RedBear-OS/local/docs/LG-GRAM-16Z90TP-COMPATIBILITY-PLAN.md

# LG Gram 16Z90TP-G.AL89C — Host Compatibility Plan

**Created:** 2026-07-20
**Status:** Implementation in progress — Phases 0, 3.2, 3.4, 3.5, 3.6, 4.1–4.4, 5.0–5.5, 6.1, 9.6 complete; Phase 9.1 partial
**Source evidence:** Host dmesg (Linux 7.1.3-1-MANJARO), six-point codebase recon
(drivers/PCI-ID inventory, redox-drm Intel state, redbear-iwlwifi state, IOMMU/kernel
state, ACPI/power state, USB/input/audio state)
**Host class:** Modern Intel laptop (Arrow Lake-H), first-class bare-metal target

---

## 1. Host Profile

| Property | Value |
|---|---|
| Model | LG Electronics 16Z90TP-G.AL89C (2025) |
| BIOS | Phoenix A1ZJ3000 X64, 2024-12-26, UEFI 2.7, Secure Boot **off** |
| CPU | Intel Core Ultra 7 255H (Arrow Lake-H), family 0x6 model 0xC5, 16 cores (hybrid P/E/LP-E), x2APIC, TSC 3.69 GHz, HWP, TM1, CET/IBT |
| RAM | 32 GB |
| GPU | Intel Meteor Lake graphics [8086:7d51], display version 14.00, VT-d active |
| Storage | SK Hynix NVMe [1c5c:1959] (nvme0, 16 queues) |
| Wi-Fi | Intel Wi-Fi 7 BE201 320MHz [8086:7740] CNVi (crf 0x2001910, cnv 0x80930), fw `bz-b0-fm-c0-c102.ucode`, **op_mode iwlmld** |
| Bluetooth | Intel [8087:0037] (USB-attached CNVi BT), fw `ibt-0093-0291.sfi` + `.ddc` |
| Audio | HDA [8086:7728] via **SOF/cAVS** (sof-arl.ri, IPC4, ALC298 codec, 2× DMIC, HDMI) |
| USB | xHCI ×2: [8086:7ec0] (USB4-adjacent), [8086:777d]; Linux quirks `0x200009810` |
| Input | PS/2 i8042 keyboard (AUX **disabled**); I2C-HID multitouch touchpad 04CA:00CC on LPSS DesignWare I2C [8086:7778/7779] |
| Camera | UVC 1.50 [30c9:00f2] |
| IOMMU | Intel VT-d, 2× DRHD (0xfc800000/0xfc801000), IRQ remapping, **force-enabled by platform** |
| Power | EC at 0x66/0x62 (GPE 0x6e), BAT0, ADP1, lid, sleep/power buttons, thermal zone, fan PNP0C0B, **S0ix only (LPIT; no S3)**, LG WMI, TPM2 |
| Misc PCI | LPC 8086:7702, SMBus 8086:7722, SPI 8086:7723, UART 8086:7745, MEI 8086:7770, GNA 8086:774c, VPU/NPU 8086:7d1d, proc-thermal 8086:7d03, PMC telemetry 8086:777f, ISH 8087:0AC2 |
| Notable quirks | HPET dysfunctional in PC10 (Linux force-disables); no wired Ethernet — **Wi-Fi is the only network device** |

---

## 2. Device-by-Device Support Matrix (dmesg vs. codebase recon)

Legend: ✅ = expected to work today (code match + mature path) · 🟡 = code exists, gap or unproven · ❌ = no support

| Device | ID | Red Bear component | Verdict | Evidence |
|---|---|---|---|---|
| UEFI boot | — | bootloader fork | ✅ | Standard Phoenix UEFI 2.7; boot proven on AMD/Intel bare metal |
| CPU/SMP | 0x6/0xC5 | kernel x2APIC dual-path | ✅ | `local_apic.rs` x2 via CPUID; 16-core boot expected |
| HPET | — | kernel | ✅ (n/a) | Redox uses LAPIC/TSC timers; HPET-dysfunctional quirk harmless |
| NVMe | 1c5c:1959 | `nvmed` (class 1/8) | ✅ | Class-based match; initfs-capable |
| xHCI ×2 | 8086:7ec0, 8086:777d | `xhcid` | ✅→🟡 | Class match 0x0C/0x03/0x30 + Intel baseline quirks; 7ec0 (USB4-adjacent) has no specific quirk entry; unvalidated on HW |
| PS/2 keyboard | i8042 | kernel `serio` + `ps2d` | ✅ | AUX-disabled handled (`test_aux_port` → `SECOND_DISABLED`); QEMU + BM proven |
| VESA console | — | `vesad`+`fbcond` | ✅ | Boot framebuffer path, always present |
| iGPU | 8086:7d51 | `redox-drm` Intel | 🟡 | 0x7D51 **is** in `INTEL_GEN12_MTL_IDS`; but display init assumes Gen8-era register layout; DMC preload gated but **never loaded to HW**; no GuC/HuC |
| Legacy iGPU fb | 8086:7d51 | `ihdgd` | 🟡 | Also claims 0x7D51 — priority vs redox-drm must be enforced |
| Wi-Fi BE201 | 8086:7740 | `redbear-iwlwifi` | 🟡→❌ | ID in table, fw family correct (`bz-b0-fm-c0`), **but** Mini-MVM is iwlmvm-era and BE201 needs **iwlmld**; fw API 102 vs expected 92–100; zero HW validation |
| BT | 8087:0037 | `redbear-btusb` | 🟡 | Recipe exists (bounded BLE slice); Intel bootload/fw-load (sfi+ddc) untested |
| Audio HDA | 8086:7728 | `ihdad` | ❌ (arch) | Class-matched and will probe, but cAVS/SOF platform — legacy HDA cannot reach ALC298 behind the DSP; needs SOF port |
| USB audio (dongle) | — | `redbear-usbaudiod` | ✅ (interim) | UAC1 full impl; viable interim audio |
| Touchpad | 04CA:00CC | `intel-lpss-i2cd`/`dw-acpi-i2cd` + `i2c-hidd` | 🟡 | Chain compiles; controller ACPI HID likely **not in any SUPPORTED_IDS**; no BM validation; single-touch parsing only |
| I2C controllers | 8086:7778/7779 | same | 🟡 | ACPI-HID matching may miss Arrow Lake HIDs; PCI-ID fallback matching absent |
| Camera | 30c9:00f2 | — | ❌ | No UVC driver anywhere |
| Battery/AC | BAT0/ADP1 | `acpid` AML `_BST`/`_PSR` | 🟡 | Polling works; **no event notifications** (no GPE) |
| Lid/buttons | PNP0C0D/C/E | — | ❌ | Zero lid code; button GPE re-enable documented as caller's job |
| GPE/EC events | GPE 0x6e | `acpid`/`ec.rs` | ❌ | EC byte protocol exists; no GPE dispatch, no QR_EC loop |
| Thermal zones | TZ00 | `acpid`+`thermald` | 🟡 | `_TMP`/`_PSV`/`_CRT` + passive cooling via cpufreq works; fan is soft-model only |
| CPU freq | ARL-H | `cpufreqd` HWP/EPP | ✅ | Code explicitly notes Arrow Lake-H HWP; MSR path generic |
| CPU temp/RAPL | — | `coretempd`, `redbear-power` | ✅ | MSR 0x19C/0x1A2/0x606+; no model gating needed |
| Suspend | S0ix/LPIT | `acpid` s2idle | 🟡→🟡 | Prep sequence exists; **LPIT parser + _PRW wake enumeration + FADT S0-idle detection done** (2026-07-22, acpid/wake.rs); MWAIT loop + GPE wake re-arm remain; S3 absent on this host |
| Shutdown/reboot | S5/reset | `acpid`/kernel | ✅ | Implemented; robustness tracked in ACPI-IMPROVEMENT-PLAN |
| IOMMU (VT-d) | DMAR | `iommu` daemon | ✅ (safe no-op) | AMD-Vi only; detects DMAR, logs, registers empty scheme; **do not set REDBEAR_DMAR_INIT=1** (gl_sts hang risk) |
| LPC/SMBus/SPI/UART/MEI/GNA/VPU/PMC/ISH/TPM | various | — | ❌ | No drivers; none are boot-critical |
| LG WMI hotkeys | — | — | ❌ | No WMI subsystem |
| USB-C eth dongle (interim net) | — | `redbear-ecmd` | ✅ (interim) | CDC-ECM driver exists — **only viable interim network path** (no wired NIC on host) |

