From 6777e6e3997031e9295c89f69a3acfc656b22de3 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Sat, 10 Oct 2026 06:10:08 +0200
Subject: [PATCH] fix(firmware): route hotplug/notify acpi names through
 get_mimic_pci_name so macos loads the dsdt

---
 docs/ANALYSIS.md               | 22 +++++++++++++
 patches/qemu/01-firmware.patch | 57 +++++++++++++++++++++++++++++++---
 2 files changed, 75 insertions(+), 4 deletions(-)

diff --git a/docs/ANALYSIS.md b/docs/ANALYSIS.md
index cd8d4e9..1b95222 100644
--- a/docs/ANALYSIS.md
+++ b/docs/ANALYSIS.md
@@ -205,6 +205,28 @@ or device ID changes, so `DEVICES` / `PCI_VENDOR` / `CPU_HEURISTIC` are untouche
 Fix: drop the `ICH9_SATA1_DEV` hunk, leave SATA at stock `1f.2`. macOS boots on the default series;
 0/85 preserved.
 
+### CLEARED - the dangling ACPI name macOS aborts the DSDT on (folded into `01-firmware`)
+
+`01-firmware` renames the cold-plug PCI device ACPI nodes through `get_mimic_pci_name`
+(`build_append_pci_bus_devices`) to break the stock `S`+hex NameSeg signature. It left the hotplug
+and bus-notification code naming/referencing the *same* devices by the old `S%.02X` scheme, in four
+spots: the child-bridge `Scope` and `^S%.02X.PCNT` cross-reference in
+`build_append_notification_callback`, the `Notify()` target in `build_append_pcihp_notify_entry`,
+and the per-slot `Scope`/`Device` in `build_append_pcihp_slots`. So the DSDT opens `Scope(S13)` on a
+device actually declared `GFX3` - a dangling NameSeg.
+
+Only macOS exposes it. Its ACPI parser aborts the whole DSDT load on the missing name:
+`[S13_] Namespace lookup failure` -> `[DSDT] table load failed` -> `[\_SB.PCI0] ... AE_NOT_FOUND`,
+then it hangs in early IOKit (last line `AppleACPIPlatformExpert/cpus`). Linux and Windows swallow
+the `AE_NOT_FOUND` and boot on, which is why the identity guests never showed it - only a from-scratch
+macOS recovery boot did. Diagnosed with macOS IOKit verbose (`boot-args io=0xffffffff`).
+
+Fix (in `01-firmware`, alongside the `get_mimic_pci_name` definition it completes): route those four
+sites through `get_mimic_pci_name` so definitions and references agree. It *removes* `S%.02X`
+NameSegs rather than adding any, so the score is unaffected - re-measured on the rebuilt binary,
+VMAware v2.8.1 and HEAD both `detected=0`/`FIRMWARE=0`, and a Tahoe recovery boots to the installer
+GUI.
+
 ---
 
 ## CLEARED - CTYPE and SMBIOS_VM_BIT (the SMBIOS QEMU synthesises)
diff --git a/patches/qemu/01-firmware.patch b/patches/qemu/01-firmware.patch
index 3ca4cbd..03165ca 100644
--- a/patches/qemu/01-firmware.patch
+++ b/patches/qemu/01-firmware.patch
@@ -193,10 +193,9 @@ index 8837b69..4001d9d 100644
      if (pcms->wdat_enabled == true) {
          g_assert(pm.tco_io_base);
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
-index 87162ff2c..3616c580a 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
-@@ -687,10 +687,10 @@ void build_append_pcihp_resources(Aml *scope /* \\_SB.PCI0 */,
+@@ -687,10 +687,10 @@
  {
      Aml *dev, *crs;
  
@@ -209,7 +208,7 @@ index 87162ff2c..3616c580a 100644
      /* device present, functioning, decoding, not shown in UI */
      aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
      crs = aml_resource_template();
-@@ -699,6 +699,89 @@ void build_append_pcihp_resources(Aml *scope /* \\_SB.PCI0 */,
+@@ -699,6 +699,89 @@
      aml_append(scope, dev);
  }
  
@@ -299,7 +298,57 @@ index 87162ff2c..3616c580a 100644
  bool build_append_notification_callback(Aml *parent_scope, const PCIBus *bus)
  {
      Aml *method;
-@@ -912,7 +995,11 @@ void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus)
+@@ -708,7 +791,9 @@
+     GQueue *pcnt_bus_list = g_queue_new();
+ 
+     QLIST_FOREACH(sec, &bus->child, sibling) {
+-        Aml *br_scope = aml_scope("S%.02X", sec->parent_dev->devfn);
++        char mimic_nm[5];
++        get_mimic_pci_name(mimic_nm, sec->parent_dev->devfn);
++        Aml *br_scope = aml_scope("%s", mimic_nm);
+         if (pci_bus_is_root(sec)) {
+             continue;
+         }
+@@ -747,7 +832,9 @@
+ 
+     /* Notify about child bus events in any case */
+     while ((sec = g_queue_pop_head(pcnt_bus_list))) {
+-        aml_append(method, aml_name("^S%.02X.PCNT", sec->parent_dev->devfn));
++        char mimic_nm[5];
++        get_mimic_pci_name(mimic_nm, sec->parent_dev->devfn);
++        aml_append(method, aml_name("^%s.PCNT", mimic_nm));
+     }
+ 
+     aml_append(parent_scope, method);
+@@ -802,9 +889,11 @@
+ {
+     Aml *if_ctx;
+     int32_t devfn = PCI_DEVFN(slot, 0);
++    char mimic_nm[5];
+ 
++    get_mimic_pci_name(mimic_nm, devfn);
+     if_ctx = aml_if(aml_and(aml_arg(0), aml_int(0x1U << slot), NULL));
+-    aml_append(if_ctx, aml_notify(aml_name("S%.02X", devfn), aml_arg(1)));
++    aml_append(if_ctx, aml_notify(aml_name("%s", mimic_nm), aml_arg(1)));
+     aml_append(method, if_ctx);
+ }
+ 
+@@ -867,10 +956,12 @@
+             continue;
+         }
+ 
++        char mimic_nm[5];
++        get_mimic_pci_name(mimic_nm, devfn);
+         if (bus->devices[devfn]) {
+-            dev = aml_scope("S%.02X", devfn);
++            dev = aml_scope("%s", mimic_nm);
+         } else {
+-            dev = aml_device("S%.02X", devfn);
++            dev = aml_device("%s", mimic_nm);
+             aml_append(dev, aml_name_decl("_ADR", aml_int(adr)));
+         }
+ 
+@@ -912,7 +1003,11 @@
          }
  
          /* start to compose PCI device descriptor */