linux-kernel - Re: [PATCH] HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231209182132.i3saw7kcjyykhizu@jekhomev>
Date:   Sat, 9 Dec 2023 20:21:32 +0200
From:   Yauhen Kharuzhy <jekhor@...il.com>
To:     Mikhail Khvainitski <me@...oinitsky.org>
Cc:     Jiri Kosina <jikos@...nel.org>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
        ValdikSS <iam@...dikss.org.ru>
Subject: Re: [PATCH] HID: lenovo: Detect quirk-free fw on cptkbd and stop
 applying workaround

On Sat, Dec 09, 2023 at 06:56:48PM +0200, Yauhen Kharuzhy wrote:
> On Sat, Dec 09, 2023 at 02:50:16PM +0200, Yauhen Kharuzhy wrote:
> > On Sun, Sep 24, 2023 at 01:58:30AM +0300, Mikhail Khvainitski wrote:
> > > Built-in firmware of cptkbd handles scrolling by itself (when middle
> > > button is pressed) but with issues: it does not support horizontal and
> > > hi-res scrolling and upon middle button release it sends middle button
> > > click even if there was a scrolling event. Commit 3cb5ff0220e3 ("HID:
> > > lenovo: Hide middle-button press until release") workarounds last
> > > issue but it's impossible to workaround scrolling-related issues
> > > without firmware modification.
> > > 
> > > Likely, Dennis Schneider has reverse engineered the firmware and
> > > provided an instruction on how to patch it [1]. However,
> > > aforementioned workaround prevents userspace (libinput) from knowing
> > > exact moment when middle button has been pressed down and performing
> > > "On-Button scrolling". This commit detects correctly-behaving patched
> > > firmware if cursor movement events has been received during middle
> > > button being pressed and stops applying workaround for this device.
> > > 
> > > Link: https://hohlerde.org/rauch/en/elektronik/projekte/tpkbd-fix/ [1]
> > 
> > This patch breaks a scrolling at my ThinkPad TrackPoint Keyboard II: it
> > starts to report middle-button push/release events with scrolling events
> > between. A support for this keyboard was added in
> > 24401f291dcc4f2c18b9e2f65763cbaadc7a1528 "HID: lenovo: Add support for
> > ThinkPad TrackPoint Keyboard II" commit.
> 
> I figured this out.
> 
> This keyboard can emit REL_Y/REL_X events between of middle-button
> events (if user was moving a cursor and press middle button without of
> stopping this), so this algorithm does a false-positive detection and switches
> the workaround off like for patched firmware:
> 
> Event: time 1702140625.854777, type 2 (EV_REL), code 1 (REL_Y), value 2
> Event: time 1702140625.854777, -------------- SYN_REPORT ------------
> Event: time 1702140625.870769, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
> Event: time 1702140625.870769, -------------- SYN_REPORT ------------
> Event: time 1702140625.870771, type 2 (EV_REL), code 1 (REL_Y), value 2
> Event: time 1702140625.870771, -------------- SYN_REPORT ------------
> Event: time 1702140625.970780, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> Event: time 1702140625.970780, -------------- SYN_REPORT ------------
> Event: time 1702140626.058800, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> Event: time 1702140626.058800, -------------- SYN_REPORT ------------
> Event: time 1702140630.462974, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> Event: time 1702140630.462974, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
> Event: time 1702140630.462974, -------------- SYN_REPORT ------------

Maybe we should map the wheel HID reports to REL_Y/REL_X in
lenovo_input_mapping_tpIIkbd() to allow libinput to do its wheel emulation job?
I tried this but I am not familiar with HID drivers and had no success.


> 
> 
> > 
> > There is an evtest output below:
> > 
> > Without of commit:
> > 
> > Middle-button click:
> > Event: time 1702122290.593300, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
> > Event: time 1702122290.593300, -------------- SYN_REPORT ------------
> > Event: time 1702122290.593312, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
> > Event: time 1702122290.593312, -------------- SYN_REPORT ------------
> > 
> > Vertical scrolling:
> > Event: time 1702122300.441627, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> > Event: time 1702122300.441627, -------------- SYN_REPORT ------------
> > Event: time 1702122300.565663, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> > Event: time 1702122300.565663, -------------- SYN_REPORT ------------
> > 
> > Horizontal scrolling:
> > Event: time 1702122307.845969, type 2 (EV_REL), code 6 (REL_HWHEEL), value -1
> > Event: time 1702122307.845969, -------------- SYN_REPORT ------------
> > Event: time 1702122307.981954, type 2 (EV_REL), code 6 (REL_HWHEEL), value -1
> > Event: time 1702122307.981954, -------------- SYN_REPORT ------------
> > 
> > 
> > 
> > After commit:
> > 
> > Middle-button click:
> > Event: time 1702125091.290045, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> > Event: time 1702125091.290045, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
> > Event: time 1702125091.290045, -------------- SYN_REPORT ------------
> > Event: time 1702125092.626118, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> > Event: time 1702125092.626118, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
> > Event: time 1702125092.626118, -------------- SYN_REPORT ------------
> > 
> > 
> > Vscroll:
> > Event: time 1702125286.653639, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> > Event: time 1702125286.653639, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
> > Event: time 1702125286.653639, -------------- SYN_REPORT ------------
> > Event: time 1702125287.929689, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> > Event: time 1702125287.929689, -------------- SYN_REPORT ------------
> > Event: time 1702125288.037688, type 2 (EV_REL), code 8 (REL_WHEEL), value -1
> > Event: time 1702125288.037688, -------------- SYN_REPORT ------------
> > Event: time 1702125290.481787, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> > Event: time 1702125290.481787, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
> > Event: time 1702125290.481787, -------------- SYN_REPORT ------------
> > 
> > Hscroll:
> > Event: time 1702125293.841920, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> > Event: time 1702125293.841920, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 1
> > Event: time 1702125293.841920, -------------- SYN_REPORT ------------
> > Event: time 1702125294.761952, type 2 (EV_REL), code 6 (REL_HWHEEL), value -1
> > Event: time 1702125294.761952, -------------- SYN_REPORT ------------
> > Event: time 1702125294.893967, type 2 (EV_REL), code 6 (REL_HWHEEL), value -1
> > Event: time 1702125294.893967, -------------- SYN_REPORT ------------
> > Event: time 1702125296.134006, type 4 (EV_MSC), code 4 (MSC_SCAN), value ffa000fb
> > Event: time 1702125296.134006, type 1 (EV_KEY), code 274 (BTN_MIDDLE), value 0
> > Event: time 1702125296.134006, -------------- SYN_REPORT ------------
> 
> -- 
> Yauhen Kharuzhy

-- 
Yauhen Kharuzhy