### 2.1 Critical config-level defect found during recon

**e1000d wildcard collision.** `local/config/drivers.d/10-network.toml` matches
`vendor=0x8086 class=2` with no subclass filter → on this host it would claim the
BE201 Wi-Fi (class 0x02 subclass 0x80) and collide with `redbear-iwlwifi`.
The pcid-side `e1000d/config.toml` whitelist is correct; the driver-manager entry
is too broad. **Must fix (Phase 0) — add `subclass = 0x00`.**

### 2.2 Known non-issues (verified, do not re-investigate)

- VT-d force-enabled: harmless — `iommu` daemon is a clean no-op on DMAR-only machines.
- HPET dysfunctional: kernel timers don't need HPET.
- AUX port disabled: `ps2d` handles it.
- PCI root ports/LPC/host bridge: bus-layer devices, no userspace driver needed by design.
- x2APIC: fully supported; IRQ remapping absence does not block MSI/MSI-X delivery.

### 2.3 ACPICA assessment (2026-07-22)

**Verdict: Do NOT port ACPICA as a C library. Port its useful data structures and algorithms into the existing Rust stack.**

ACPICA (~87K lines C + ~9K headers) is Intel's reference ACPI implementation. Porting it
wholesale would create a C dependency in the core ACPI path, violating the project's
Rust-first driver architecture. Instead, we port ACPICA's battle-tested algorithms into
the existing `acpi-rs` vendored fork + `acpid` daemon:

| ACPICA component | Status | Action |
|---|---|---|
| AML interpreter (acpi-rs) | ✅ Already vendored + Notify fixed | Continue extending opcode coverage |
| LPIT table parser | ✅ Ported (2026-07-22) | `acpid/wake.rs` — LpitInfo::parse() |
| _PRW wake device enumeration | ✅ Ported (2026-07-22) | `acpid/wake.rs` — WakeRegistry::enumerate() |
| FADT S0-idle detection | ✅ Ported (2026-07-22) | `Fadt::supports_s0_idle()` — bit 21 |
| _DSW/_PSW wake arming | ✅ Ported (2026-07-22) | `WakeRegistry::arm_wake_devices()` / `disarm_wake_devices()` — _DSW(1)/_PSW(1) enable + GPE wake enable |
| Sleep state discovery | ✅ Ported (2026-07-22) | `SleepStates::discover()` — _S0 through _S5 enumeration |
| GPE block handling | ✅ Already in acpid/gpe.rs | FADT-driven, write-1-to-clear, enable preserve |
| GPE _Lxx/_Exx dispatch | ✅ Ported (2026-07-22) | `enabled_active_gpes()` + `\_GPE._L{gpe:02X}`/`_E{gpe:02X}` method evaluation in handle_sci (evgpe.c acpi_ev_gpe_detect) |
| ACPI PM timer | ✅ Ported (2026-07-22) | `pm_timer_read()` from FADT pm_timer_block; `/scheme/acpi/pmtimer` endpoint (3.579545 MHz) |
| EC query protocol | ✅ Already in acpid/ec.rs | SCI_EVT poll/IRQ, QR_EC drain, bounded at 32 |
| Fixed event dispatch | ✅ Already in acpid/power_events.rs | PM1_STS PWRBTN/SLPBTN/RTC |
| Sleep/wake (S0ix entry) | 🟡 Partial | `enter_s2idle()` now arms wake devices; `exit_s2idle()` disarms them. MWAIT idle loop remains (kernel idle-loop work) |
| Thermal zone methods | ✅ Ported (2026-07-22) | `/scheme/acpi/thermal/<zone>/{temperature,passive,critical}` — _TMP/_PSV/_CRT evaluation via scheme |
| Namespace management | ✅ In acpi-rs | AmlSymbols with RwLock |
| Table manager (RSDT/XSDT) | ✅ In acpid/acpi.rs | SdtHeader parse + checksum + DSDT/SSDT/FADT/FACS/ECDT |

### 2.4 pcid assessment (2026-07-22)

**Verdict: pcid is correct and well-wired. No changes needed.**

Reviewed `local/sources/base/drivers/pcid/src/main.rs` (411 lines):

- **Enumeration**: scans buses 0 and 0x80 (Arrow Lake PCH workaround, documented FIXME).
  Bridge secondary buses discovered recursively.
- **BAR parsing**: IO/Memory32/Memory64 handled correctly with 64-bit BAR slot skip.
- **Quirks**: PIIX4/PIIX5 IDE legacy-BAR quirk (fixed ports 0x1F0/0x3F6/0x170/0x376/0xC0C0).
  vgaarb boot VGA identification (logging).
- **Capability list**: proper `has_capability_list()` check before parsing.
- **ROM BAR**: correct read-modify-write-restore sequence.
- **Device enable**: bus mastering + memory + IO enable. MSI/MSI-X disabled before re-enable.
- **IRQ routing**: legacy IRQ via device-tree-style `interrupt_map` with pin/line mapping.
- **Wiring**: registers `/scheme/pci` via `register_sync_scheme`. Registers with acpid via
  `/scheme/acpi/register_pci` for ACPI integration. pcid-spawner spawns drivers on detection.
- **Known limitations** (documented FIXMEs, not bugs):
  - Bus 0x80 hardcoded scan (should come from ACPI bus enumeration)
  - MCFG only describes first host bridge (multi-CPU systems need ACPI enumeration)

