Skip to content

AML fixes found running laptops' battery methods - #377

Merged
martin-hughes merged 8 commits into
rust-osdev:mainfrom
ogoffart:olivier/aml-fixes
Nov 10, 2026
Merged

martin-hughes merged 8 commits into
rust-osdev:mainfrom
ogoffart:olivier/aml-fixes

Conversation

@ogoffart

@ogoffart ogoffart commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

I discovered more bug when trying read the battery status on more laptops.
I made one PR because it is easier for me, but i can also split in several PR if you prefer.

See the individual commit messages for details

`If (Local0)` failed with ObjectNotOfExpectedType when the local held a
reference, such as a field's value: the predicate was read as an integer
without going through the reference. `While` already unwrapped it.

Found on the Framework Laptop 13 (AMD)'s battery methods.
Namespace::search let the internal LevelDoesNotExist out for a path like
\A.B.C with no B, where a missing last segment gives ObjectDoesNotExist.
Callers that check for a missing object didn't expect it: CondRefOf
(\A.B.C) was an error that stopped loading the whole table instead of
false, and evaluate_if_present returned an error instead of None. ACPICA
returns AE_NOT_FOUND for both.

Found on the Framework Laptop 13 (AMD), whose SSDTs test for optional
devices that way (\_SB.PCI0.GPPC.XHC0.RHUB.GHBX).
The resulting string kept the null byte that ends the buffer's string:
`split_inclusive` includes the separator.

Found on the Framework Laptop 13 (AMD)'s battery methods.
…eplaces the element

`Index (PKG, n)` returned a RefOf reference, so storing to it converted the
value to the element's current type: a string stored over an integer
element became 0. When the Index reference is the target of the store, and
the element isn't itself a reference, the element is now replaced, as
do_store's documentation says and as uACPI does (store_to_reference).
Through a Local that holds it, the store still goes to the element with an
implicit cast. CopyObject to an Index reference was a todo!().

Found on the Framework Laptop 13 (AMD), whose battery methods store
strings into a package's integer elements.

@martin-hughes martin-hughes left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ogoffart: Great work! Thanks for taking the time to fix all these.

"Request changes" seems a bit mean given that this is a great PR, but please would you add one extra test per my comment?

Happy enough to take this all in one PR since they're all straightforward fixes. Thanks for splitting each fix to one commit, it was very easy to check each one individually.

Some random comments:

  • I also have a Dell XPS 13 7390 laptop 🥳 (it travels around the world when I'm away from home! I've never tested my own code on it though 😆)
  • You've touched on a few areas that Isaac and I know need a bit more work (CopyObject, Index references, Notify) but from what I see your work is all a nice improvement.

Comment thread src/aml/mod.rs Resolved
Comment thread tests/de_ref_of.rs Resolved
Comment thread src/aml/mod.rs Resolved
…ct it names

`DerefOf (Index (PKG, n))` with a string element looked the string up as a
name in the namespace. Only a string given to DerefOf directly is a path;
through a reference, it's the value.

Found on the Framework Laptop 13 (AMD)'s battery methods.

Fixes rust-osdev#372.
read_buffer_field compared the field's length, in bits, with the integer
size, in bytes: only fields of up to 8 bits became integers, and a
CreateDWordField read gave a 4-byte buffer. Compared with an integer,
the integer is then converted to an 8-byte buffer, and they differ.

Found on a Dell XPS 13 7390, whose battery's _STA compares such a field
with an integer.
CreateDWordField (Arg0, Arg1, FLD) failed: the index is a reference to
the argument, not an integer. CreateField's bit index and size had the
same problem.

Found on a Dell XPS 13 7390: every call to its firmware's SMI methods
failed.
Notify was unimplemented, and its arguments didn't even match the types
they're resolved to (an object and an integer, not a name string), so
any method notifying failed. With no way to tell the operating system
yet, it's logged and ignored, as ACPICA does without a notify handler.
That's safe: Notify only queues an event for the operating system's
handlers, which run later; it returns nothing and changes nothing in the
namespace, so the method computes the same.

Found on a Dell XPS 13 7390, whose embedded controller's _REG notifies
the lid.

@martin-hughes martin-hughes left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great, thank you again @ogoffart.

Really good to see how the crate is being used in the wild.

@martin-hughes
martin-hughes merged commit bd87882 into rust-osdev:main Nov 10, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants