linux-kernel - Re: [PATCH v2] HID: Add Wireless Radio Control feature for Chicony devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPpJ_edoMq0dSqOQuiRpV861brBTA8TyRXB=wyVuA=FwokFW9Q@mail.gmail.com>
Date:   Mon, 11 Jan 2021 13:40:25 +0800
From:   Jian-Hong Pan <jhp@...lessos.org>
To:     Jiri Kosina <jikos@...nel.org>
Cc:     Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        Chris Chiu <chiu@...lessos.org>,
        linux-input <linux-input@...r.kernel.org>,
        Linux Kernel <linux-kernel@...r.kernel.org>,
        linux@...lessos.org
Subject: Re: [PATCH v2] HID: Add Wireless Radio Control feature for Chicony devices

Jiri Kosina <jikos@...nel.org> 於 2021年1月7日 週四 下午5:23寫道：
>
> On Wed, 23 Dec 2020, Jian-Hong Pan wrote:
>
> > Some Chicony's keyboards support airplane mode hotkey (Fn+F2) with
> > "Wireless Radio Control" feature. For example, the wireless keyboard
> > [04f2:1236] shipped with ASUS all-in-one desktop.
> >
> > After consulting Chicony for this hotkey, learned the device will send
> > with 0x11 as the report ID and 0x1 as the value when the key is pressed
> > down.
> >
> > This patch maps the event as KEY_RFKILL.
>
> I don't know how exactly does the report descriptor of that device look
> like, but is this not doable from userspace via setkeycode() (udev/systemd
> is shipping a lot of such mappings already -- see evdev/keyboard
> definitions in hwdb).

Thanks for your suggestion!

I have tested the key with evtest.  But it has no response from all
inputs.  Nor response from xev.

So, I tried usb monitor to see what does it send:

$ lsusb -d 04f2:1236
Bus 001 Device 002: ID 04f2:1236 Chicony Electronics Co., Ltd
$ sudo modprobe usbmon
$ sudo cat /sys/kernel/debug/usb/usbmon/1u
ffff9145e0dea6c0 348311963 C Ii:1:002:1 0:8 8 = 00000000 00000000
ffff9145e0dea6c0 348311996 S Ii:1:002:1 -115:8 8 <
ffff9145e0deaf00 352852533 C Ii:1:002:2 0:4 2 = 1101
ffff9145e0deaf00 352852547 S Ii:1:002:2 -115:4 3 <

It sends 0x1101 for the hotkey.  The same response from hid events:

$ sudo cat /sys/kernel/debug/hid/0003\:04F2\:1236.0002/events
report (size 2) (numbered) =  11 01

Then, I notice there is the RFKILL event listed on the "Chicony USB
Receiver Wireless Radio Control" device:

$ sudo evtest /dev/input/event8
Input driver version is 1.0.1
Input device ID: bus 0x3 vendor 0x4f2 product 0x1236 version 0x111
Input device name: "Chicony USB Receiver Wireless Radio Control"
Supported events:
  Event type 0 (EV_SYN)
  Event type 1 (EV_KEY)
    Event code 103 (KEY_UP)
    Event code 105 (KEY_LEFT)
    Event code 106 (KEY_RIGHT)
    Event code 108 (KEY_DOWN)
    Event code 116 (KEY_POWER)
    Event code 138 (KEY_HELP)
    Event code 139 (KEY_MENU)
    Event code 142 (KEY_SLEEP)
    Event code 143 (KEY_WAKEUP)
    Event code 148 (KEY_PROG1)
    Event code 174 (KEY_EXIT)
    Event code 227 (KEY_SWITCHVIDEOMODE)
    Event code 247 (KEY_RFKILL)
    Event code 314 (BTN_SELECT)
    Event code 315 (BTN_START)
    Event code 353 (KEY_SELECT)
    Event code 356 (KEY_POWER2)
    Event code 408 (KEY_RESTART)
    Event code 438 (KEY_CONTEXT_MENU)
  Event type 2 (EV_REL)
    Event code 9 (REL_MISC)
  Event type 3 (EV_ABS)
...

Also, after debugging, I found its HID application ID is
HID_GD_WIRELESS_RADIO_CTLS 0x0001000c [1].
Then, I searched HID_GD_WIRELESS_RADIO_CTLS in the kernel.  I found
HID_GD_RFKILL_BTN [2] is mapped in hid-input.
However, this key press on the Chicony keyboard maps to nothing, nor
HID_GD_RFKILL_BTN.  Only have the HID report with raw data 0x11 0x00
as mentioned above.
It is more like ignored by the kernel and it even has no scancode.
That's why I try to map it as KEY_RFKILL in the driver.

[1] https://elixir.bootlin.com/linux/v5.10/source/include/linux/hid.h#L181
[2] https://elixir.bootlin.com/linux/v5.10/source/drivers/hid/hid-input.c#L743

Regards,
Jian-Hong Pan