M2-USBACM-01 — guarded first controller ownership and logging

USBACM-03 now has successful physical kernel/PID1 logging evidence. USBACM-04 extends the original first-detach stop below to one guarded reconnect; it is offline validated and untested on hardware. All other ownership/deadline boundaries remain. The original first-attachment contract is retained below as history.

USBACM-04 lifecycle source contract

The pinned Linux v6.18 musb_gadget.c requires musb_g_disconnect under the controller lock; it invokes the composite disconnect callback, clears speed/activity and returns B-peripheral/B-idle to B-idle with NOTATTACHED state. Its vbus_session gadget operation is disabled, so this adapter does not pretend a generic VBUS callback is available. Core start/stop disable/re-enable interrupts using platform callbacks; stop samples/acknowledges pending status. Start does not assert SOFTCONN, so the adapter permits pullup only after successful re-entry and the unchanged FIFO-layout check. Existing write callbacks continue clearing SESSION/HR and implement MT6582 sampled W1C semantics. The upstream host-state alternatives are excluded by the existing peripheral-only configuration and runtime B-device guard; no OTG or DMA path is introduced.

On CHRDET loss, retain the owned controller and use the same saved-input y2_session_end contract already used by terminal teardown. On reattachment, require fresh supply/clocks, exact saved inputs, unchanged digital/mode/trim bytes and zero DMA controls before y2_session_start; do not replay the original inherited-controller takeover predicate against registers Linux now owns. One re-entry only, no deadline reset. These are source-supported implementation facts; physical detach/re-enumeration and heartbeat/replay require the combined owner test. An offline fixture cannot establish electrical behavior.

Original first-attachment ownership contract

2026-09-09, baseline d9c2c98, #23/#27 under active M2 #28. The owner explicitly requested one combined enumeration/logging attempt to reduce physical cycles. Scope audit. Offline implementation, not a successful hardware enumeration result. Original candidate; sync-wait fix. The first hardware photo records a cable-wait PWRAP poll refusal before enumeration.

Entry evidence and limits

CHRDET photos establish bit5 following the reported startup cable condition. Connected startup gives PHY6a=BE and a correct pre-write wake refusal; the complete connected-start PHY state remains unknown. Unplugged startup gives the reviewed passive handoff and successful 6a=04→00 release. The earlier PHY-wake result remains the positive same-boot stability/calibration sample. None establishes enumeration.

This trial therefore boots unplugged, performs the existing guarded wake, and asks for USB attachment. It does not normalize BE or bypass the old guard. A late cable attachment is an explicitly untested hardware transition. A mismatch stops this candidate and preserves its screen; it does not authorize another write sequence. CHRDET is a charger-presence indication, not measured VBUS voltage.

Controller contract and exact sources

Use the previously pinned Linux v6.18, public MediaTek d53dd75c3ff77cac3f5be58fddfe660e94f94d64, FM kernel and LK bytes identified by USB source research, USB state, clock, wake and PWRAP. No new ROM/source provenance claim is made. Additional bounded disassembly is retained in ignored evidence-private/20260909-m2-enumeration/; its extractor wraps the already retained symbol-delimited FM bytes in a temporary ELF for LLVM disassembly.

Supply, clock, DMA and calibration ownership

The adapter owns a bounded retained-state experiment, not a completed SoC clock/regulator/PHY framework. It has a real integrated usb_phy object whose initialization refers to the guarded state and whose OTG callback attaches the gadget. It does not register a nop PHY or fabricate USB clocks. USB_PHY=n disables the global lookup/ULPI framework; upstream's inline usb_phy_init still calls this adapter's real callback. PM, USB_MUSB_MEDIATEK and GENERIC_PHY remain off; there is no clock/supply disable on probe exit.

Before any new controller write: the original complete power/clock/MAC snapshot, successful wake W1/V7F/FFF and original CHRDET0 must pass. After attachment, repeat bounded PWRAP CID/VUSB/CHRDET reads, clock gate/mux/PLL checks and the full 21-register snapshot. Require POWER20, B-device with no SESSION/HR/HOSTMODE, HWVERS6503, the reviewed digital PHY state with6a=00, and all eight DMA controls0. The seven saved PHY mode/trim bytes must exactly match the successful wake sample.

