Repository navigation
drm/apple: preserve physical disconnect through failed teardown - #295
Closed
RyanTheTide wants to merge 12 commits into
Closed
RyanTheTide wants to merge 12 commits into
RyanTheTide wants to merge 12 commits into
Conversation
A fatal PIPE check or USB3 host lock failure returns before the mux is changed, but the wrapper still records the requested backend. Subsequent PHY set_mode calls then skip the failed setup. Parking has the same false state update when its initial check fails. Record the backend only after successful setup or parking. When a fixed hub's lane mode already matches the Type-C request, retry an outstanding PIPE setup without reconfiguring lanes or disturbing DisplayPort ownership. Keep the existing mode-dirty gate and fatal USB3 host lock ACK requirement. Add host fault injection of the production PIPE functions and PHY/Type-C callbacks. Cover all mode backends, both USB3 host BIST generations, repeated fixed-hub retries, parking, SAFE USB2 and capability guards. The baseline fails each regression group; the corrected functions pass with address and undefined-behavior sanitizers. The register sequence is unchanged. Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
A failed PIPE parking check leaves the previous backend selected. The fixed-hub mux and USB3 power-off callbacks nevertheless continue lane or power changes, and the reset callback also powers down USB2 and reports success. This drops ownership assumptions while the PIPE is still live. Return the parking error and stop each caller before its next transition. Park before asserting DWC3 reset so a fatal check cannot leave the controller reset or USB2 powered off. Keep host state, mode dirtiness and DP ownership intact on failure. The PIPE handshake policy is unchanged. Add sanitized host fault injection of the production mux, power-off and reset callbacks, including their actual PIPE, mode, AUX and PMA functions. Cover repeated failures and recovery across dirty states and orientation, and verify fixed-hub SAFE retains USB2. Adapt existing PIPE and unwind tests to the parking return value. All three caller groups fail on the parent and pass after propagation; the W=1 ARM64 ATC object also builds. Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
After parking succeeds, USB3 power-off still ignores mode shutdown errors and clears host state before cleanup completes. DP teardown or domain sleep can therefore fail while the callback reports success. An earlier failed transition can also leave OFF recorded with dirty resources, which the callback skips entirely. Propagate mode shutdown errors, clear host state only after success and retry cleanup when an OFF mode is dirty. Keep the cleanup ownership and training guards in the existing mode configuration functions. Extend the production-callback host diagnostic with DP stop, dirty OFF and both domain-sleep failures. Inject all 54 cleanup poll phases across ordinary and fixed-hub ports, checking retained obligations, blocked DP training and successful retry. The parent fails this regression group; the corrected callback and W=1 ARM64 ATC object pass. Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
Retain each core-owned PHY power reference until its provider accepts shutdown. Apple glue records the remaining releases and reset, keeps the domain protected, and drains those obligations before another start. Host/gadget teardown, completed PHY releases and core exit run once. Expose small core teardown/removal finishers so Apple can own the power release sequence without a second generic decrement. Existing DWC3 callers retain their original sequence. Restore the saved Type-C mode from USB2 init when delayed shutdown completed after the last mux event. Mark legacy ATC transitions dirty before changing the domain and block PIPE/DP setup until the transition is restored, as on J700. Record uncompleted probe/removal cleanup rather than hiding it. Add independently authored production-function ASan/UBSan diagnostics. The power-reference, pending-reset and legacy-abort controls fail on 7044af6 and pass with this change. The 48 shutdown/restart and 36 pending-failure restart permutations, partial PHY releases, startup failures, root-hub references and normal generic teardown pass. Existing ATC diagnostics and ARM64 LLVM W=1 ATC/DWC3 objects pass. Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
A Type-C orientation change updates swap_lanes without invalidating the completed mode. A repeated request for the same mode then skips lane configuration, and DP training can use the new lane selection against the old physical route. Fixed-hub mode changes also leave a live USB3 PIPE attached when their destination still uses USB3, although the lane backend is being rebuilt. Mark orientation changes dirty so existing cleanup and training guards apply until the route is restored. Park the fixed-hub PIPE before every lane rebuild and reconnect it after successful configuration. Preserve parking errors, DP ownership, same-orientation fast paths, fixed USB2 host behavior and the established generation-specific routing masks. Add a dynamic-debug orientation/state record without reading calibration data. Extend the production-function ASan/UBSan diagnostic with 144 orientation routes across T8103/T8122/T8140/T8142 and fixed/ordinary ports, both initial orientations and flip roundtrips, 122 transition poll injections, ownership and training guards, pending flip cancellation and capability rejection. The parent fails all three new regression groups; the patch passes them. R41-config ARM64 LLVM W=1 ATC/DWC3 objects and strict checkpatch pass. Reversed J700 hardware qualification remains with the release owner. (cherry picked from commit 072e4922e3bad5ca2917d6339a2a7ed71708885e) Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
The orientation poll-injection loop accepts every successful return as an advisory phase. Suppressing the fatal RCAL1 timeout consequently passes all of the original tests. Its generic route oracle also consults the same mode table as the implementation, allowing incorrect reversed routes to pass. Record the production poll callers and allow success only for the existing dummy/BIST/unlock advisory phases. Check explicit public lane and crossbar expectations and preservation of unrelated routing state. Add SAFE-first roundtrips, persistent cleanup failure after BIST and fatal host-ACK errors, and cancellation after a partially applied orientation change. Reviewed production candidate 072e4922e3bad5ca2917d6339a2a7ed71708885e passes the strengthened ASan/UBSan controls. Isolated RCAL-error suppression and incorrect generic reverse-route controls pass the original diagnostic and fail this diagnostic. The prerequisite parent still fails the candidate regressions. Production driver code is unchanged; electrical recovery still requires hardware qualification. (cherry picked from commit ecf9f745f122252cc285466720b3b4b8addd1967) Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