---

## 3. Boot Path Analysis (redbear-mini on this host)

```
UEFI 2.7 (Phoenix) → Red Bear bootloader (✅ expected)
  → kernel: x2APIC detect (✅), 16-core SMP (✅), MADT (✅), MCFG ECAM 0xC0000000 (✅)
  → initfs: pcid → nvmed (✅ SK Hynix) → rootfs mount (✅)
  → vesad + fbcond console (✅)
  → pcid-spawner + driver-manager:
      xhcid ×2 (✅ class match, Intel baseline quirks — watch 7ec0)
      ps2d (✅)
      ihdad (🟡 probes, finds no usable codec — must fail gracefully, not hang)
      redbear-iwlwifi (🟡 probes, fw API mismatch likely — must fail gracefully)
      e1000d (❌ COLLISION — Phase 0 fix)
  → acpid: RSDP/FADT/DSDT/SSDT/EC (✅), battery/AC poll (🟡), shutdown (✅)
  → cpufreqd HWP (✅), coretempd (✅), thermald (🟡)
  → login prompt (✅ expected) — redbear-mini usable with keyboard + USB-Ethernet dongle
```

Expected first-boot result: **boots to login on VESA console with working keyboard,
NVMe, USB, CPU power management, battery readout, and shutdown — but no touchpad,
no network (without USB dongle), no DRM/KMS, no audio, no suspend.**

---

## 4. Multiphase Plan

Phase ordering respects the canonical subsystem order (IRQ/low-level → USB → Wi-Fi →
BT → desktop) but prioritizes host boot-blockers and the no-wired-NIC reality.
Every phase ends with a validation gate on the **real host** (this machine is
available — that changes everything vs. prior plans blocked on hardware access).
Evidence language per project rules: compile-visible ≠ QEMU-bounded ≠ hardware-validated.

Effort scale: S (<1 week) · M (1–3 weeks) · L (3–8 weeks) · XL (8+ weeks)

---

### PHASE 0 — Host bring-up prerequisites (S, config-level, zero risk)

> **STATUS: COMPLETE (2026-07-20).** All items landed; affected components
> cross-compile for `x86_64-unknown-redox`; all host-side test suites pass
> (redox-driver-sys 72, firmware-loader 11, redbear-iwlwifi 8, redbear-wifictl 21).

| # | Work item | Files | Notes |
|---|---|---|---|
| 0.1 | **Fix e1000d wildcard collision** — add `subclass = 0x00` to e1000d match | `local/config/drivers.d/10-network.toml` + embedded copy in `config/redbear-device-services.toml` | ✅ DONE — same defect class also fixed for `rtl8168d` (Realtek ships subclass-0x80 Wi-Fi too) |
| 0.2 | Add DMI quirk-table entry for `LG Electronics 16Z90TP` | `redbear-quirks/source/quirks.d/50-system.toml` | ✅ DONE — **and repaired the system-quirk *parsing* pipeline**: the sibling LG entries' flags (`force_s2idle` etc.) silently parsed to empty sets (unknown names dropped). Added `SystemQuirkFlags` + `DmiSystemQuirkRule` + dual-namespace parsing in `toml_loader.rs` + `quirks::system_quirks()` consumer API in redox-driver-sys. **Consumer wiring (acpid `force_s2idle`, ps2d `kbd_deactivate_fixup`) remains Phase 5 work — the flags parse and are queryable but nothing branches on them yet.** 16Z90TP entry matches on `board_name = "16Z90TP"` (exact-match semantics; product_name carries the SKU suffix) |
| 0.3 | Verify/port xHCI quirks for 8086:7ec0 & 8086:777d — decode Linux `0x200009810` | `redox-driver-sys/source/src/quirks/xhci_table.rs` | ✅ DONE — decoded as `SPURIOUS_SUCCESS \| LPM_SUPPORT \| INTEL_HOST \| AVOID_BEI \| DEFAULT_PM_RUNTIME_ALLOW`. Missing piece was the **universal `hci_version > 0x96 → SPURIOUS_SUCCESS`** rule (Linux `xhci.c:5477`); added it + a flag-parity test pinning the LG Gram controllers to the exact Linux flag set. The `>= 0x120 → DEFAULT_PM_RUNTIME_ALLOW` rule already existed |
| 0.4 | Confirm graphics spawn priority: redox-drm wins over ihdgd for 0x7D51 | `drivers.d/30-graphics.toml`, `pcid.d/intel_gpu.toml`, `redbear-{mini,full}.toml` | ✅ VERIFIED CORRECT — redox-drm Intel entry priority 61 > vesad 60; redbear-mini empties `/etc/pcid.d/ihdgd.toml`; redbear-full overrides it to spawn redox-drm; `/etc/pcid.d` overrides `/usr/lib/pcid.d` via `config_for_dirs()` BTreeMap; base package stages into `/usr/lib/pcid.d` so no layer collision. No change needed |
| 0.5 | Stage firmware blobs | `local/firmware/`, `redbear-iwlwifi/main.rs`, `redbear-wifictl/backend.rs`, `firmware-loader/blob.rs`, `redbear-device-services.toml` | ✅ DONE — staged host-verified blobs (iwlwifi bz-b0-fm-c0 **c101/c102/c103/c106** + pnvm, gf-a0 set, i915/mtl_dmc.bin + guc/huc/gsc, ibt-0093-0291.sfi/.ddc). **Key discovery:** the `c`-prefixed series is the iwlmld firmware — candidate tables rewritten to prefer c106→c101 over the legacy 92–101 series. **Fixed firmware path gap:** new linux-firmware ships iwlwifi under `intel/iwlwifi/`; added wildcard path-map to firmware-loader builtins + `/etc/firmware-fallbacks.d/10-iwlwifi.toml`. Image path confirmed: `redbear-firmware` recipe ships the full set (cache has c106) |

**Phase 0 discoveries beyond the original scope (all fixed, none deferred):**

1. `rtl8168d` had the same wildcard collision as e1000d → fixed with the same `subclass = 0` filter.
2. The `[[dmi_system_quirk]]` TOML entries in `50-system.toml` were **dead data** — every system flag silently dropped by the parser, and no consumer API existed. Now a real pipeline: `SystemQuirkFlags` → `DmiSystemQuirkRule` → `quirks::system_quirks()` → consumers (acpid/ps2d wiring lands in Phases 4–5).
3. `integrate-redbear.sh` AMD-only firmware staging into `firmware-loader/source/firmware/amdgpu/` never reaches the image (package ships only the binary) — the real image path is the `redbear-firmware` recipe (full linux-firmware install, local 2.8 GB cache already present). Documented here; the dead staging path is legacy cleanup, not Phase 0 scope.
4. Firmware fallback chains in `redbear-device-services.toml` are embedded 16× (fragment composition); updates must use replace-all edits.

