From: Kirill A. Korinsky <kirill@korins.ky>
Subject: Re: Fix boot on HONOR MagicBook Art 14 Snapdragon
To: tech@openbsd.org
Date: Sun, 22 Dec 2024 03:21:57 +0100

On Sun, 22 Dec 2024 01:32:19 +0100,
Kirill A. Korinsky <kirill@korins.ky> wrote:
> 
> tech@,
> 
> On the last snapshot the HONOR MagicBook Art 14 Snapdragon fails to boot
> with trace:
> 
>         panic: attempt to access user address 0x0 from EL1
>         Stopped at panic+0x140: cmp w21, #0x0
> 
>         TID PID UID PRFLAGS PFLAGS CPU COMMAND
>         db_enter() at panic+0x13c
>         panic() at kdata_abort+0x180
>         do_el0_sync() at handle_el1h_sync+0x68
>         handle_el1h_sync() at qciic_exec+0x2d4
>         qciic_exec() at ihidev_intr+0x70
>         ihidev_intr() at qcgpio_intr+0xac
>         qcgpio_intr() at agintc_irq_handler+0x2bc
> 
>         ddb{0}>
> 
> If I build kernel with enabled debug at ihidev the cause is clear, it can't
> read HID report descriptor from touchpad:
> 
>         ihidev1 at iic3 addr 0x5dihidev1: HID command I2C_HID_CMD_DESCR at 0x1
>         ihidev1: HID descriptor: 1e 00 00 01 df 02 02 00 03 00 2a 00 04 00 20 00 05 00 06 00 cc 35 04 01 01 01 00 00 00 00
>         ihidev1: resetting
>         ihidev1: HID command I2C_HID_CMD_SET_POWER(0)
>         ihidev1: HID command I2C_HID_CMD_RESET
>         ihidev1: HID command I2C_HID_REPORT_DESCR at 0x2 with size 735
>         ihidev1: HID report descriptor: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f
>         , gpio 896 vendor 0x35cc product 0x104, QTEC0002
> 
> Here the diff which introduces a quirk for this machine / touchpad which
> allows me to boot it.
> 
> About diff: I've used id code instead of name because QTEC0002 looks wrong.
> I say that because keyboard reads as: vendor 0x49f product 0x5343, QTEC0001
>

And here second quirk for this tocuhpad.

With both quirks system boots and touchpad reads in wsconsctl as:

        mouse.type=touchpad
        mouse.rawmode=0
        mouse.scale=0,4680,0,3120,0,36,33
        mouse.reverse_scrolling=0
        mouse.tp.tapping=0,0,0
        mouse.tp.swapsides=0
        mouse.tp.disable=0
        mouse.tp.edges=0.0,5.0,0.0,5.0
        mouse.scaling=0.164
        mouse1.type=touchpad
        mouse1.rawmode=1
        mouse1.scale=0,0,0,0,0,0,0
        mouse1.reverse_scrolling=0
        mouse1.scaling=1.000
        mouse2.type=touch-panel
        mouse2.rawmode=1
        mouse2.scale=0,3120,0,2080,0,0,0
        mouse2.reverse_scrolling=0
        mouse2.scaling=1.000

and it somehow works. Somehow means that I can move coursor in X11
intermittently for short period of time, like few seconds, after I touch
touch a screen.

anyway, I not able to move coursor in X11. I was able before xeonodm starts,
but not when I see login screen. Touch screen works.

When it happens, I do have in logs lines like this:

        Dec 22 03:08:12 honor /bsd: ihidev2: ihidev_intr: hid input (rep 16): 10 a5 45 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Dec 22 03:08:12 honor /bsd: ihidev1: ihidev_intr: invalid packet size (65535 vs. 42)
        Dec 22 03:08:13 honor /bsd: ihidev2: ihidev_intr: hid input (rep 16): 10 a5 45 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Dec 22 03:08:13 honor /bsd: ihidev1: ihidev_intr: invalid packet size (65535 vs. 42)
        Dec 22 03:08:14 honor /bsd: ihidev2: ihidev_intr: hid input (rep 16): 10 a5 45 02 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Dec 22 03:08:14 honor /bsd: ihidev1: ihidev_intr: invalid packet size (65535 vs. 42)

Where ihidev1 is touchpad and ihidev2 is touchscreen.