A fixed-hub T8140 host keeps its controller alive across connector changes. Parking currently continues after a failed lock or unlock, records the dummy backend and lets lane/reset teardown proceed despite an incomplete handoff. An already asserted LOCK request also reports success without checking ACK. Verify actual ACK for existing requests. Require completed parking handshakes for the live T8140 fixed-hub USB3 backend. On failure retain backend and resource ownership, mark the mode dirty and return the error before further native reset or lane changes. Existing retries restore the transition when readiness returns. Keep the historical inactive/legacy parking policy and the fatal USB3 host setup ACK requirement. Extend the strict production-function sanitizer diagnostics with live LOCK/UNLOCK failure ordering, ownership and both orientation roundtrips, eight policy scope controls and REQ-without-ACK rejection. Keep fatal and advisory phases explicitly distinguished in the corrected poll harness. The parent fails the new regressions; the patch passes existing 144 route, 122 poll, sticky SAFE, partial cancellation and ownership controls. This repairs the reported handoff contract, not a demonstrated clock or electrical root cause. Warm hotplug hardware qualification remains open. Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
An advisory USB3 host unlock can leave ACK asserted. If the next live fixed-hub parking attempt cannot release it, the initial check returns without marking the mode dirty. A subsequent request for the cached mode then reports success and DP training remains permitted despite the failed handoff. Mark this entry check failure dirty under the same live T8140 predicate as the parking lock and unlock failures. Retain backend and ownership and require a successful retry before cached mode success or training. Extend the production-function sanitizer controls for entry ACK failures, cached mode requests, both orientations and unchanged legacy/inactive scope. Host controls reproduce the cached success and training writes on the reviewed commit and pass with this correction. This establishes software error handling only; physical hotplug qualification remains open. (cherry picked from commit 926975ec6a633f26897565a34e66284d4a9527f2) Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
An existing request with actual ACK is a valid idempotent lock operation. Use debug level for that ordinary notice. Preserve all ACK polling, timeout/release warnings, fatal errors and dirty-state ownership guards. (cherry picked from commit b705aed087d0966cfa8bb4a344c2476e4cfca0a3) (cherry picked from commit 4a23c24) Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
TIPD can leave the shared external connector present when closing the TBT switch or dropping the USB role fails before its OOB disconnect. Send the existing owner-gated disconnect before these fallible transitions, while retaining failed route/PHY ownership and bounded cable revalidation. DCP already reports physical absence after a failed stop. Keep that report authoritative by discarding pending old-sink hotplug replay and consuming firmware hotplug callbacks while the external cable is absent. Preserve power, link, generation and DMA teardown guards. Add an actual-function host regression with injected transition/stop failures, late callbacks, stale stop generations and two shared ports. The fixed source passes 88 ASan/UBSan assertions; the unchanged parent fails 14. Both affected source files compile for arm64 with W=1. Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
A fresh external session has no OOB cable authority yet. The external_cable callback guard added by 80642a29 also consumes firmware discovery before that first OOB event, leaving the connector absent if raw connect supplies no second RX notification. Use one zero-initialized physical-absence tombstone instead. Set it before physical disconnect teardown and clear it on a real OOB connect, with WRITE_ONCE/READ_ONCE for lifecycle/RX access. Preserve fresh pre-OOB publication and pending replay, while rejecting callbacks during known physical absence. Same-cable DPMS never sets the tombstone. Retain early owner-gated OOB ordering, clearing pending replay on logical disconnect, failed hardware ownership and all generation/stop guards. This does not invent a callback generation token across a genuine reconnect. Extend the actual-function regression through OOB connect/link admission with a raw-connect stub that emits no second RX. The final source passes 116 ASan/UBSan assertions; the reviewed parent fails six. DCP compiles for arm64 with W=1, and source-only checkpatch is clean. Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Assisted-by: LLM
This was referenced Oct 13, 2026
RyanTheTide
force-pushed
the
fix/atc-pipe-retry-20261013
branch
from
October 13, 2026 15:24
4407f9b to
00a2d82
Compare
RyanTheTide
force-pushed
the
fix/physical-disconnect-authority-20261013
branch
from
October 13, 2026 15:25
29e6d87 to
cae9860
Compare
RyanTheTide
force-pushed
the
fix/atc-pipe-retry-20261013
branch
from
October 13, 2026 15:52
00a2d82 to
f5afac9
Compare
Contributor
Author
|
Closing as superseded by merged #293 ( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A failed PHY or USB-role teardown can leave GNOME treating an unplugged external monitor as connected. Publish physical absence before those fallible transitions, retain ownership until teardown succeeds, and discard callbacks/pending replay from the absent sink.
Preserve initial firmware discovery before the first physical cable event using a separate physical-absence flag. Same-cable DPMS remains unaffected. This does not provide a new callback generation token across a genuine reconnect.
Depends on #293; this draft is based on its reviewed source head
4407f9b00f8243401ce03e336b951368a4878a2a.Validation:
29e6d87for integration: 47 additional actual callback/mode-state checks pass, including concurrent callbacks during both successful and failed teardown. The unchanged parent fails 14 of these checks. Host mutexes and mocked firmware do not qualify kernel timing or hardware.Hardware qualification is pending. This draft must not be treated as a fix for the separate PHY orientation/handshake failure, and is not ready to merge.
Provenance: independently authored public driver code, with LLM assistance recorded in commits. Private hardware capture data and controller implementation are excluded.