**Gate 0:** ✅ changed components cook successfully for the target;
`redbear-iwlwifi`, `redbear-wifictl`, `firmware-loader`, `redox-driver-sys` all build + publish.

---

### PHASE 1 — Bare-metal boot validation (S, evidence-first)

This host is available — run the existing validation harnesses against it and
record everything. **No code changes in this phase except genuine boot-blocker fixes.**

| # | Work item | How |
|---|---|---|
| 1.1 | Boot `redbear-mini` live ISO on host; capture full boot log to `local/docs/boot-logs/lg-16z90tp-*.log` | USB stick; serial capture if console fails |
| 1.2 | Validate: 16-core SMP, NVMe root, xHCI enumeration (both controllers), PS/2 keyboard, VESA console at native panel resolution, battery/AC readout, HWP P-states, coretemp, ACPI shutdown + reboot | Manual + `redbear-info`, `redbear-ecmd` |
| 1.3 | Validate USB-Ethernet interim networking: CDC-ECM dongle → `redbear-ecmd` → DHCP | `redbear-netctl` |
| 1.4 | Run bounded low-level controller proofs (MSI-X, xHCI IRQ, PS/2, timer) | `local/scripts/test-lowlevel-controllers-qemu.sh` analogues on BM; record results |
| 1.5 | Add host entry to `local/docs/HARDWARE-VALIDATION-MATRIX.md` with honest evidence levels | Per row: compile / QEMU / BM-validated |
| 1.6 | Fix only true boot-blockers discovered (root-cause fixes per ABSOLUTE RULE) | Triage as found |

**Gate 1:** redbear-mini boots to login on the host with keyboard + NVMe + USB +
shutdown/reboot verified. This is the " minimally usable " milestone.

---

### PHASE 2 — CPU & platform power validation (S–M)

| # | Work item | Files | Effort |
|---|---|---|---|
| 2.1 | Validate `cpufreqd` HWP on ARL-H: governor switching, EPP hints, per-core HWP_REQUEST | `local/recipes/system/cpufreqd/` | S |
| 2.2 | Validate RAPL domains (pkg/pp0/pp1/dram/platform) in `redbear-power`; check 0x64D platform energy on ARL | `redbear-power/source/src/msr.rs` | S |
| 2.3 | Validate `coretempd` + `thermald` passive cooling loop under load (stress via cub builds) | thermald + cpufreqd integration | S |
| 2.4 | Hybrid topology: feed CPUID leaf 0x1A P/E/LP-E classification (exists in redbear-power) into cpufreqd per-cluster governor policy | `cpufreqd`, `redbear-power/cpuid.rs` | M |
| 2.5 | Serial console bring-up via DBG2 16550 (0x3f8) for headless debugging of later phases | kernel/boot config | S |

**Gate 2:** `redbear-power` shows correct per-cluster frequencies, temps, RAPL power;
thermal throttling engages and recovers under sustained load.

---

### PHASE 3 — Display: VESA → DRM/KMS on Meteor Lake (L, critical path for desktop)

Follows `local/docs/DRM-MODERNIZATION-EXECUTION-PLAN.md` Workstream C.

| # | Work item | Files | Effort |
|---|---|---|---|
| 3.1 | Validate vesad at native panel mode (eDP; likely 2560×1600); confirm fbcond + any framebuffer consumers | vesad/bootloader EDID handoff | S |
| 3.2 | ~~Per-generation display differentiation~~ **INVESTIGATED AND DISPROVEN (2026-07-22)** — register offsets are IDENTICAL from Gen8 (SKL) through Gen14 (MTL): PIPECONF=0x70008, PLANE_CTL=0x70180, PLANE_SURF=0x7019C, DDI_BUF_CTL=0x64000, HTOTAL=0x60000. Only CHICKEN_TRANS has a DISPLAY_VER>=14 branch. The real MTL gap is DMC firmware loading (Phase 3.4), not register offsets. | `redox-drm/source/src/drivers/intel/{mod,display}.rs` | ~~L~~ → ✅ DONE (investigation) |
| 3.3 | Real connector/EDID bring-up on eDP: GMBUS read at panel; bounded modeset proof via `redbear-drm-display-check` on the host | display.rs + test-drm-display-runtime.sh | M → 🟡 CODE-COMPLETE (2026-07-22) — GMBUS EDID read already real (I2C via GMBUS0-3); **DPCD AUX stub replaced with real native AUX channel read** (DP_AUX_CH_CTL/DATA, native read cmd 0x9, ACK check, MTL POWER_REQUEST). Modeset proof + panel bring-up need host boot. |
| 3.4 | **DMC firmware load sequence**: CSS header parse, DMA-to-DMC-store, DC state enable — port from Linux i915 `intel_dmc.c`. Consume the already-preloaded `mtl_dmc.bin` | `intel/mod.rs`, new `intel/dmc.rs`; firmware-loader | M–L → ✅ DONE (2026-07-22) — full DMC v1+v3 parser, payload MMIO loading, DisplayPlatform enum, wired into IntelDriver::new() |
| 3.5 | eDP backlight control (DDI PWM / DPCD) — brightness keys need WMI (Phase 9); scheme-level brightness first | new `intel/backlight.rs` | M → ✅ DONE (2026-07-22) — CPU PWM backlight with UTIL_PIN mode setup, BLC_PWM_CPU_CTL[2] duty cycle control, enable/disable/set_brightness, Gen9+ register offsets |
| 3.6 | GuC/HuC/GSC: manifest entries now, load sequences **deferred** (render path, not display blocker). Document as convergence work in DRM plan | `main.rs` firmware keys | S (manifest only) → ✅ DONE (2026-07-22) — guc_firmware_key(), huc_firmware_key(), gsc_firmware_key() on DisplayPlatform; manifest logged at IntelDriver::new() |

**Gate 3:** `redox-drm` drives the internal panel at native resolution with correct
EDID modeset + page flips on the host; vesad remains as fallback. **This unblocks the
whole desktop path (Qt6/KWin) on this machine.**

---

### PHASE 4 — Touchpad: I2C-HID chain bring-up (M)

> **STATUS: 4.1–4.4 COMPLETE (2026-07-21).** The entire I2C transfer chain was
> stubbed end-to-end and has been replaced with real implementations (see
> "stub sweep" below). 4.4 (multitouch report parsing) landed on 2026-07-21.
> Only 4.5 (host runtime validation) remains open and requires the running
> system.