Index: sys/dev/i2c/ihidev.c
===================================================================
RCS file: /home/cvs/src/sys/dev/i2c/ihidev.c,v
diff -u -p -r1.33 ihidev.c
--- sys/dev/i2c/ihidev.c	18 Oct 2024 12:53:49 -0000	1.33
+++ sys/dev/i2c/ihidev.c	22 Dec 2024 02:21:10 -0000
@@ -61,6 +61,7 @@ static int I2C_HID_POWER_ON	= 0x0;
 static int I2C_HID_POWER_OFF	= 0x1;
 
 int	ihidev_match(struct device *, void *, void *);
+int	ihidev_quirks(struct ihidev_softc *);
 void	ihidev_attach(struct device *, struct device *, void *);
 int	ihidev_detach(struct device *, int);
 int	ihidev_activate(struct device *, int);
@@ -75,6 +76,21 @@ int	ihidev_maxrepid(void *buf, int len);
 int	ihidev_print(void *aux, const char *pnp);
 int	ihidev_submatch(struct device *parent, void *cf, void *aux);
 
+#define IHIDEV_QUIRK_SKIP_RESET		0x1
+#define IHIDEV_QUIRK_RE_POWER_ON	0x2
+#define IHIDEV_QUIRK_SKIP_POWER_OFF	0x4
+
+const struct ihidev_quirks {
+	uint16_t		ihq_vid;
+	uint16_t		ihq_pid;
+	int			ihq_quirks;
+} ihidev_devs[] = {
+	/* HONOR MagicBook Art 14 Touchpad (QTEC0002) */
+	{ 0x35cc, 0x0104,
+	    IHIDEV_QUIRK_SKIP_RESET | IHIDEV_QUIRK_RE_POWER_ON |
+	    IHIDEV_QUIRK_SKIP_POWER_OFF },
+};
+
 const struct cfattach ihidev_ca = {
 	sizeof(struct ihidev_softc),
 	ihidev_match,
@@ -98,6 +114,19 @@ ihidev_match(struct device *parent, void
 	return (0);
 }
 
+int
+ihidev_quirks(struct ihidev_softc *sc)
+{
+	const struct ihidev_quirks *q;
+	int i, nent = nitems(ihidev_devs);
+
+	for (i = 0, q = ihidev_devs; i < nent; i++, q++)
+		if (q->ihq_vid == sc->sc_vid && q->ihq_pid == sc->sc_pid)
+			return (q->ihq_quirks);
+
+	return (0);
+}
+
 void
 ihidev_attach(struct device *parent, struct device *self, void *aux)
 {
@@ -597,6 +626,13 @@ ihidev_hid_desc_parse(struct ihidev_soft
 		return (1);
 	}
 
+	sc->sc_vid = letoh16(sc->hid_desc.wVendorID);
+	sc->sc_pid = letoh16(sc->hid_desc.wProductID);
+	sc->sc_quirks = ihidev_quirks(sc);
+
+	if (sc->sc_quirks & IHIDEV_QUIRK_SKIP_RESET)
+		goto skip_rest;
+
 	while (retries-- > 0) {
 		if (ihidev_reset(sc)) {
 			if (retries == 0)
@@ -608,6 +644,7 @@ ihidev_hid_desc_parse(struct ihidev_soft
 			break;
 	}
 
+skip_rest:
 	sc->sc_reportlen = letoh16(sc->hid_desc.wReportDescLength);
 	sc->sc_report = malloc(sc->sc_reportlen, M_DEVBUF, M_WAITOK | M_ZERO);
 
@@ -616,6 +653,10 @@ ihidev_hid_desc_parse(struct ihidev_soft
 		    sc->sc_dev.dv_xname);
 		return (1);
 	}
+
+	if (sc->sc_quirks & IHIDEV_QUIRK_RE_POWER_ON)
+		if (ihidev_poweron(sc))
+			return (1);
 
 	return (0);
 }
Index: sys/dev/i2c/ihidev.h
===================================================================
RCS file: /home/cvs/src/sys/dev/i2c/ihidev.h,v
diff -u -p -r1.9 ihidev.h
--- sys/dev/i2c/ihidev.h	3 Sep 2022 15:48:16 -0000	1.9
+++ sys/dev/i2c/ihidev.h	22 Dec 2024 02:20:20 -0000
@@ -93,6 +93,10 @@ struct ihidev_softc {
 	int		sc_fastpoll;
 	struct timeout	sc_timer;
 	int		sc_dying;
+
+	uint16_t	sc_vid;
+	uint16_t	sc_pid;
+	int		sc_quirks;
 };
 
 struct ihidev {


-- 
wbr, Kirill