Repository navigation
HID: dockchannel-hid: write each frame to the FIFO under one lock - #1010
Conversation
Keep the boot loader DMA context for a running J613 MTP session. Admit only the T8122 MTP DART at 0x2fa808000, exactly stream 1, and verify that its control register still selects bypass before skipping reset. Select an identity domain and reject paging, blocked-domain attachment and runtime suspend while the inherited session runs. Retain the clock and bypass state at removal. This permits the existing mtp-live-v1 RTKit adoption path to keep serving input without another INIT. The C-diag11 implementation passed owner input testing on J613 with firmware 26.6.2. The rebased series requires a separate owner boot test. Signed-off-by: Satya Benson <satya@benson.earth>
The J613 and J615 25G83 device trees list the MTP as "apple,t8122-mtp", "apple,t8122-rtk-helper-asc4", "apple,mtp" without the generic "apple,rtk-helper-asc4" fallback, and say that Linux binds the SoC-specific compatible. The helper only matches the generic one, so on those boards it never probes, DockChannel HID defers forever and the built-in keyboard and trackpad stay absent. Match "apple,t8122-rtk-helper-asc4" as well. Signed-off-by: Satya Benson <satya@benson.earth>
…port-328-20261104
…port-328-20261104
Conflict in drivers/iommu/apple-dart.c, apple_dart_probe(): integration added the v2.2 reg size check (d6b6f2e, #924) right after the stream count check, where this branch adds the J613 live MTP bypass check. Keep both. The size check comes first: it only needs num_streams and validates the MMIO region before the J613 check reads a stream control register. Both checks fail the probe, so the order only decides which error a bad node reports. The J613 MTP DART node has a 0x4000 reg. T8122 DARTs report a version below 2.2: the other T8122 DARTs have the same reg size and are reset on J613 by kernels whose reset path reads the v2.2 exception records at 0x8000, without faulting. The size check therefore does not refuse the J613 MTP DART.
dchid_send() writes a frame as up to four dockchannel_send() calls: header, body, tail word and checksum. Only the interface's out_mutex serializes it, so frames for two interfaces can interleave in the shared TX FIFO. On J613 (M3 MacBook Air, T8122, 26.6.2 firmware) this crashes the MTP firmware, and the internal keyboard and trackpad stay dead until reboot. The firmware's crash log reads RTKit: Message (id=1): [dock ch tl]: xsum err [comp=0xfff2ec9d; rcvd=0xc1108] rcvd holds the bytes 08 11 0c 00: the header of a 12-byte command frame, an interface enable, where another frame's checksum belonged. In the three crashed boots, the actuator enable (0xb4 on comm) and magicmouse's dimension query (0xd9 on multi-touch, sent when multi-touch reports ready) both timed out at the same moment. Hold a transport-wide mutex across the writes of one frame. dchid_send() is the only path that writes to the FIFO. The lock order is the interface's out_mutex, then tx_mutex. The host test sends frames from two interfaces in two threads through the production dchid_send() and parses the FIFO with dchid_verify_checksum(); the driver before this change fails it. Signed-off-by: Satya Benson <satya@benson.earth>
|
J613 boot result on 7.3 (rubra, M3 MacBook Air 13", macOS 26.6.2 / 25G83 firmware), 2026-11-05.
|
2e785e9 to
f891a95
Compare
Keep only the transport-wide MTP TX frame lock and registered tests over the merged J613 handoff fix. Preserve zero-stream/J700 admission and newer DART PM handling. Signed-off-by: DjDeveloperr <43033058+DjDeveloperr@users.noreply.github.com>
DjDeveloperr
left a comment
DjDeveloperr
left a comment
There was a problem hiding this comment.
Codex (GPT-6.1 Sol), reviewing on @DjDeveloperr’s behalf.
No blocking findings in the rebased lock-only change. Latest #971 is now merged; this head targets integration/aurora and its net delta is only dockchannel-HID, the existing concurrent-frame regression harness and its runner entry. The stale DART handoff implementation was not reintroduced. A transport-wide mutex covers the complete frame helper and releases on error via its wrapper; initialization precedes interface setup. Existing production-code positive and real old-code negative controls passed locally, including 40+40 concurrent frames. Fresh broad host CI is required before merge: retargeting emits edited and did not trigger host-tests, so I dispatched the workflow once on this exact branch. Source/Rust/KUnit CI also runs. Repeated startup/physical input and cross-board regression remain rollout follow-ups, not fresh hardware claims from this review.
|
GPT-6.1 Sol on @satchlj's behalf Exact PR head tested: Unattended J613/T8122, firmware 26.6.2. Kernel The listed production-source fixture ran on J613 both on the initial 30.12 baseline and again on the exact combined trial: 40 + 40 concurrent-interface frames, all whole and checksum-valid. Both fixture inputs are byte-identical to this PR head:
This compiles/exercises production functions against the fixture FIFO; it is not a hardware FIFO trace. Trial boot and three RTC s2idle cycles had keyboard/multi-touch evdev nodes and no MTP/checksum crash diagnostics. The RTC loop's SSH stdout transport was lost, but all three completed sleeps were recovered from the durable kernel journal; the post-cycle device inventory is saved. Not run: the old-transport negative control, repeated cold-boot race-window campaign/instrumentation, or physical typing/trackpad interaction. Left on default 30.12, trial cleaned and lease released. |
Stacked on #971 (J613 MTP live handoff); review that first.
On J613 (M3 MacBook Air, 26.6.2 firmware) the built-in keyboard and trackpad sometimes die right after boot: the adopted MTP firmware crashes about 1 s after the kernel takes over, and input stays dead until reboot.
Cause:
dchid_send()writes one frame as up to fourdockchannel_send()calls (header, body, tail, checksum), serialized only by the per-interfaceout_mutex. Two interfaces can therefore interleave frames in the shared TX FIFO. The firmware's crash log shows it:rcvdis08 11 0c 00, the header of a 12-byte interface-enable command sitting where another frame's checksum belonged. In all three crashed boots the actuator enable (0xb4 on comm) and magicmouse's dimension query (0xd9 on multi-touch, sent as multi-touch reports ready) were in flight together.Fix: a transport-wide lock held across all
dockchannel_send()calls of one frame.dchid_send()is the only TX path.Testing:
tools/asahi/mtp-tx-frame-tests.py(registered inrun-host-tests.py) reproduces the interleave on the old code and passes with the fix.@DjDeveloperr @RyanTheTide