From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E113033A9E2 for ; Sat, 11 Jul 2026 06:54:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783752884; cv=none; b=R907cH02za5VeGVNvano/OmGSUPxkS58Z+NSe3QZlK51Hd0gV1/djdWEFeJP6OV2Sb3gy44USGo7papHZfhbxKBmQzNsV8t/wY7YeKu6niydTO1K0ugpPCd2J+XO5JtFqXKQIx9Iz2shKknkA3uGTRLOtWMaAiE+WeE2Dw5QkxM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783752884; c=relaxed/simple; bh=r8zVy/hy4V0/8I+I9cgXPbXLAFAu3TqXTM7jHRDzT5U=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=mzS8tCRN/gBfN62BoyJ3lFjQ4f7stY1w1ju5ZNP90SIFHiCezB4XyqYSyl2BdGd4zj86YmlNHpGGvxL9HjAcq0kP2sFFxN6PQjcG91NKI4lzianXLbALk4/d228OEk9AiixihCUKVg8bPCAyyYETNOiKrkLtQIKh8z9SXRAjV6M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2c7c61b5292so29326665ad.0 for ; Fri, 10 Jul 2026 23:54:42 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783752882; x=1784357682; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=LnDtSBfU0+MIPTjDEiJMV7jjCz5ET5nDw4xwWOKlpbE=; b=L5w4xgNY/W+jBe0sS+TTG4jxX6SaUTfIYY9TRnbvNfiwj6WVAD4BGfD5Tp3ckMtVcP cSar5ZlGtffW5VnMA+DsJzg5MsIHEYMl+5H0lokFc4hkWwzFYg4viaDGp3fnbAKiKKpd HT3AiSygRZleYSgjeAlHQmdU4SbKvMWZjo3WWYVFJL1N+FprH3ZvvYxrJoFZ0UI+17FN /atkGFNZvWECr5kqQquGpkhveESNfbdVVq3rLO5HRYHPLPTPJYzIyMEAMudy1V8ECmdD N1V6ZGyiayxRawEkWxLIY2Meyhi+Yk/F5EXRJxdTJWMPENFAxQ9u+ME1pCyClYPNl/R+ vq/Q== X-Forwarded-Encrypted: i=1; AHgh+RpW+BYBbULRVKjvcQaz4bS32CfJVzElExBjSS6udAPz7J9UVD3I5ulOmK/zMH45TQHOl4X5hhyhj5XmTZg=@vger.kernel.org X-Gm-Message-State: AOJu0YyduTTrv4G4bAiN4zQFPuOIOVfzOqnosDICKRHP/CSc2bcDdnip ud/cIGVPSVJveB950RFiYT8amhmWwrv0JKYsckRsHtFVoFqfvF0/FN4= X-Gm-Gg: AfdE7cnygSfBp7OukNfalGhOkLrLqfzpcbhCJoHTiIDVjbLdDrsWQ7VK3rH0CR5QGB5 72ZylPgnNhWaagdTyPuK2s7+G5qcGsD+59A0Bw2UfFmCC3KEROSH0Tngjh+UUeltXuXNzxlgw4S rK9ULxvHGwrSDDSeNA4plzGWPTk0UdZdgN7wALA2vs2B5kUfl+ISTjfR5cwRjF5pPz5WoRiScUM 4s6A0M0sqImskJa9UdJLoFnhRiUkJ9xcc2DJ/tk7MPsKh49IkZ5FTk5Fyfk8p7hj/8MGlQnzNkk 0UdfLr8l+8hjr506s8/crVkMvbrFXaTNdyV4S/x9qqLS/WB5yqnddHrZC4SWS/hpoaIhaewEMUS x/v/UjnW6UOAxLkNEMAEAtSuOkziPw88qdDYyoJttia0KSrvJEKFSsuBrePNvIJuU8A4i8YvqCo XWkuDzTYRhhOgz47dI3wll1MbiS7n/MJ38rCP8PBUy5ocvUIzr6unQbtyM+LRgTBwBYj/aTzzuB 8fWHZ0VDklAXOHtKFi77exlylVwfZAKvnVl X-Received: by 2002:a17:903:2f90:b0:2ca:4cfd:a6ea with SMTP id d9443c01a7336-2ce9e7b0335mr19692175ad.16.1783752882319; Fri, 10 Jul 2026 23:54:42 -0700 (PDT) Received: from penguin.tail0a1999.ts.net (61-228-52-13.dynamic-ip.hinet.net. [61.228.52.13]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ce8f5183b9sm18272535ad.5.2026.07.10.23.54.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 23:54:41 -0700 (PDT) From: Shih-Yuan Lee To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Shih-Yuan Lee Subject: [PATCH v2 1/3] Input: applespi - force PIO mode on MacBook8,1 Date: Sat, 11 Jul 2026 14:54:13 +0800 Message-Id: <20260711065415.7396-2-fourdollars@debian.