**Stub sweep (all found during this phase, all replaced with real code):**

1. **i2cd transfer path was a stub** — `queue_transfer_stub` returned
   "not implemented yet" for every transfer, and its wire format didn't even
   match the only in-tree consumer (i2c-hidd sends a bare
   `I2cTransferRequest`, i2cd expected `I2cControlRequest::Transfer`).
   → Real provider routing: adapter resolution by name/alias (exact-first,
   ambiguity-rejecting) + forwarding to the provider daemon's
   `/scheme/<provider>/transfer` endpoint.
2. **intel-lpss-i2cd / dw-acpi-i2cd were register-and-park stubs** — they
   mapped the MMIO, logged register offsets in a debug line, registered an
   adapter name, and parked forever without initializing the controller or
   executing a single transfer.
   → New shared crate `drivers/i2c/designware` (`dw-i2c`): real DesignWare
   master engine ported from Linux 7.1 `i2c-designware-master.c`/`common.c`
   + shared `/scheme/<name>` transfer endpoint. (amd-mp2-i2cd is a
   *different* IP — the AMD mailbox controller — and remains a
   registration-only daemon until its own engine lands; every transfer to
   it fails honestly with "no transfer provider". It is NOT covered by this
   sweep.)

**Review-fix round (2026-07-20, post-implementation review):**

A 5-lane review (goal/QA/code-quality/security/context) returned FAIL with
two verified-CRITICAL and ~14 MAJOR findings. All legitimate findings were
fixed in the same session (fix commits on submodule/base + 0.3.1):

| Finding | Fix |
|---|---|
| CRITICAL: `IC_CON`/`IC_TAR` written while enabled | Engine restructured to Linux `i2c_dw_xfer_init` ordering: wait-idle → disable → program → enable with `IC_ENABLE_STATUS` polling on every transfer |
| CRITICAL: Intel LPSS PCI bring-up skipped parent init | Proper `pcid_interface` claim + `enable_device`, BAR size validation, `intel_lpss_init_dev` port (reset-deassert + 64-bit remap at BAR0+0x200) |
| MAJOR: NACK-reported-as-success | `wait_for` now checks `TX_ABRT` **before** success predicates on every poll |
| MAJOR: SCL timing wrong (fall-time source + rounding) | HCNT uses `sda_fall_ns`, round-to-nearest division; corrected to Linux vectors FS 100/200, SS 552/652 with pinned tests |
| MAJOR: `stop=false` hangs | Rejected honestly (`Invalid`) |
| MAJOR: abort/timeout left controller wedged | `recover()` — ABORT-bit cycle + disable + state flush after any failed transfer |
| MAJOR: unbounded requests (`Read(usize::MAX)` → OOM) | `validate_request`: segment/byte/address/10-bit limits before any MMIO |
| MAJOR: `provider_scheme` unchecked capability | Grammar validation at registration (single safe component) |
| MAJOR: routing ambiguity (short alias shadows exact) | Exact-first resolution in both i2cd and the endpoint; last-component accepted only when unambiguous |
| MAJOR: ACPI-alias startup race | Bounded retry in alias discovery; acpid runs from initfs (41_acpid) so ordering is satisfied |
| MAJOR: `setrens` fail-open | `endpoint::serve` takes a `Result`-returning callback; namespace failure is fatal |
| MAJOR: MLD (`c`-series) firmware fed to Mini-MVM | c-series removed from current candidate lists (returns with the MLD op-mode in Phase 6); fallback chains no longer mix MLD/MVM series |
| MAJOR: subdirectory blobs invisible to candidate detection | Detection probes both flat and `intel/iwlwifi/` layouts |
| MAJOR: untyped error flattening | `I2cTransferResponse.status` (typed `I2cTransferStatus`, serde-defaulted, wire-compatible) |

Open findings deferred with records: AMD MP2 mailbox engine (separate port),
system-quirk consumers in acpid/ps2d (Phase 5), redbear-firmware supply-chain
pinning (pre-existing, separate task), CallerCtx authZ on i2c schemes
(design question), fake-MMIO state-machine tests (test-infrastructure work).

3. **intel-lpss-i2cd could never bind on modern hardware** — it matched only
   legacy ACPI HIDs, but MTL/ARL platforms bind LPSS I2C by PCI ID
   (Linux `intel-lpss-pci.c` model).
   → PCI discovery for ARL-H (0x7750/0x7751, 0x7778–0x777b) and MTL-P
   (0x7e50/0x7e51, 0x7e78–0x7e7b) with BAR0 from PCI config space
   (32/64-bit BAR decode), ACPI alias resolution by matching
   `FixedMemory32 == BAR0` across `/scheme/acpi/resources/`.
4. **Six broken spawn paths** — `drivers.d` command paths pointed at
   `/usr/lib/drivers/` for binaries staged at `/usr/bin/` (i2cd, gpiod,
   dw-acpi-i2cd, intel-gpiod, i2c-gpio-expanderd, i2c-hidd) → fixed.
5. **No init service for intel-lpss-i2cd** → added
   `00_intel-lpss-i2cd.service` (`type = { scheme = "i2c-lpss" }`, absolute
   cmd path — init PATH covers only /usr/bin); `dw-acpi-i2cd` service type
   upgraded from `oneshot_async` to `type = { scheme = "dw-acpi-i2c" }`;
   i2c-hidd `requires_weak` updated.
6. **Boot-order race** — controller daemons could lose registration if i2cd
   wasn't ready yet → bounded retry (100 × 50 ms) in `register_adapter`.

| # | Work item | Files | Effort |
|---|---|---|---|
| 4.1 | Identify actual ACPI `_HID` of the two LPSS I2C controllers on the host | — | ✅ DONE — **no `_HID` exists on this platform** (host-verified via sysfs: PCI function 00:15.0/00:15.1 ↔ `\_SB_.PC00.I2C0/I2C1`, DesignWare adapter spawned by intel-lpss MFD with `bxt_i2c_info`, 133 MHz). PCI-ID discovery implemented instead, per Linux's model |
| 4.2 | Controller bring-up: BAR/IRQ, DesignWare init sequence, bus speed | `drivers/i2c/designware/`, `intel-lpss-i2cd` | ✅ DONE (polling engine; IRQ-driven completion is a documented IRQ-plan follow-up, not a stub) |
| 4.3 | `i2c-hidd`: probe 04CA:00CC (PNP0C50), `_DSM` HID descriptor, report descriptor fetch | `i2c-hidd`, `i2cd`, endpoint chain | ✅ CODE-READY — protocol chain verified end-to-end in code (i2c-hidd's bare `I2cTransferRequest` → i2cd routing → provider endpoint). Runtime proof pending host boot (Phase 1) |
| 4.4 | Multitouch digitizer report parsing (ABS_MT_* slots, tracking IDs) + forwarding through inputd → evdevd gesture module | `i2c-hidd/{hid,input,report_desc}.rs` | ✅ CODE-COMPLETE (2026-07-21) — HID 1.11 §6.2.2 descriptor parser + decoder in new `report_desc.rs` (digitizer contacts, generic-desktop X/Y/wheel, buttons, keyboard page fallback, sign-extended fields, usage-min/max expansion, global-state stack). Integrated via `forward_layout_report`: first touching contact → absolute `MouseEvent`; two simultaneous contacts → vertical `ScrollEvent` (two-finger scroll); buttons → `ButtonEvent`. 3 unit tests pass on host. Runtime palm rejection / gesture tuning stays open with 4.5 (needs boot) |
| 4.5 | Host validation: pointer, click, two-finger scroll; palm-rejection tuning | — | S — OPEN (needs boot) |

