From: Kirill A. Korinsky <kirill@korins.ky>
Subject: Re: Fix boot on HONOR MagicBook Art 14 Snapdragon
To: tech@openbsd.org
Date: Sun, 22 Dec 2024 22:23:30 +0100

On Sun, 22 Dec 2024 03:21:57 +0100,
Kirill A. Korinsky <kirill@korins.ky> wrote:
> 
> On Sun, 22 Dec 2024 01:32:19 +0100,
> Kirill A. Korinsky <kirill@korins.ky> wrote:
> > 
> > tech@,
> > 
> > On the last snapshot the HONOR MagicBook Art 14 Snapdragon fails to boot
> > with trace:
> > 
> >         panic: attempt to access user address 0x0 from EL1
> >         Stopped at panic+0x140: cmp w21, #0x0
> > 
> >         TID PID UID PRFLAGS PFLAGS CPU COMMAND
> >         db_enter() at panic+0x13c
> >         panic() at kdata_abort+0x180
> >         do_el0_sync() at handle_el1h_sync+0x68
> >         handle_el1h_sync() at qciic_exec+0x2d4
> >         qciic_exec() at ihidev_intr+0x70
> >         ihidev_intr() at qcgpio_intr+0xac
> >         qcgpio_intr() at agintc_irq_handler+0x2bc
> > 
> >         ddb{0}>
> > 
> > If I build kernel with enabled debug at ihidev the cause is clear, it can't
> > read HID report descriptor from touchpad:
> > 
> >         ihidev1 at iic3 addr 0x5dihidev1: HID command I2C_HID_CMD_DESCR at 0x1
> >         ihidev1: HID descriptor: 1e 00 00 01 df 02 02 00 03 00 2a 00 04 00 20 00 05 00 06 00 cc 35 04 01 01 01 00 00 00 00
> >         ihidev1: resetting
> >         ihidev1: HID command I2C_HID_CMD_SET_POWER(0)
> >         ihidev1: HID command I2C_HID_CMD_RESET
> >         ihidev1: HID command I2C_HID_REPORT_DESCR at 0x2 with size 735
> >         ihidev1: HID report descriptor: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> >         , gpio 896 vendor 0x35cc product 0x104, QTEC0002
> > 
> > Here the diff which introduces a quirk for this machine / touchpad which
> > allows me to boot it.
> > 
> > About diff: I've used id code instead of name because QTEC0002 looks wrong.
> > I say that because keyboard reads as: vendor 0x49f product 0x5343, QTEC0001
> >
> 
> And here second quirk for this tocuhpad.
> 
> With both quirks system boots and touchpad reads in wsconsctl as:
> 
>         mouse.type=touchpad
>         mouse.rawmode=0
>         mouse.scale=0,4680,0,3120,0,36,33
>         mouse.reverse_scrolling=0
>         mouse.tp.tapping=0,0,0
>         mouse.tp.swapsides=0
>         mouse.tp.disable=0
>         mouse.tp.edges=0.0,5.0,0.0,5.0
>         mouse.scaling=0.164
>         mouse1.type=touchpad
>         mouse1.rawmode=1
>         mouse1.scale=0,0,0,0,0,0,0
>         mouse1.reverse_scrolling=0
>         mouse1.scaling=1.000
>         mouse2.type=touch-panel
>         mouse2.rawmode=1
>         mouse2.scale=0,3120,0,2080,0,0,0
>         mouse2.reverse_scrolling=0
>         mouse2.scaling=1.000
> 
> and it somehow works. Somehow means that I can move coursor in X11
> intermittently for short period of time, like few seconds, after I touch
> touch a screen.
> 
> anyway, I not able to move coursor in X11. I was able before xeonodm starts,
> but not when I see login screen. Touch screen works.
> 
> When it happens, I do have in logs lines like this:
> 
>         Dec 22 03:08:12 honor /bsd: ihidev2: ihidev_intr: hid input (rep 16): 10 a5 45 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>         Dec 22 03:08:12 honor /bsd: ihidev1: ihidev_intr: invalid packet size (65535 vs. 42)
>         Dec 22 03:08:13 honor /bsd: ihidev2: ihidev_intr: hid input (rep 16): 10 a5 45 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>         Dec 22 03:08:13 honor /bsd: ihidev1: ihidev_intr: invalid packet size (65535 vs. 42)
>         Dec 22 03:08:14 honor /bsd: ihidev2: ihidev_intr: hid input (rep 16): 10 a5 45 02 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>         Dec 22 03:08:14 honor /bsd: ihidev1: ihidev_intr: invalid packet size (65535 vs. 42)
> 
> Where ihidev1 is touchpad and ihidev2 is touchscreen.
> 

After mglocker@ commit to qcgpio.c(v 1.12) with updated mapping, touchpad
started worked.

