAD_CFG_DW0_GPPC_A_13` of GPIO Community 0,
+bit 0 `GPIOTXSTATE`, "drive a level '1' to the TX output pad". The window
+0xFD6E0000 + 64 KiB is one of four the GPIO controller `\_SB.GPI0`
+(`INT34C5`) lists in its `_CRS`, and each holds every pad's configuration
+of its community with `PAD_OWN`, `PADCFGLOCK`, `HOSTSW_OWN` and the GPE
+group assignment (§27.1.1–27.1.19); `PAD_OWN` 00 is "no read/write
+restriction to the Pad Configuration register set during host ownership".
+
+**The hotkey device's write** is not read on the T14: the server details a
+kind's first refusal only. On the host the T14's tables reach it by
+`HKEY._INI` → `DYTC` → `SCPF` → `\_SB.PC00.PL1S` → `CTCN`, which writes
+bytes at MCHBAR + 0x5F50, 0x5F54, 0x59A0 and 0x59A1, where MCHBAR is what
+00:00.0 offset 0x48 holds (the host run assumed 0xFEDC0000). Intel's 11th
+Generation Core processor datasheet vol. 2 (631122) is the document for
+those offsets; it is fetched and unread, its PDF encrypted against the text
+extractor tried.
+
+**What it costs**:
+
+- `EC._INI` is refused inside `WGIN`, so the pad stays as the firmware
+  left it, `WGIN`'s flags miss bit 5, and nothing after `WGIN` runs: on
+  the host, under the values that run answered, that is a read of the
+  controller's bytes 0x49 and 0x3A and a write of 0x3A with bit 5 set;
+- `HKEY._INI` is refused inside `DYTC`, and whatever comes after its
+  refused write is not done;
+- the battery and the adapter are read regardless (`battery_read`).
+
+Owner: the AML track
+(`issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md`).
+
+## Exit condition
+
+The hotkey device's refused write is read on the T14, and either a design
+the owner accepts mediates these writes by Intel's register maps, built,
+with the T14's `acpi_tables_loaded` reading both `_INI`s run and the
+expectation in `tests/toyos.rs` moved to it, or the refusal stays and the
+row expects it.