**Adapter naming chain (documented for future consumers):**
touchpad `_CRS` `I2cSerialBus` resource source (e.g. `\_SB_.PC00.I2C0`) →
i2c-hidd sends it as `I2cTransferRequest.adapter` → i2cd resolves against
registered names + aliases (exact → normalized → last-component) →
provider daemon (intel-lpss-i2cd registered alias `PC00.I2C0` discovered by
matching `FixedMemory32 == BAR0`) → engine executes on the controller's BAR0.

**Gate 4 (partial):** base fork cooks for `x86_64-unknown-redox` with the new
chain; all unit tests pass (dw-i2c 3, intel-lpss-i2cd 3, i2c-hidd 3, others
green); binaries staged at verified paths. Full gate (touchpad usable on host)
is now blocked only on Phase 1 boot — 4.4 (multitouch parsing) landed
2026-07-21.

---

### PHASE 5 — Laptop ACPI events: GPE/EC/lid/buttons (M–L)

This phase removes the biggest "not a real laptop" gap: event-driven power state.

> **STATUS: CODE-COMPLETE (2026-07-21).** All five sub-items (P5.1–P5.5)
> landed plus a prerequisite P5.0; affected crates compile for
> `x86_64-unknown-redox`; `cook base` and `cook redbear-upower` succeed;
> i2c-hidd (3) + dw-i2c (5) + intel-lpss-i2cd (1) tests pass on host.
> acpid host-side tests can't link (pre-existing libredox limitation —
> tests must run via `redoxer`). Runtime Gate 5 remains open pending
> Phase 1 bare-metal boot.

**Prerequisite work (P5.0):**

The upstream `acpi-rs` crate (rev 90cbe88) **panicked** on every AML
`Notify (target, value)` opcode — the interpreter path was literally
`unimplemented!()`. Since `Notify` is the backbone of ACPI event flow
(EC queries fan it out, battery/AC/lid/thermal devices use it, _Qxx
methods end with `Notify(\_SB.BAT0, 0x80)`), this is unworkable on real
laptop firmware. Fixed by **vendoring the acpi-rs crate into the base
fork** (`drivers/acpi-rs/`) with a real `Opcode::Notify` executor:

- `src/aml/mod.rs`: resolves the target ACPI path, then invokes
  `Handler::handle_notify(target_path, value)`.
- `src/lib.rs`: new `Handler::handle_notify` default (no-op) so
  existing users of the crate (amlserde, others) keep compiling.
- `drivers/acpid/Cargo.toml` + `drivers/amlserde/Cargo.toml`: switched
  to `acpi = { path = "../acpi-rs", features = ["alloc", "aml"] }` so
  every consumer sees the same fork (avoids the dual-version trap).
- `Cargo.toml` (workspace): added `"drivers/acpi-rs"` to members.

This is a **vendored fork**, not a `local/sources/acpi-rs/` submodule.
It lives inside the base fork and travels with it. Upstream acpi-rs
has Notify unimplemented at the time of vendoring; if upstream lands a
real Notify implementation we will re-evaluate convergence per the
upstream-first rule (CONSOLE-TO-KDE § "upstream-first for fast-moving
components").

**Stub sweep in this phase:**

1. **acpi-rs `Notify` opcode was `unimplemented!()`** → vendored fork
   with a real executor that resolves the target path and calls back
   into the handler.
2. **acpid had no SCI/GPE/PM1 path at all** → new `gpe.rs` (FADT-driven
   GPE block map, write-1-to-clear status, read-modify-write enable
   preserving firmware state on every other GPE) + `power_events.rs`
   (init + SCI dispatch following Linux `evgpe.c` / `ec.c` / `button.c`).
3. **EC query protocol had no event-loop caller** → `pub fn sci_evt_set()`
   and `pub fn query()` exposed on `Ec`, called by the SCI handler with
   a 32-iteration bounded drain guard.
4. **No lid/button/fan scheme surface** → scheme.rs grew `Lid`,
   `LidState`, `ButtonDir`, `Button`, `Notifications`, `Fan`,
   `FanState`, `FanSpeed` handle kinds with proper directory-vs-file
   separation.
5. **`evaluate_acpi_method` took `&mut self`** → changed to `&self`
   everywhere; AML mutation goes through the existing `RwLock`-guarded
   `AmlSymbols` inner state, which is how the EC query loop and the
   notification drain can run from a read-only context.

**Review-fix round (2026-07-20):** this phase inherited all Phase 4
review fixes (LPSS PCI bring-up, I2C engine ordering, firmware op-mode
honesty) because it shares the base fork. No additional review has
been run on the Phase 5 surface yet; the implementation follows the
same Linux 7.1 reference patterns and bounded-validation discipline.

