Bug 95851

Summary: [Lenovo Miix 2 11] Synaptics/ITE-Tech hid-rmi fails to configure touchpad
Product: Drivers Reporter: philipp.spilger
Component: Input DevicesAssignee: drivers_input-devices
Status: NEW ---    
Severity: normal CC: hristo, tobi291019
Priority: P1    
Hardware: x86-64   
OS: Linux   
Kernel Version: 3.19.3 Subsystem:
Regression: No Bisected commit-id:
Attachments: dmesg
lsusb output
lsusb verbose output
lsmod output

Description philipp.spilger 2015-03-30 11:28:58 UTC
Created attachment 172631 [details]
dmesg

The touchpad of keyboard-/touchpad dock of the Lenovo Miix convertible is not working. The hid-rmi driver fails to configure the device.

During bootup (nd everytime the dock is de-/attached) the following error message shows up:

[    5.638597] hid-rmi 0003:06CB:A001.0004: failed to write hid report (-38)
[    5.638647] hid-rmi 0003:06CB:A001.0004: rmi_set_page: set page failed: -38.
[    5.638691] hid-rmi 0003:06CB:A001.0004: failed to set page select to 0.
[    5.640806] input: ITE Tech. Inc. ITE Device(8595) as /devices/pci0000:00/0000:00:14.0/usb2/2-3/2-3.3/2-3.3:1.1/0003:06CB:A001.0004/input/input7
[    5.640989] hid-rmi 0003:06CB:A001.0004: input,hiddev0,hidraw3: USB HID v1.10 Pointer [ITE Tech. Inc. ITE Device(8595)] on usb-0000:00:14.0-3.3/input1
[    5.640993] hid-rmi 0003:06CB:A001.0004: Device failed to be properly

Build date 2015-3-30 on Linux.

The problem dosn't occur under Debian Wheezy (Kernel version 3.2.0-4, both touchpad and keyboard are working.

I'm attaching the dmesg, lsusb and lsusb -v output. (This is from arch linux running 3.19.2 kernel, but the problem seems to happen with every recent enough kernel.)
Comment 1 philipp.spilger 2015-03-30 11:29:31 UTC
Created attachment 172641 [details]
lsusb output
Comment 2 philipp.spilger 2015-03-30 11:29:53 UTC
Created attachment 172651 [details]
lsusb verbose output
Comment 3 philipp.spilger 2015-03-30 11:34:02 UTC
I almost forgot: blacklisting the hid-rmi module doesn't help, the device then simply isn't recognized at all.
Comment 4 philipp.spilger 2015-03-30 12:05:02 UTC
Created attachment 172661 [details]
lsmod output
Comment 5 Tobias Auerochs 2018-06-02 10:04:31 UTC
A near identical error can be observed on the Acer Switch 5 (SW512-52) when connecting the cover keyboard:

[   66.169194] usb 1-4: new full-speed USB device number 6 using xhci_hcd
[   66.316823] usb 1-4: New USB device found, idVendor=06cb, idProduct=81a7
[   66.316826] usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[   66.316827] usb 1-4: Product: ACER Tablet Keyboard
[   66.316829] usb 1-4: Manufacturer: Chicony
[   66.320678] input: Chicony ACER Tablet Keyboard as /devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4:1.0/0003:06CB:81A7.0006/input/input25
[   66.375973] hid-generic 0003:06CB:81A7.0006: input,hidraw2: USB HID v1.11 Keyboard [Chicony ACER Tablet Keyboard] on usb-0000:00:14.0-4/input0
[   66.380473] input: Chicony ACER Tablet Keyboard as /devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4:1.1/0003:06CB:81A7.0007/input/input26
[   66.435962] hid-generic 0003:06CB:81A7.0007: input,hiddev1,hidraw3: USB HID v1.11 Device [Chicony ACER Tablet Keyboard] on usb-0000:00:14.0-4/input1
[   66.496268] hid-rmi 0003:06CB:81A7.0008: failed to write hid report (-38)
[   66.496270] hid-rmi 0003:06CB:81A7.0008: rmi_set_page: set page failed: -38.
[   66.496271] hid-rmi 0003:06CB:81A7.0008: failed to set page select to 0.
[   66.496520] hid-rmi 0003:06CB:81A7.0008: hiddev2,hidraw4: USB HID v1.11 Mouse [Chicony ACER Tablet Keyboard] on usb-0000:00:14.0-4/input2