The only quirks that I need to boot it is skip reset before get HID report.

Index: sys/dev/i2c/ihidev.c
===================================================================
RCS file: /cvs/src/sys/dev/i2c/ihidev.c,v
diff -u -p -r1.33 ihidev.c
--- sys/dev/i2c/ihidev.c	18 Oct 2024 12:53:49 -0000	1.33
+++ sys/dev/i2c/ihidev.c	22 Dec 2024 21:13:48 -0000
@@ -61,6 +61,7 @@ static int I2C_HID_POWER_ON	= 0x0;
 static int I2C_HID_POWER_OFF	= 0x1;
 
 int	ihidev_match(struct device *, void *, void *);
+int	ihidev_quirks(struct ihidev_softc *);
 void	ihidev_attach(struct device *, struct device *, void *);
 int	ihidev_detach(struct device *, int);
 int	ihidev_activate(struct device *, int);
@@ -75,6 +76,17 @@ int	ihidev_maxrepid(void *buf, int len);
 int	ihidev_print(void *aux, const char *pnp);
 int	ihidev_submatch(struct device *parent, void *cf, void *aux);
 
+#define IHIDEV_QUIRK_SKIP_RESET	0x1
+
+const struct ihidev_quirks {
+	uint16_t		ihq_vid;
+	uint16_t		ihq_pid;
+	int			ihq_quirks;
+} ihidev_devs[] = {
+	/* HONOR MagicBook Art 14 Touchpad (QTEC0002) */
+	{ 0x35cc, 0x0104, IHIDEV_QUIRK_SKIP_RESET },
+};
+
 const struct cfattach ihidev_ca = {
 	sizeof(struct ihidev_softc),
 	ihidev_match,
@@ -98,6 +110,19 @@ ihidev_match(struct device *parent, void
 	return (0);
 }
 
+int
+ihidev_quirks(struct ihidev_softc *sc)
+{
+	const struct ihidev_quirks *q;
+	int i, nent = nitems(ihidev_devs);
+
+	for (i = 0, q = ihidev_devs; i < nent; i++, q++)
+		if (q->ihq_vid == sc->sc_vid && q->ihq_pid == sc->sc_pid)
+			return (q->ihq_quirks);
+
+	return (0);
+}
+
 void
 ihidev_attach(struct device *parent, struct device *self, void *aux)
 {
@@ -597,6 +622,13 @@ ihidev_hid_desc_parse(struct ihidev_soft
 		return (1);
 	}
 
+	sc->sc_vid = letoh16(sc->hid_desc.wVendorID);
+	sc->sc_pid = letoh16(sc->hid_desc.wProductID);
+	sc->sc_quirks = ihidev_quirks(sc);
+
+	if (sc->sc_quirks & IHIDEV_QUIRK_SKIP_RESET)
+		goto skip_rest;
+
 	while (retries-- > 0) {
 		if (ihidev_reset(sc)) {
 			if (retries == 0)
@@ -608,6 +640,7 @@ ihidev_hid_desc_parse(struct ihidev_soft
 			break;
 	}
 
+skip_rest:
 	sc->sc_reportlen = letoh16(sc->hid_desc.wReportDescLength);
 	sc->sc_report = malloc(sc->sc_reportlen, M_DEVBUF, M_WAITOK | M_ZERO);
 
Index: sys/dev/i2c/ihidev.h
===================================================================
RCS file: /cvs/src/sys/dev/i2c/ihidev.h,v
diff -u -p -r1.9 ihidev.h
--- sys/dev/i2c/ihidev.h	3 Sep 2022 15:48:16 -0000	1.9
+++ sys/dev/i2c/ihidev.h	22 Dec 2024 21:13:48 -0000
@@ -93,6 +93,10 @@ struct ihidev_softc {
 	int		sc_fastpoll;
 	struct timeout	sc_timer;
 	int		sc_dying;
+
+	uint16_t	sc_vid;
+	uint16_t	sc_pid;
+	int		sc_quirks;
 };
 
 struct ihidev {


-- 
wbr, Kirill