Bug 282592 - Framework Laptop 16: Touchpad driver crashes on boot
Summary: Framework Laptop 16: Touchpad driver crashes on boot
Status: In Progress
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: amd64 Any
: --- Affects Only Me
Assignee: Vladimir Kondratyev
URL:
Keywords:
Depends on:
Blocks: frameworklaptop
  Show dependency treegraph
 
Reported: 2024-11-06 21:22 UTC by Daniel Schaefer
Modified: 2024-12-22 03:18 UTC (History)
9 users (show)

See Also:


Attachments
hid-signedness.patch (7.93 KB, patch)
2024-11-22 04:21 UTC, Vladimir Kondratyev
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Schaefer 2024-11-06 21:22:19 UTC
On the Framework Laptop 16, the touchpad driver (sys/dev/hid/hmt.c) crashes on boot.
This only occurs when the touchpad is present.

If the touchpad is disconnected on boot, the EC will pretend to be the touchpad and send the exact same HID report descriptor to the OS as the touchpad does.
The difference is that it won't send any HID reports and does not respond to any GET_REPORT requests, except for report ID 2 where it returns the bytes `{0x04, 0x00, 0x02, 0x05, 0x00, 0x00, 0x00, 0x00}`.
See: https://github.com/FrameworkComputer/EmbeddedController/commit/9d49389919c36e44e451514b8278b9eb7ee6ed1e

Analysing the crashdump it seems we crashed in this line: https://github.com/freebsd/freebsd-src/blob/609fa228bae6d864558f5167d4a964aab2a5fc88/sys/dev/hid/hmt.c#L757
But looking at the HID report descriptor `left_button` will be 2 and there is no matching Usage that could land us in this if branch.
Comment 1 Vladimir Kondratyev freebsd_committer freebsd_triage 2024-11-22 04:21:22 UTC
Created attachment 255377 [details]
hid-signedness.patch

Test this patch
Comment 2 commit-hook freebsd_committer freebsd_triage 2024-12-08 20:30:31 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=71a21ba8f23335e93ce7428d151c629fd1930391

commit 71a21ba8f23335e93ce7428d151c629fd1930391
Author:     Rene Ladan <rene@FreeBSD.org>
AuthorDate: 2024-12-08 20:28:03 +0000
Commit:     Rene Ladan <rene@FreeBSD.org>
CommitDate: 2024-12-08 20:28:03 +0000

    devel/jetbrains-phpstorm: update to 2024.3

    PR:             282592
    Approved by:    maintainer timeout (dmitry.wagin@ya.ru, 14 days)

 devel/jetbrains-phpstorm/Makefile  |  4 +--
 devel/jetbrains-phpstorm/distinfo  |  6 ++--
 devel/jetbrains-phpstorm/pkg-plist | 58 +++++++++++++++++++++++++++++---------
 3 files changed, 49 insertions(+), 19 deletions(-)
Comment 3 Rene Ladan freebsd_committer freebsd_triage 2024-12-08 20:35:39 UTC
I mistyped the PR number in #2 :(
Comment 4 SHENG-YI HUNG 2024-12-09 04:29:02 UTC
We are also in Framework office today. Patch from previous comment works. :)
Comment 5 Daniel Schaefer 2024-12-09 05:41:20 UTC
(In reply to SHENG-YI HUNG from comment #4)

Confirmed, tested with Sheng-Yi. System can boot now with touchpad attached, thanks!
Comment 6 Ihor Antonov 2024-12-14 04:50:15 UTC
I have the same problem with Framework 16.
I will test the patch soon.
Comment 7 Ihor Antonov 2024-12-21 17:14:56 UTC
The patch works for me.

I patched the tip of the main branch and built a memstick release and flushed it to the usb stick. I was able to boot the usb drive, install the OS, install sway and use touchpad. Moving the pointer, left and right click and scrolling all works as expected.

Thanks Vladimir!
Please incorporate this patch into the tree.
Comment 8 commit-hook freebsd_committer freebsd_triage 2024-12-22 03:18:11 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=38b67578fb4bbf568f7012ca3921a4d15cfe7c5d

commit 38b67578fb4bbf568f7012ca3921a4d15cfe7c5d
Author:     Vladimir Kondratyev <wulf@FreeBSD.org>
AuthorDate: 2024-12-22 03:16:11 +0000
Commit:     Vladimir Kondratyev <wulf@FreeBSD.org>
CommitDate: 2024-12-22 03:16:11 +0000

    hid: Correctly handle signed/unsigned quantities in kernel HID parser.

    Wrong signedness of usage value results in inverted range check in hmt(4)
    driver that allows out of bound array access leading to panic.

    Reported by:    many
    Sponsored by:   Future Crew, LLC
    Obtained from:  NetBSD
    NetBSD PR:      kern/53605
    PR:             274014, 282592

 sys/dev/hid/hid.c | 91 +++++++++++++++++++++++++++++--------------------------
 sys/dev/hid/hid.h | 32 +++++++++----------
 2 files changed, 64 insertions(+), 59 deletions(-)