Also, once one disconnects it again, a kernel oops occurs:

[   79.495314] usb 1-4: USB disconnect, device number 6
[   79.646369] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[   79.646393] IP: device_del+0x26/0x560
[   79.646398] PGD 0 P4D 0 
[   79.646410] Oops: 0000 [#1] PREEMPT SMP PTI
[   79.646416] Modules linked in: hid_rmi rmi_core ccm rfcomm xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack libcrc32c crc32c_generic ipt_REJECT nf_reject_ipv4 xt_tcpudp tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables devlink iptable_filter bnep arc4 nls_iso8859_1 nls_cp437 vfat fat snd_hda_codec_hdmi iwlmvm mac80211 dcdbas dell_wmi_descriptor snd_hda_codec_realtek snd_hda_codec_generic iwlwifi snd_soc_skl snd_soc_skl_ipc snd_hda_ext_core snd_soc_sst_dsp snd_soc_sst_ipc snd_soc_acpi hid_sensor_magn_3d joydev hid_sensor_accel_3d hid_sensor_incl_3d hid_sensor_gyro_3d hid_sensor_rotation hid_sensor_als snd_soc_core mousedev hid_sensor_trigger cfg80211 industrialio_triggered_buffer
[   79.646530]  kfifo_buf hid_sensor_iio_common industrialio snd_compress hid_multitouch kvmgt vfio_mdev ac97_bus mdev vfio_iommu_type1 vfio snd_pcm_dmaengine hid_sensor_hub iTCO_wdt iTCO_vendor_support intel_ishtp_hid input_leds hid_generic serio_raw atkbd libps2 intel_wmi_thunderbolt wmi_bmof acer_wmi i915 intel_rapl x86_pkg_temp_thermal intel_powerclamp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel i2c_algo_bit ghash_clmulni_intel pcbc drm_kms_helper btusb aesni_intel snd_hda_intel aes_x86_64 btrtl crypto_simd glue_helper btbcm btintel drm snd_hda_codec cryptd bluetooth intel_cstate snd_hda_core intel_uncore snd_hwdep ipu3_cio2 snd_pcm uvcvideo intel_rapl_perf v4l2_fwnode videobuf2_dma_sg videobuf2_vmalloc pcspkr videobuf2_memops snd_timer videobuf2_v4l2 intel_gtt i2c_i801 rtsx_usb_ms
[   79.646663]  snd videobuf2_common agpgart shpchp soundcore ecdh_generic syscopyarea mei_me sysfillrect videodev rfkill memstick sysimgblt idma64 crc16 mei fb_sys_fops intel_ish_ipc intel_lpss_pci i2c_hid usbhid media hid intel_ishtp intel_lpss processor_thermal_device intel_soc_dts_iosf intel_pch_thermal i8042 int3403_thermal int340x_thermal_zone rtc_cmos serio wmi battery evdev intel_vbtn ac sparse_keymap int3400_thermal acpi_thermal_rel mac_hid usbip_host usbip_core coretemp msr crypto_user ip_tables x_tables rtsx_usb_sdmmc led_class mmc_core rtsx_usb zfs(PO) zunicode(PO) zlua(PO) zcommon(PO) znvpair(PO) zavl(PO) icp(PO) spl(O) ahci libahci xhci_pci libata xhci_hcd scsi_mod usbcore usb_common lz4 lz4_compress
[   79.646809] CPU: 3 PID: 62 Comm: kworker/3:1 Tainted: P     U     O     4.16.12-1-zen #1
[   79.646815] Hardware name: Acer Switch SW512-52/Guam_KL, BIOS V1.05 01/23/2018
[   79.646847] Workqueue: usb_hub_wq hub_event [usbcore]
[   79.646861] RIP: 0010:device_del+0x26/0x560
[   79.646867] RSP: 0018:ffffa36a810fbab0 EFLAGS: 00010246
[   79.646874] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   79.646880] RDX: 0000000000000001 RSI: 000000007fffffff RDI: 0000000000000000
[   79.646886] RBP: ffff9d4e97caa000 R08: 0000000000000000 R09: 00000001001e001d
[   79.646892] R10: ffff9d4f29400300 R11: 00000000001e001d R12: 0000000000000000
[   79.646898] R13: ffff9d4e97cab8b8 R14: ffff9d4e97cab8e0 R15: ffffffffc1735138
[   79.646905] FS:  0000000000000000(0000) GS:ffff9d4f31d80000(0000) knlGS:0000000000000000
[   79.646911] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   79.646917] CR2: 0000000000000000 CR3: 000000019720a003 CR4: 00000000003606e0
[   79.646922] Call Trace:
[   79.646947]  rmi_unregister_transport_device+0x12/0x20 [rmi_core]
[   79.646959]  rmi_remove+0x41/0x50 [hid_rmi]
[   79.646974]  hid_device_remove+0x53/0x100 [hid]
[   79.646986]  device_release_driver_internal+0x1a8/0x2a0
[   79.646995]  bus_remove_device+0xe9/0x170
[   79.647005]  device_del+0x205/0x560
[   79.647014]  ? preempt_count_add+0x68/0xa0
[   79.647028]  hid_destroy_device+0x42/0x60 [hid]
[   79.647041]  usbhid_disconnect+0x43/0x60 [usbhid]
[   79.647071]  usb_unbind_interface+0x80/0x2f0 [usbcore]
[   79.647084]  device_release_driver_internal+0x1a8/0x2a0
[   79.647093]  bus_remove_device+0xe9/0x170
[   79.647103]  device_del+0x205/0x560
[   79.647133]  usb_disable_device+0xcf/0x3d0 [usbcore]
[   79.647162]  usb_disconnect+0xcb/0x2b0 [usbcore]
[   79.647190]  hub_event+0xf11/0x1a90 [usbcore]
[   79.647204]  process_one_work+0x1e3/0x3c0
[   79.647215]  worker_thread+0x2b/0x450
[   79.647224]  ? process_one_work+0x3c0/0x3c0
[   79.647233]  kthread+0x112/0x130
[   79.647244]  ? kthread_create_worker_on_cpu+0x1d0/0x1d0
[   79.647255]  ret_from_fork+0x35/0x40
[   79.647264] Code: 00 00 00 00 00 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 31 c0 <48> 8b 07 48 89 04 24 48 8b 87 80 00 00 00 48 85 c0 74 1b 48 8b 
[   79.647391] RIP: device_del+0x26/0x560 RSP: ffffa36a810fbab0
[   79.647396] CR2: 0000000000000000
[   79.647404] ---[ end trace 5688dde852c1db8c ]---