| # | Work item | Files | Status |
|---|---|---|---|
| 5.0 | *(prerequisite)* Real AML `Notify` opcode (was `unimplemented!()` in upstream acpi-rs) | `drivers/acpi-rs/` (vendored fork), `drivers/acpid/Cargo.toml`, `drivers/amlserde/Cargo.toml`, workspace `Cargo.toml` | ✅ DONE — vendored fork at base `drivers/acpi-rs/`; `Handler::handle_notify` hook added; all acpi consumers in the base workspace pointed at the path dep |
| 5.1 | **GPE dispatch infrastructure in acpid**: SCI via `/scheme/irq` (ACPI `sci_int` from FADT), GPE status/enable block access, per-GPE handler registry | `drivers/acpid/src/gpe.rs` (new), `drivers/acpid/src/main.rs` | ✅ DONE — `GpeBlocks::from_fadt` builds the register map; PM1 fixed-event bits (PWRBTN/SLPBTN/RTC) per ACPI 6.4 §4.8.3.1; enable preserve + status write-1-to-clear; main loop subscribes `/scheme/irq/{sci_irq}` (default 9) and dispatches via `handle_sci`. 2 unit tests cover block mapping + GPE1 base offset |
| 5.2 | EC event loop: `SCI_EVT` poll/IRQ → `QR_EC` query → dispatch `_Qxx` AML methods; wire battery/AC change notifications (`\_SB.BAT0` notify 0x80) | `drivers/acpid/src/power_events.rs` (new), `drivers/acpid/src/ec.rs`, `drivers/acpid/src/notifications.rs` (new), `drivers/acpid/src/aml_physmem.rs` | ✅ DONE — ECDT parse for EC device path + GPE (ACPI 6.4 §5.2.16) with `_HID = PNP0C09` probe fallback over conventional paths (mirrors Linux `acpi_ec_ecdt_start`); `handle_sci` drains the EC query queue (bounded at 32 iterations); `Ec::sci_evt_set()` / `Ec::query()` exposed; `_Qxx` AML methods evaluated; `AmlNotifications` shared queue receives `Notify` events pushed by the vendored acpi-rs `handle_notify` hook |
| 5.3 | Lid switch (PNP0C0D `_LID`) + power/sleep fixed events (PM1_STS PWRBTN/SLPBTN) → scheme surfaces + kstop events | `drivers/acpid/src/scheme.rs`, `drivers/acpid/src/power_events.rs`, `drivers/acpid/src/acpi.rs` | ✅ DONE — lid device discovered via `_LID` evaluation over candidate paths (EC child + `\_SB`); PM1 fixed events cleared-before-dispatch; surfaces at `/scheme/acpi/{lid/state, button/{power,sleep}, notifications}`; PowerButton increments edge counter and triggers the main-loop shutdown path; SleepButton increments counter and calls `enter_s2idle`; AML `Notify(\_SB.LID_,…)` refreshes `_LID` and emits `LidChanged(open)` on edge transitions |
| 5.4 | Event-driven `redbear-upower` (replace polling with notify-driven refresh) | `local/recipes/system/redbear-upower/source/src/main.rs` | ✅ DONE — added 250 ms `notify_interval` tokio arm draining `/scheme/acpi/notifications`; on non-empty drain, snapshots power state and emits `Changed` D-Bus signal if it changed. The existing 30 s poll arm stays as a safety net for missed events |
| 5.5 | Fan: real PNP0C0B/EC fan control replacing thermald soft model | `drivers/acpid/src/scheme.rs`, `drivers/acpid/src/power_events.rs`, `drivers/acpid/src/acpi.rs` | ✅ DONE — **implementation differs from the original plan wording**: instead of replacing thermald's soft fan model, acpid now owns the ACPI 4.0 fan method surface directly. Probes `_FST`-exposing devices over conventional placements (EC child + LPCB + `\_SB`), exposes read+write at `/scheme/acpi/fan/<idx>/{state,speed}` (`_FST` on read, `_FSL` on write, percent clamped 0–100). thermald keeps its soft model for now; convergence between the two is a Phase 9.x hardening task |

**Gate 5 (code-complete, runtime open):** Unplug/replug AC → instant
battery/AC event; close/open lid → event logged; power button → clean
shutdown flow; fan responds to thermal load. All code paths exist and
compile; none have been exercised on the host yet (Phase 1 boot is the
prerequisite). The 250 ms notification drain in redbear-upower should
turn the existing 30 s worst-case state lag into a near-instant event,
but this is a runtime claim and remains to be measured.

---

### PHASE 6 — Wi-Fi BE201: the iwlmld gap (XL, hardest network work)

Pre-agreed reality: **this is not a device-ID add.** The Mini-MVM layer is
iwlmvm-era; BE201 firmware is iwlmld-era with different command IDs, RX
descriptors, and notification dispatch. Respect `WIFI-IMPLEMENTATION-PLAN.md`
phases W0–W7.

| # | Work item | Files | Effort |
|---|---|---|---|
| 6.0 | De-risk transport on older silicon first: if any AX210-class card is available (USB/M.2 test card), validate existing Mini-MVM path end-to-end on the host's sibling hardware before touching iwlmld | redbear-iwlwifi | S (if HW available) |
| 6.1 | Firmware plumbing: add API-102+ iwlmld candidates to tables in `main.rs` + `redbear-wifictl/backend.rs` | `redbear-iwlwifi/source/src/main.rs`, `redbear-wifictl/source/src/backend.rs` | S → ✅ DONE (2026-07-22) — OpMode enum (Mvm/Mld), FirmwareTableEntry struct with separate mvm/mld candidate lists, iwlmld c101-c106 candidates added to both tables, StubBackend eliminated from wifictl, scan fake fallback removed |
| 6.2 | **Mini-MLD layer**: port Linux 7.1 `drivers/net/wireless/intel/iwlwifi/mld/` structures — new RX/multi-link descriptor format, notification IDs, op-mode registration; gate MLD vs MVM on device family (BZ→MLD) | new `linux_mld.{c,h}` beside `linux_mvm.{c,h}`; `linux_port.c` op-mode dispatch | XL |
| 6.3 | Bounded runtime ladder on host: probe → fw boot alive → scan (see real SSID) → association → DHCP → reconnect persistence. Use existing `redbear-phase5-wifi-*` in-guest harness | redbear-wifictl + test scripts | M (iterative) |
| 6.4 | Integration: netctl profile, boot-time autoconnect, honest `redbear-info` states | wifictl, config fragments | S |

**Gate 6:** BE201 associates with the host's AP and passes traffic on the host —
real wireless connectivity, not bounded simulation.

---

### PHASE 7 — Bluetooth: Intel CNVi BT (M)

| # | Work item | Files | Effort |
|---|---|---|---|
| 7.1 | Intel BT firmware load in `redbear-btusb`: bootloader-mode detection, `ibt-0093-0291.sfi` download, DDC apply — port from Linux `btintel.c` | `local/recipes/drivers/redbear-btusb/` | M → 🟡 PARTIAL (2026-07-22) — btintel.rs: IntelVersion parse, MFG enter/exit, firmware download command sequence (CSS header + PKey + Signature + payload fragments, RSA/ECDSA), boot param extraction, SFI/DDC filename tables, 9 unit tests. HCI transport wiring (event-driven fragment ack) remains. |
| 7.2 | HCI bring-up on the host: reset → read version → operational mode; bounded BLE battery-level slice validation via existing harness | btusb + `test-bluetooth-qemu.sh` host analogue | M |
| 7.3 | `redbear-btctl` scan/pair/connect on host | redbear-btctl | S |