Only then mask L1 and core interrupt enables, clear POWER/DEVCTL, and resample all eight DMA controls before session/FIFO ownership. This takes over a controller already disconnected with inactive DMA; it does not stop active inherited DMA. Any nonzero channel refuses takeover. Upstream is built PIO-only and has no DMA controller callbacks or mask. Endpoint buffers reside in controller FIFO RAM; USB payload moves by CPU. Display DMA and the D08 RAM policy are unchanged.

The only added PHY writes are masked digital6c/6d operations. The three analog trim samples00/05/15 and four mode bytes1a/1d/22/63 are checked again after the session and recorded in the kernel ring. No analog calibration, PMIC register, rail enable, charging policy, clock gate/reference, host VBUS or controller-wide reset write is added. PWRAP continues only the already-reviewed AP read-command and valid-clear handshake; no PMIC write transaction.

Once active, check CHRDET/VUSB every250ms, with the existing bounded PWRAP transaction. Stop on error, first detach or 50s after the initial wake. Mask L1, drop SOFTCONN, notify PID1 to close its tty, unregister MUSB, then release only the digital6c/6d bits forced by this adapter, preserving other bits. Do not re-suspend or power-cycle the PHY. An IRQ burst above512 entries in one jiffy masks L1 and disables this IRQ, latching EOVERFLOW. No automatic retry/recovery.

Gadget, PID1 and host contract

Built-in upstream g_serial defaults ACM on, OBEX off, one port. Standard 0525:a4a7 descriptors and one ttyGS0; no ADB, shell, filesystem export or network. CONFIGFS_FS and unused serial/OBEX function code are selected dependencies; no configfs mount and no additional function is instantiated.

PID1 retains its cached 260-byte baseline snapshot. USBACM-01 used a separate 36-byte live ABI: magic/result/stage/polls/CHRDET/DEVCTL/IRQ/events/configured. USBACM-02 bumps the magic to 0x59325532 and appends the 52-byte failed PWRAP poll snapshot (88 bytes total); zero snapshot magic means no failed poll. A dedicated spinlock protects the failure copy across worker/status reads; no user copy or hardware access occurs under that lock. The sample survives teardown. PID1 displays it without replacing the cached PHY/wake rows. Reads are PID1-only and copy cached RAM, without fresh MMIO. DEVCTL=0x100 is uncollected; CHRDET=0x10000 is invalid. Screen dashes distinguish unread values from zero. Stages:1 preflight,2 attach prompt,3 session,4 registration,5 ready,6 configured, 7 stopped. A latched signed error retains the failing stage and baseline rows.

The relay discovers /sys/class/tty/ttyGS0/dev, strictly parses major/minor and creates only volatile /dev/ttyGS0 and read-only /dev/kmsg nodes. It uses ARM EABI mknod14, lseek19, ioctl54 and existing read/write/open/close; actual linked targets are checked against ENOSYS. Raw tty open is nonblocking/O_NOCTTY. There is no serial console dependency and no runtime UART write in PID1.

Only exact LOG1\n requests a stream. It emits Y2LOG1 M2-USBACM-03 (01/02 in the earlier candidates), retained PID1 startup/mount/sleep/baseline rows and heartbeat/status/error rows, rewinds /dev/kmsg to the oldest available kernel-ring record, and continues both. Kernel records retain native level/sequence/timestamp; PID1 records identify the source and BEAT. The early kernel ring is128KiB; PID1 history8KiB, TX queue32KiB, record buffer8KiB. Full history keeps its early records and explicitly reports loss; queue overflow and kernel EPIPE overrun have GAP records. This is bounded, not a lossless panic/crash recorder. Each once-per-heartbeat service performs at most one32-byte command read,16 kmsg reads and8 partial writes; absent/slow readers and malformed input do not wait. Flush tty output before close.

Host procedure validates the CDC ACM USB parent, records descriptors/path/timestamps/raw bytes/hash and asserts DTR before LOG1. The automatic selector refuses ambiguity; tty numbering alone proves nothing. PTY fixtures are labeled as such and never count as physical enumeration.

Qualification remaining

The first candidate combines the reviewed dependency chain, not its proof. Physical attachment, USB reset/control requests, ACM enumeration, log transfer, continued heartbeat and retained calibration require owner hardware evidence. Connected-start recovery and reconnect after a physical detach are deliberately unimplemented in this bounded first-attachment trial. The relay can reopen and replay a surviving tty, but that is not controller reconnect qualification. #27's late-open/non-reading/reconnect criteria remain intact and unfulfilled on hardware. #23, #27, #28 and every M2 exit gap stay open; M1 and later gates unchanged.