I am currently trying to dig through kernel code a bit an so far it appears to be that the usbhid module (which hid-rmi is talking to as the low-level driver) assumes an OUT endpoint to exist (as stored in the urbout field), however as can be seen in lsusb:

    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      1 Boot Interface Subclass
      bInterfaceProtocol      2 Mouse
      iInterface              0 
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.11
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength     148
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               1

There is only an IN endpoint and that causes usbid to return an ENOSYS in usbhid_output_report and that is what causes the first set of errors that can be seen.

The pasted dmesg and lsusb output are from the Acer Switch 5, but it seems the relevant data matches with what is happening on the reported Lenovo device as well.

A minor thing to note is that I had the hid-rmi module blacklisted for the lsusb output as lsusb otherwise freezes on this system, which unlike on the reported device still leaves the touchpad in a semi-functional state with no multi-touch features.

In case anyone has an idea what is causing this and has further clues on what to debug, I can test things on this device at least for the coming week, but I might return it as this is somewhat of a deal-breaker.

If someone thinks it is better to open a separate bug report for this I would gladly do so, but as far as I can tell, the two issues are probably linked.

Using Arch Linux with 4.16.x kernel (also happens on 4.15.x as expected).
Comment 6 Hristo Venev 2019-01-08 13:19:42 UTC
The same thing is observed on Acer Switch 3, USB ID 06cb:81a7.