**Gate 7:** `redbear-btctl` sees and connects to a BLE peripheral on the host.

---

### PHASE 8 — Audio: SOF/cAVS (XL, largest single effort)

| # | Work item | Files | Effort |
|---|---|---|---|
| 8.0 | Interim (do first): USB-audio dongle path via `redbear-usbaudiod` validated on host — documented as the interim answer | redbear-usbaudiod | S |
| 8.1 | Probe ihdad on 8086:7728 to record exact failure mode (expected: no codecs behind DSP); ensure graceful failure, never a boot hang | `ihdad/src/hda/device.rs` | S |
| 8.2 | **SOF/AVS port**: cAVS 2.5 (ARL) DSP bring-up — power gating, ROM boot, `sof-arl.ri` firmware download via firmware-loader, IPC4 channel, HDA link DMA. Reference: `local/reference/linux-7.1/sound/soc/sof/intel/` + `sound/soc/intel/avs/`; revive `local/docs/archived/INTEL-HDA-IMPLEMENTATION-PLAN.md` HDA-011 track | new `local/recipes/drivers/redbear-sof/` (per LINUX REFERENCE SOURCE POLICY: implemented in-tree, Linux as reference only) | XL |
| 8.3 | ALC298 codec verbs over the HDA link; speaker + headphone jack routing; DMIC later | sof codec layer | L |

**Gate 8:** Speaker playback on the host. (DMIC + HDMI audio are post-gate follow-ups.)

---

### PHASE 9 — Platform extras (post-core, S–M each)

| # | Item | Notes | Effort |
|---|---|---|---|
| 9.1 | **Suspend (s2idle) completion**: LPIT parser (ACPI 6.5 §5.2.9.9), MWAIT idle-loop wiring, `_PRW` wake-device enumeration, GPE wake re-arm. The host has **no S3** — this is the only suspend path | `acpid`, kernel idle | L → 🟡 PARTIAL (2026-07-22) — LPIT parser + _PRW wake enumeration + FADT S0-idle detection done (acpid/wake.rs); MWAIT idle loop and GPE wake re-arm remain (needs kernel idle-loop support) |
| 9.2 | LG WMI hotkeys: WMI subsystem (PNP0C14 GUID dispatch) → brightness/rfkill/volume events → evdev | new `redbear-wmi` | M |
| 9.3 | UVC camera: new `redbear-uvcd` (UVC 1.1/1.5) — well-specified; reference Linux `drivers/media/usb/uvc/` | new recipe | L |
| 9.4 | ISH sensor hub (8087:0AC2): only if a consumer exists (auto-rotate/ALS). Lowest priority | — | M |
| 9.5 | Intel VT-d runtime (`intel_vtd.rs` in iommu daemon): converges acpid's orphaned DMAR parser into the daemon (per ACPI-IMPROVEMENT-PLAN ownership note). Value: DMA isolation for later Wi-Fi/GPU hardening | `local/recipes/system/iommu/` | L |
| 9.6 | Non-critical devices documented as permanent no-driver: MEI, GNA, VPU/NPU, PMC telemetry, SMBus, SPI, UART, TPM — with one-line justification each (no consumer) | this doc | S → ✅ DONE (2026-07-22) — see below |

**Phase 9.6 — permanent no-driver devices (LG Gram 16Z90TP):**

| Device | PCI ID | Justification |
|---|---|---|
| MEI (Intel Management Engine) | 8086:7770 | No consumer. MEI exposes firmware management interfaces; Red Bear OS has no management engine client, no AMT, no PTT. Not boot-critical. |
| GNA (Gaussian Neural Accelerator) | 8086:774c | No consumer. GNA is an inference accelerator for ML workloads; no Red Bear OS software uses it. |
| VPU/NPU (Neural Processing Unit) | 8086:7d1d | No consumer. NPU is for AI inference offload; no Red Bear OS software uses it. |
| PMC telemetry | 8086:777f | No consumer. PMC exposes power management controller telemetry; Red Bear power monitoring uses MSR-based RAPL/coretemp instead. |
| SMBus | 8086:7722 | No consumer. SMBus is for legacy system management peripherals; no Red Bear OS devices use SMBus. |
| SPI | 8086:7723 | No consumer. SPI is for embedded flash/sensor access; no Red Bear OS devices use SPI on this platform. |
| UART | 8086:7745 | Debug-only. 16550 UART at 0x3f8 (DBG2); available for serial console debugging but no production consumer. |
| TPM2 | PNP0C31 | No consumer. TPM is for measured boot and attestation; Red Bear OS does not implement secure boot or remote attestation. |

**No stubs anywhere in this phase — per local/AGENTS.md zero-tolerance policy,
each item is a real implementation or it does not ship.**

---

### PHASE 10 — Validation, quirks, and hardening (continuous)

| # | Item |
|---|---|
| 10.1 | Keep `HARDWARE-VALIDATION-MATRIX.md` row for 16Z90TP current after every phase gate |
| 10.2 | Every discovered hardware workaround → data-driven quirk entry (compiled table or `redbear-quirks` TOML + DMI match), never an `#ifdef`-style special case |
| 10.3 | Boot logs per milestone archived to `local/docs/boot-logs/` |
| 10.4 | Durability: all source changes land as fork commits (`local/sources/*`) or patches (`local/patches/*`) in the same session — per DURABILITY POLICY |
| 10.5 | Upstream-sync safety: any new generic infrastructure (GPE dispatch, Mini-MLD, SOF) is implemented in the canonical component (acpid / redbear-iwlwifi / new recipe), not as host-specific hacks |

---

## 5. Dependency Graph

```
Phase 0 (collision fix, quirks, firmware) ──► Phase 1 (BM boot validation)
Phase 1 ──► Phase 2 (power validation)
Phase 1 ──► Phase 3 (display)            ──► desktop path (Qt6/KWin on host)
Phase 1 ──► Phase 4 (touchpad)           ──► usable laptop input
Phase 1 ──► Phase 5 (ACPI events)        ──► Phase 9.1 (suspend)
Phase 1 ──► Phase 6 (Wi-Fi, XL)          ──► network without dongle
Phase 1 ──► Phase 7 (Bluetooth)
Phase 1 ──► Phase 8 (audio SOF, XL)
Phase 3+4+5+6 complete = "daily-drivable laptop" milestone
```

## 6. Suggested Execution Order (effort-sequenced)

1. **Phase 0 + 1** — boot the host, fix the e1000d collision, capture the matrix (week 1)
2. **Phase 4 (touchpad)** + **Phase 2 (power)** — makes it a *usable* laptop (weeks 1–3)
3. **Phase 5 (ACPI events)** — makes it a *real* laptop (weeks 3–6)
4. **Phase 3 (display DRM)** — desktop path on the host (weeks 3–10, parallel)
5. **Phase 6 (Wi-Fi iwlmld)** — the XL rock to push (start early, longest lead time)
6. **Phase 7 (BT)**, **Phase 8 (audio)** — after their USB/PCI substrates are proven
7. **Phase 9 extras** — as capacity allows

## 7. Explicitly Out of Scope (per policies)

- No removal/ignore/comment-out of any package or device entry that fails to probe
  (ABSOLUTE RULE) — failures get root-cause fixes or honest "unsupported" reporting.
- No new branches, repos, or submodules without the documented necessity case.
- Linux kernel source is reference-only; all ports are in-tree implementations.
- TPM2/secure-boot/ME features — no consumer, no plan.