linux-kernel - [PATCH v2 4/4] HID: input: work around Win8 stylus-on-touchscreen reporting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 8 Mar 2021 18:42:18 +0100
From:   Ahelenia Ziemiańska 
        <nabijaczleweli@...ijaczleweli.xyz>
To:     unlisted-recipients:; (no To-header on input)
Cc:     Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        Peter Hutterer <peter.hutterer@...-t.net>,
        Jiri Kosina <jikos@...nel.org>, linux-input@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH v2 4/4] HID: input: work around Win8 stylus-on-touchscreen
 reporting

With this, these devices now behave as tablets as expected by userspace

The search in hidinput_is_win8_touching() terminates at f=0, u=0
on Goodix screens (27C6:0111, 27C6:0113), but I expect it
to have negligible impact on devices that don't have TipSwitch
as the first report as well

Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@...ijaczleweli.xyz>
---

Notes:
    changes in v2:
      * hidinput_fixup_win8_inrange() became hidinput_is_win8_touching()
      * BarrelSwitch now anded with TipSwitch

 drivers/hid/hid-input.c | 48 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index a5ba92978473..aee1f1283c1d 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1273,6 +1273,42 @@ static void hidinput_handle_scroll(struct hid_usage *usage,
 	input_event(input, EV_REL, usage->code, hi_res);
 }
 
+/*
+ * Win8 tablet stylus devices send, in order:
+ *   HID_DG_TIPSWITCH (BTN_TOUCH)
+ *   HID_DG_INVERT    (BTN_TOOL_RUBBER)
+ *   HID_DG_ERASER    (BTN_TOUCH)
+ *   HID_DG_INRANGE   (BTN_TOOL_PEN)
+ *
+ * For each of these states:
+ *   hover     :                         INRANGE
+ *   touching  : TIPSWITCH
+ *   hover+2   :           INVERT        INRANGE
+ *   touching+2:                  ERASER INRANGE
+ *
+ * Which means we'd send BTN_TOUCH=0 + BTN_TOOL_PEN=1 on proximity,
+ * then BTN_TOUCH=1 and BTN_TOOL_PEN=0 in consecutive groups when touched,
+ * indicating the stylus leaving the screen as soon as the two meet.
+ *
+ * Additionally, HID_DG_BARRELSWITCH corresponds directly to the button,
+ * regardless of the tip switch, making it borderline impossible to use precisely.
+ */
+static bool hidinput_is_win8_touching(struct hid_device *hid, struct hid_field *field)
+{
+	unsigned f, u;
+	struct hid_field *rfield;
+
+	for (f = 0; f < field->report->maxfield; ++f) {
+		rfield = field->report->field[f];
+		for (u = 0; u < rfield->maxusage; ++u) {
+			if (rfield->usage[u].hid == HID_DG_TIPSWITCH)
+				return rfield->value[u];
+		}
+	}
+
+	return false;
+}
+
 void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value)
 {
 	struct input_dev *input;
@@ -1306,7 +1342,13 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
 		return;
 	}
 
+	if (usage->hid == HID_DG_ERASER && value)
+		*quirks |= HID_QUIRK_INVERT;
+
 	if (usage->hid == HID_DG_INRANGE) {
+		if (hid->group == HID_GROUP_MULTITOUCH_WIN_8)
+			value = value || hidinput_is_win8_touching(hid, field);
+
 		if (value) {
 			input_event(input, usage->type, (*quirks & HID_QUIRK_INVERT) ? BTN_TOOL_RUBBER : usage->code, 1);
 			return;
@@ -1322,6 +1364,12 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
 		input_event(input, EV_KEY, BTN_TOUCH, value > a + ((b - a) >> 3));
 	}
 
+	if (usage->hid == HID_DG_BARRELSWITCH && hid->group == HID_GROUP_MULTITOUCH_WIN_8) {
+		value = value && hidinput_is_win8_touching(hid, field);
+		input_event(input, usage->type, usage->code, value);
+		return;
+	}
+
 	if (usage->hid == (HID_UP_PID | 0x83UL)) { /* Simultaneous Effects Max */
 		dbg_hid("Maximum Effects - %d\n",value);
 		return;
-- 
2.20.1

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)