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260711065415.7396-1-fourdollars@debian.org> References: <20260711055247.5412-1-fourdollars@debian.org> <20260711065415.7396-1-fourdollars@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On MacBook8,1 (early 2015 12" MacBook), the LPSS SPI controller's DMA handshake and interrupt routing frequently fail or time out after warm reboots, causing the keyboard and trackpad to become unresponsive and spamming "SPI transfer timed out" (-110) errors to dmesg. Address this by introducing a DMI quirk inside the probe function that detects the MacBook8,1 model and overrides the controller's can_dma callback to a custom helper that always returns false. This forces the host controller to fall back to the rock-solid PIO mode. Since we overwrite the shared host controller's can_dma callback, save the original callback pointer during probe and restore it in the unbind (remove) path to prevent an execute-after-free vulnerability when the applespi driver is unloaded. Signed-off-by: Shih-Yuan Lee --- drivers/input/keyboard/applespi.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/applespi.c index b5ff71cd5a70..07a910cb8459 100644 --- a/drivers/input/keyboard/applespi.c +++ b/drivers/input/keyboard/applespi.c @@ -45,6 +45,7 @@ #include #include #include +#include #include #include #include @@ -431,6 +432,10 @@ struct applespi_data { int tp_dim_max_x; int tp_dim_min_y; int tp_dim_max_y; + + bool (*original_can_dma)(struct spi_controller *controller, + struct spi_device *spi, + struct spi_transfer *xfer); }; static const unsigned char applespi_scancodes[] = { @@ -1605,6 +1610,13 @@ static void applespi_save_bl_level(struct applespi_data *applespi, "Error saving backlight level to EFI vars: 0x%lx\n", sts); } +static bool applespi_can_not_dma(struct spi_controller *controller, + struct spi_device *spi, + struct spi_transfer *xfer) +{ + return false; +} + static int applespi_probe(struct spi_device *spi) { struct applespi_data *applespi; @@ -1788,6 +1800,19 @@ static int applespi_probe(struct spi_device *spi) debugfs_create_file("tp_dim", 0400, applespi->debugfs_root, applespi, &applespi_tp_dim_fops); + /* + * MacBook8,1's SPI host controller DMA is broken (timeout errors). + * Force PIO mode by overriding the controller's can_dma callback. + * + * Since we modify the shared controller's callback, we save the + * original pointer and restore it in applespi_remove(). + */ + applespi->original_can_dma = spi->controller->can_dma; + if (dmi_match(DMI_PRODUCT_NAME, "MacBook8,1")) { + dev_info(&spi->dev, "Disabling DMA for MacBook8,1 SPI to force PIO mode\n"); + spi->controller->can_dma = applespi_can_not_dma; + } + return 0; } @@ -1822,6 +1847,9 @@ static void applespi_remove(struct spi_device *spi) applespi_drain_reads(applespi); + if (applespi->original_can_dma) + spi->controller->can_dma = applespi->original_can_dma; + debugfs_remove_recursive(applespi->debugfs_root); } -- 2.39.5