Re: [PATCH v5 0/3] Input/SPI: fixes for MacBook8,1 DMA timeout, UAF, and NULL pointer dereference

[Shih-Yuan Lee]

Hi Dmitry, Mark, and the linux-input/linux-spi community,

Thank you for all the feedback across v1 through v5 of this series.

During further testing on the MacBook8,1 hardware, I discovered two
additional issues that change the scope of the fix:

1. The LPSS SPI controller (00:15.4) loses all private register state
   across S3 suspend/resume.  Restoring only the SSP clock on resume,
   without de-asserting LPSS_PRIV_RESETS (0x204) first, causes a PCIe
   Completion Timeout and a watchdog-triggered system reset.  Additionally,
   the IDMA block (which shares the SPI interrupt line) needs its registers
   restored to prevent spurious interrupts from masking real SPI transfers.
   This is a generic LPSS fix in spi-pxa2xx.c, not specific to MacBook8,1.

2. The applespi_remove() teardown has a use-after-free race between the
   drain_writes/drain_reads calls and the GPE handler removal.

Given these changes, the patch series has grown and now spans two
subsystems more cleanly than before:

  [input] Input: applespi - register touchpad device synchronously in probe
  [input] Input: applespi - fix use-after-free in applespi_remove()
  [spi]   spi: pxa2xx: disable DMA and fix runtime PM for Apple MacBook8,1
  [spi]   spi: pxa2xx: restore LPSS private and IDMA registers on S3 resume

I will submit these as two separate series to linux-input and linux-spi
respectively rather than continuing this thread, to keep subsystem
boundaries clean.

Thanks again for your patience and review.

Shih-Yuan Lee

-- 
2.39.5