Bug 282592
| Summary: | Framework Laptop 16: Touchpad driver crashes on boot | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Base System | Reporter: | Daniel Schaefer <dhs> | ||||
| Component: | kern | Assignee: | Vladimir Kondratyev <wulf> | ||||
| Status: | In Progress --- | ||||||
| Severity: | Affects Only Me | CC: | aokblast, dhs, emaste, i19780219111, ihor, lwhsu, markj, rene, wulf | ||||
| Priority: | --- | ||||||
| Version: | CURRENT | ||||||
| Hardware: | amd64 | ||||||
| OS: | Any | ||||||
| Bug Depends on: | |||||||
| Bug Blocks: | 262152 | ||||||
| Attachments: |
|
||||||
Created attachment 255377 [details]
hid-signedness.patch
Test this patch
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=71a21ba8f23335e93ce7428d151c629fd1930391 commit 71a21ba8f23335e93ce7428d151c629fd1930391 Author: Rene Ladan <rene@FreeBSD.org> AuthorDate: 2024-12-08 20:28:03 +0000 Commit: Rene Ladan <rene@FreeBSD.org> CommitDate: 2024-12-08 20:28:03 +0000 devel/jetbrains-phpstorm: update to 2024.3 PR: 282592 Approved by: maintainer timeout (dmitry.wagin@ya.ru, 14 days) devel/jetbrains-phpstorm/Makefile | 4 +-- devel/jetbrains-phpstorm/distinfo | 6 ++-- devel/jetbrains-phpstorm/pkg-plist | 58 +++++++++++++++++++++++++++++--------- 3 files changed, 49 insertions(+), 19 deletions(-) I mistyped the PR number in #2 :( We are also in Framework office today. Patch from previous comment works. :) (In reply to SHENG-YI HUNG from comment #4) Confirmed, tested with Sheng-Yi. System can boot now with touchpad attached, thanks! I have the same problem with Framework 16. I will test the patch soon. The patch works for me. I patched the tip of the main branch and built a memstick release and flushed it to the usb stick. I was able to boot the usb drive, install the OS, install sway and use touchpad. Moving the pointer, left and right click and scrolling all works as expected. Thanks Vladimir! Please incorporate this patch into the tree. A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=38b67578fb4bbf568f7012ca3921a4d15cfe7c5d commit 38b67578fb4bbf568f7012ca3921a4d15cfe7c5d Author: Vladimir Kondratyev <wulf@FreeBSD.org> AuthorDate: 2024-12-22 03:16:11 +0000 Commit: Vladimir Kondratyev <wulf@FreeBSD.org> CommitDate: 2024-12-22 03:16:11 +0000 hid: Correctly handle signed/unsigned quantities in kernel HID parser. Wrong signedness of usage value results in inverted range check in hmt(4) driver that allows out of bound array access leading to panic. Reported by: many Sponsored by: Future Crew, LLC Obtained from: NetBSD NetBSD PR: kern/53605 PR: 274014, 282592 sys/dev/hid/hid.c | 91 +++++++++++++++++++++++++++++-------------------------- sys/dev/hid/hid.h | 32 +++++++++---------- 2 files changed, 64 insertions(+), 59 deletions(-) (In reply to commit-hook from comment #8) Is there any reason not to apply this to stable/14 as well? It applies cleanly for me. |
On the Framework Laptop 16, the touchpad driver (sys/dev/hid/hmt.c) crashes on boot. This only occurs when the touchpad is present. If the touchpad is disconnected on boot, the EC will pretend to be the touchpad and send the exact same HID report descriptor to the OS as the touchpad does. The difference is that it won't send any HID reports and does not respond to any GET_REPORT requests, except for report ID 2 where it returns the bytes `{0x04, 0x00, 0x02, 0x05, 0x00, 0x00, 0x00, 0x00}`. See: https://github.com/FrameworkComputer/EmbeddedController/commit/9d49389919c36e44e451514b8278b9eb7ee6ed1e Analysing the crashdump it seems we crashed in this line: https://github.com/freebsd/freebsd-src/blob/609fa228bae6d864558f5167d4a964aab2a5fc88/sys/dev/hid/hmt.c#L757 But looking at the HID report descriptor `left_button` will be 2 and there is no matching Usage that could land us in this if branch.