[FAILED - DO NOT MERGE] dmaengine: correlate Denali QSPI completion ordering

[ooaklee]

Summary

Remove the Denali QSPI runtime-resume register replay added by b6781f86632b, while retaining the guarded 64-bit event-ring, per-pair interrupt-mask, doorbell, DMA-synchronization, and MSHW0485 transport fixes already merged into the beta base.

Hardware evidence

A/B testing on the same Surface Pro 11 OLED installation showed:

• 7.2.0-jg-0sp11v19-qcom-x1e: touch and pen remain stable under sustained use.
• 7.2.2-jg-0sp11beta2: touch initially enumerates, then an unowned GPI event is followed by paired RX residue, -EIO, channel-stop timeout, reset-response timeout, and loss of both touch and pen.
• The same sp11-iptsd binary and 045e:0c83 HIDRAW identity are used on both kernels, locating the regression below userspace.

The failed beta contains one additional touch-path behavior absent from the qualified source: replay of live GENI/GSI interrupt state on every runtime resume. The failure timing aligns with the first autosuspend/resume transition.

Guardrail

This patch removes only that replay. It does not change generic SPI runtime PM, MSHW0485 protocol selection, ring geometry, descriptor ownership, DMA synchronization, HID ABI, or DT configuration.

Validation

• scripts/checkpatch.pl --strict --no-tree: clean.
• ARM64 ubuntu_x1e_defconfig, W=1, targeted drivers/spi/spi-geni-qcom.o: passed.
• Physical qualification remains required; keep this PR draft until sustained touch, pen, suspend/resume, and repeated HIDRAW bridge recovery pass.

Related work

• Upstream-focused QSPI/touch series: SP11: add protocol-9 QSPI and OF-only MSHW0485 touch jglathe/linux_ms_dev_kit#83
• Original guarded beta merge: Input: re-lift guarded SP11 QSPI and direct touch #33

Merge policy

Do not merge on compile evidence alone. This is a hardware-test hypothesis derived from an A/B regression and must remain separate from the beta base until SP11 qualification succeeds.

v6 intermittent-touch follow-up

Removing the runtime-resume replay was necessary but not sufficient. During a live dynamic-debug test, touch recovered only in short intervals and then failed again. The decisive sequence was: a TX-only descriptor was retired by the one-jiffy fallback; its successor produced a length-correct TX EOT at the first CONFIG pointer, terminal QUP notification and successful RX EOT, but no second terminal-pointer TX EOT; the existing guard discarded that evidence and SPI timed out waiting only for TX. Repeated cold recovery eventually removed HIDRAW/IPTSD. This is a kernel QSPI/GPI ownership race, not missing userspace or a DTB namespace problem.

Commit 1a207c4 records the early-pointer EOT against the exact issued descriptor and permits only the later terminal QUP notification to retire that same head descriptor, advancing the ring to its doorbell. The grace timer is now limited to TX-only commands, and both correlation slots are cleared during termination and resource release. The ARM64 GPI object builds cleanly and strict checkpatch reports zero errors and warnings. Two focused OpenCode reviews agreed with the diagnosis and found the hardened patch acceptable for a v7 hardware test. The QUP BIT(27) meaning remains based on the captured 0x08000080 terminal event and must be validated physically before merge.

[ooaklee]

The v7 qualification aggregate included the patch-equivalent form of this commit and failed on its first touchscreen interaction. Direct touch then stopped, while the touch input nodes, SPI HIDRAW bridge, and IPTSD service remained enumerated. The touch IRQ stayed at its boot-time count, and a later read-only task-stack snapshot found the SPI thread and touch IRQ thread idle rather than permanently blocked in spi_sync().

This disproves qualification of the current early-EOT policy. It remains plausible that removing the timer fallback for paired reads can strand or mis-retire a TX cookie, but the post-failure idle stacks mean we must instrument the event/notification transition rather than claim a demonstrated deadlock. Known-good v19 retains the timer retirement policy for all QSPI TX EOT descriptors. This PR must not merge until a narrower instrumented candidate survives sustained touch/pen testing.

[ooaklee]

Critical correction to the v7 hardware result:\n\nImmediately before rolling back, the tester deliberately repeated the touchscreen test. The first touchscreen contact instantly hard-locked the entire Surface Pro 11, requiring a forced power reset.\n\nThis is more severe than the earlier nonfatal manifestation, where touch stopped responding while the SPI HIDRAW bridge and IPTSD remained enumerated. The idle-thread snapshot collected after that earlier manifestation describes only that instance; it does not rule out a kernel deadlock or another system-level failure on the repeat.\n\nConsequences:\n\n- v7 is unsafe to boot or reproduce again.\n- This PR remains failed and must not be merged.\n- A green CI/build result is not qualification evidence.\n- The next candidate must replace or substantially revise this completion approach and should be tested only after persistent crash capture is available.\n- No precise root cause is claimed from the current evidence.

[ooaklee]

Closing this failed draft after recovering the persistent v7 journal.

The terminal sequence was:

mshw0485-touch spi0.0: SP11 QSPI pair failed tx(result:0 residue:0) rx(result:0 residue:3628)
kernel BUG at drivers/dma/qcom/../dmaengine.h:54!
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP

Line 54 is BUG_ON(tx->cookie < DMA_MIN_COOKIE) in dma_cookie_complete(). This proves that the completion path tried to complete an invalid/already-cleared descriptor cookie. The complete race interleaving remains an inference because the hard lock prevented the rest of the call trace from being persisted.

OpenCode independently reviewed the exact commit and agreed it must not merge. Its corrected assessment identifies unsafe ownership/lifetime overlap between the early/deferred completion slots, callbacks, and the SPI failure path calling channel termination/reset. A future replacement needs atomic descriptor ownership transfer under the virtual-channel lock, callbacks outside that lock, and timer/IRQ/tasklet quiescence before reset.

The hardware-proven v19 kernel has been restored and touch, pen, stereo audio, and volume control are working again. This branch remains available as a failure record; do not retest it.

[ooaklee]

Analysis correction after checking the full locking model:

The simple terminate-versus-running-tasklet use-after-free theory in the preceding comment is not defensible. gpi_ev_tasklet() holds gpii->pm_lock for the full event scan and deferred-completion check, while gpi_terminate_all() must acquire that same lock for writing before reset can free descriptors. The SPI TX/RX callbacks only signal completions. OpenCode was challenged with this control and withdrew its initial exact-interleaving claim.

What remains proven is narrower and still decisive:

• RX was reported complete with all 3628 bytes remaining.
• TX was reported complete with zero residue.
• One of the three GPI dma_cookie_complete() sites then received a descriptor whose cookie was already cleared or otherwise invalid.
• The kernel raised an Oops and the machine hard-locked.
• The incomplete persisted trace does not identify the fatal call site, channel, or distinguish live double-completion from stale/reallocated memory.

The closed/no-merge disposition is unchanged. We should not design a replacement around a guessed race. The missing discriminators are a complete Oops stack and, if a future reproduction can be made acceptably safe, KASAN/slab-lifetime evidence.