From: Shih-Yuan Lee <fourdollars@debian.org>
To: Dmitry Torokhov <dmitry.torokhov@gmail.com>,
Mark Brown <broonie@kernel.org>
Cc: linux-input@vger.kernel.org, linux-spi@vger.kernel.org,
linux-kernel@vger.kernel.org,
Shih-Yuan Lee <fourdollars@debian.org>
Subject: [PATCH v5 3/3] spi: pxa2xx: disable DMA for Apple MacBook8,1
Date: Sat, 11 Jul 2026 21:11:40 +0800 [thread overview]
Message-ID: <20260711131140.18777-4-fourdollars@debian.org> (raw)
In-Reply-To: <20260711131140.18777-1-fourdollars@debian.org>
On MacBook8,1 (early 2015 12" MacBook), the LPSS SPI controller's DMA
handshake and interrupt routing frequently fail or time out on boot,
causing the keyboard and trackpad to become unresponsive.
Avoid this architectural bug by disabling DMA and forcing the SPI
controller to use PIO mode. Move this platform/motherboard-level quirk
to the SPI host controller driver (spi-pxa2xx-pci.c) where LPSS setup
occurs, preventing layering violations, TOCTOU races, or execute-after-free
bugs in the client driver.
Additionally, introduce a `force_pio` module parameter in the PCI
host controller driver to allow other users to force PIO mode for
debugging.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=108331
Signed-off-by: Shih-Yuan Lee <fourdollars@debian.org>
---
drivers/spi/spi-pxa2xx-pci.c | 35 +++++++++++++++++++++++++++++++++--
1 file changed, 33 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
index cae77ac18520..31bdaa096d9e 100644
--- a/drivers/spi/spi-pxa2xx-pci.c
+++ b/drivers/spi/spi-pxa2xx-pci.c
@@ -18,9 +18,14 @@
#include <linux/dmaengine.h>
#include <linux/platform_data/dma-dw.h>
+#include <linux/dmi.h>
#include "spi-pxa2xx.h"
+static bool spi_pxa2xx_force_pio;
+module_param_named(force_pio, spi_pxa2xx_force_pio, bool, 0444);
+MODULE_PARM_DESC(force_pio, "Force PIO mode (disables DMA) for SPI transfers. ([0] = disabled, 1 = enabled)");
+
#define PCI_DEVICE_ID_INTEL_QUARK_X1000 0x0935
#define PCI_DEVICE_ID_INTEL_BYT 0x0f0e
#define PCI_DEVICE_ID_INTEL_MRFLD 0x1194
@@ -93,6 +98,32 @@ static void lpss_dma_put_device(void *dma_dev)
pci_dev_put(dma_dev);
}
+static const struct dmi_system_id pxa2xx_spi_pci_dmi_table[] = {
+ {
+ .ident = "Apple MacBook8,1",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBook8,1"),
+ },
+ },
+ { }
+};
+
+static bool pxa2xx_spi_pci_can_dma(struct pci_dev *dev)
+{
+ if (spi_pxa2xx_force_pio) {
+ pci_info(dev, "Forcing PIO mode (disabling DMA)\n");
+ return false;
+ }
+
+ if (dmi_check_system(pxa2xx_spi_pci_dmi_table)) {
+ pci_info(dev, "MacBook8,1 detected: disabling DMA to force PIO mode\n");
+ return false;
+ }
+
+ return true;
+}
+
static int lpss_spi_setup(struct pci_dev *dev, struct pxa2xx_spi_controller *c)
{
struct ssp_device *ssp = &c->ssp;
@@ -166,7 +197,7 @@ static int lpss_spi_setup(struct pci_dev *dev, struct pxa2xx_spi_controller *c)
c->dma_filter = lpss_dma_filter;
c->dma_burst_size = 1;
- c->enable_dma = 1;
+ c->enable_dma = pxa2xx_spi_pci_can_dma(dev);
return 0;
}
@@ -238,7 +269,7 @@ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa2xx_spi_controller *c)
c->dma_filter = lpss_dma_filter;
c->dma_burst_size = 8;
- c->enable_dma = 1;
+ c->enable_dma = pxa2xx_spi_pci_can_dma(dev);
return 0;
}
--
2.39.5
prev parent reply other threads:[~2026-07-11 13:11 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260711055247.5412-1-fourdollars@debian.org>
2026-07-11 11:49 ` [PATCH v4 0/3] Input/SPI: fixes for MacBook8,1 DMA timeout, UAF, and NULL pointer dereference Shih-Yuan Lee
2026-07-11 11:49 ` [PATCH v4 1/3] Input: applespi - cancel pending work on driver remove Shih-Yuan Lee
2026-07-11 11:49 ` [PATCH v4 2/3] Input: applespi - fix NULL pointer dereference in tp_dim open Shih-Yuan Lee
2026-07-11 11:49 ` [PATCH v4 3/3] spi: pxa2xx: disable DMA for Apple MacBook8,1 Shih-Yuan Lee
2026-07-11 13:11 ` [PATCH v5 0/3] Input/SPI: fixes for MacBook8,1 DMA timeout, UAF, and NULL pointer dereference Shih-Yuan Lee
2026-07-11 13:11 ` [PATCH v5 1/3] Input: applespi - cancel pending work on driver remove Shih-Yuan Lee
2026-07-11 13:11 ` [PATCH v5 2/3] Input: applespi - fix NULL pointer dereference in tp_dim open Shih-Yuan Lee
2026-07-11 13:11 ` Shih-Yuan Lee [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260711131140.18777-4-fourdollars@debian.org \
--to=fourdollars@debian.org \
--cc=broonie@kernel.org \
--cc=dmitry.torokhov@gmail.com \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox