MacBookPro15,2: t2bce VHCI dies and kernel faults after hibernate resume on linux-t2 7.1.8

[anildigital]

Summary

Hibernating and resuming a 2018 13-inch Intel MacBook Pro causes the
t2bce_vhci controller to time out and die. The kernel subsequently emits two
general-protection faults and the machine becomes unusable, requiring a forced
power-off.

This uses the newer t2bce stack, not legacy apple-bce.

Hardware

• Model: MacBookPro15,2
• Board: Mac-827FB448E656EC26
• Product: MacBook Pro 13-inch, 2018, four Thunderbolt 3 ports
• Firmware: BIOS 2103.160.2.0.0
• iBridge firmware: 23.16.16068.0.0

Software

• Distribution: Omarchy 4.0.0 / Arch Linux
• Kernel: 7.1.8-arch1-Watanare-T2-3-t2
• Package: linux-t2 7.1.8.arch1-3
• systemd: 261.2-1
• Hyprland: 0.56.2-1
• Root filesystem: Btrfs on dm-crypt
• RAM: 15.5 GiB
• Hibernation swapfile: 15.5 GiB Btrfs swapfile

Kernel command line included:

intel_iommu=on iommu=pt pm_async=off mem_sleep_default=deep
resume=/dev/mapper/root resume_offset=<configured>

Power states:

$ cat /sys/power/state
freeze mem disk

$ cat /sys/power/mem_sleep
s2idle [deep]

Hibernation was configured using Omarchy's standard hibernation setup. The
swapfile, initramfs resume hook, resume device and Btrfs resume offset were
already present.

Steps to reproduce

1. Boot normally.
2. Run systemctl hibernate from the graphical session.
3. Power on/resume the system.
4. The T2 virtual USB controller fails during restoration.
5. The kernel faults and the system becomes unresponsive.
6. Hold the power button to recover.

Relevant timeline

Hibernation was requested at 22:10:27:

systemd-logind: hibernate requested from client PID 1241948 ('systemctl')
systemd-logind: The system will hibernate now!
systemd-sleep: Performing sleep operation 'hibernate'...
kernel: PM: hibernation: hibernation entry

The hibernation image was successfully allocated:

kernel: PM: hibernation: Allocated 1693388 pages for snapshot
kernel: PM: hibernation: Allocated 6773552 kbytes in 20.28 seconds
kernel: ACPI: PM: Preparing to enter system sleep state S4
kernel: ACPI: PM: Waking up from system sleep state S4

The T2 VHCI restoration then failed with ETIMEDOUT:

kernel: t2bce_vhci: Possible desync, cmd cancel timed out
kernel: t2bce_vhci: tq resume set-active failed dev=1 port=5 ep=00 status=-110 ret_state=0 active=0 paused_by=4 stalled=0
kernel: t2bce_vhci: stateful resume queue failed: dev=1 ep=00 status=-110
kernel: t2bce_vhci: stateful resume exit status=-110
kernel: t2bce_vhci: bus_resume exit status=-110 no_state_resume=0
kernel: t2bce_vhci t2bce_vhci: HC died; cleaning up
kernel: usb usb7: PM: dpm_run_callback(): usb_dev_restore returns -110
kernel: usb usb7: PM: failed to restore: error -110
kernel: leds apple::kbd_backlight: Setting an LED's brightness failed (-19)

Immediately afterward, the first kernel general-protection fault occurred:

kernel: Oops: general protection fault, probably for non-canonical address 0x8000000100b00003: 0000 [#1] SMP PTI
kernel: CPU: 6 UID: 1000 PID: 1196382 Comm: quickshell
kernel: Tainted: G S       C
kernel: RIP: 0010:do_mprotect_pkey+0x242/0x5b0
kernel: RAX: 8000000100b00003

Its stack included:

__x64_sys_mprotect
do_syscall_64
wait_for_completion_io_timeout
__slab_free
zram_slot_free_notify
kmem_cache_free
zs_free
do_swap_page
handle_mm_fault

About eight seconds later, a second kernel fault occurred in a Chrome I/O
thread:

kernel: t2bce_dma: command queue timeout (slot 26)
kernel: t2bce_dma: SQ unregister failed
kernel: Oops: general protection fault, probably for non-canonical address 0xb8bcbc5bd5339ec5: 0000 [#2] SMP PTI
kernel: CPU: 1 UID: 1000 PID: 551417 Comm: Chrome_ChildIOT
kernel: Tainted: G S    D  C
kernel: RIP: 0010:__refill_objects_node+0x2db/0x660
kernel: RAX: b8bcbc5bd5339ec5
kernel: R10: dead000000000100

Its stack included:

refill_objects
__pcs_replace_empty_main
kmem_cache_alloc_noprof
vm_area_alloc
__mmap_region
mmap_region
do_mmap
vm_mmap_pgoff
ksys_mmap_pgoff

T2 communication continued timing out:

kernel: t2bce_dma: command queue timeout (slot 27)
kernel: t2bce_dma: CQ unregister failed
kernel: t2bce_vhci: Possible desync, cmd cancel timed out
kernel: t2bce_dma: command queue timeout (slot 28)
kernel: t2bce_dma: SQ unregister failed
kernel: t2bce_dma: command queue timeout (slot 29)
kernel: t2bce_dma: CQ unregister failed
kernel: t2bce_vhci: Possible desync, cmd cancel timed out

The journal then stopped without an orderly shutdown because the machine had to
be powered off forcibly.

Other observations

• No OOM kill or memory-pressure event occurred.
• No NVMe or filesystem I/O error preceded the failure.
• No i915 GPU fault preceded the failure.
• There was no relevant userspace coredump.
• After the forced restart, Btrfs replayed its tree log and mounted successfully.
• Normal suspend has previously resumed successfully on this installation.
• The linux-t2 package was installed several days before this incident, rather
  than immediately before the failure.
• The same boot contained a large number of malformed Bluetooth advertising
  packet messages from hci0.

Workaround

Hibernation, hybrid sleep and suspend-then-hibernate are now disabled:

[Sleep]
AllowHibernation=no
AllowSuspendThenHibernate=no
AllowHybridSleep=no

Normal suspend remains enabled and logind now reports:

CanSuspend=yes
CanHibernate=no
CanHybridSleep=no
CanSuspendThenHibernate=no

Related reports

• #607 concerns hibernate resume with legacy apple-bce, but reports only
  keyboard and trackpad loss rather than kernel protection faults.
• #729 contains similar -110 BCE/VHCI communication timeouts, but during
  Touch Bar probing at boot rather than hibernation resume.

Filed by GPT-5 via OpenAI Codex.