linux-kernel - Re: [GIT PULL] HID for 5.7

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 3 Apr 2020 14:22:15 +0200
From:   Samuel Čavoj <sammko@...mserver.com>
To:     Jiri Kosina <jikos@...nel.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [GIT PULL] HID for 5.7

On 03.04.2020 12:05, Jiri Kosina wrote:
> On Wed, 1 Apr 2020, Linus Torvalds wrote:
> 
> > Anyway, because I noticed this due to the name, it does strike me that 
> > clearly Windows must be ignoring - or otherwise reacting differently to 
> > - the HID_MAIN_ITEM_CONSTANT flag. Because presumably those mice work 
> > under Windows without special drivers?
> > 
> > In fact, reading that driver, it looks like they report being *both* 
> > constant *and* variable in their report descriptors. Which sounds odd. 
> > Maybe we should do whatever Windows does, and not need a special driver 
> > for this maybe-bot-so-glorious-after-all mouse hardware?
> 
> Adding Samuel to CC.
> 
> From what I understood is that in order to access the buttons reported in 
> report #2 (the one marked with HID_MAIN_ITEM_CONSTANT), you actually *do* 
> need a special software on windows anyway.

The Glorious software is merely used to map the actions to the buttons.
The mouse comes with a common default configuration (forward and back on
the side buttons) but every button can be remapped to any action. I am
used to having a Play/Pause button on my mouse and that's where I
encountered the problem in the first place.

The configuration of the mouse is then stored in the firmware. The
Glorious software is not required to be running or even to be installed
for the mouse to function. The vanilla Windows HID driver is in use.
Sorry if that wasn't clear.

> What we do is that we ignore any changes in reports with 
> HID_MAIN_ITEM_CONSTANT in the HID core.
> 
> It would still be possible to access the report via hidraw, and maybe 
> that's analogy of what the Windows driver/special Glorious software :) 
> does, I don't know. It's hard to believe that Windows would be actually 
> willing to report any changes coming through HID_MAIN_ITEM_CONSTANT 
> reports, but who knows.

It unfortunately appears to be the case. Just for reference, here is the
relevant part of the original descriptor again:

  INPUT(2)[INPUT]
    Field(0)
      Flags( Constant Variable Absolute )
    Field(1)
      Flags( Constant Variable Absolute )
    Field(2)
      Flags( Constant Variable Absolute )

Windows accepts the reports just fine. Unless there is something else at
play here, but I don't see anything that could be since the default HID
driver is used on Windows.

I also set the Relative flag instead of Absolute in the driver, in order
to drop repeat events when holding down the button. These are not
desirable in the case of consumer control events, such as 'Next Track'.
This is not a big problem, though.

Regards,
Samuel