// SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2024 Red Hat, Inc */ #include "vmlinux.h" #include "hid_bpf.h" #include "hid_bpf_helpers.h" #include "hid_report_helpers.h" #include <bpf/bpf_tracing.h> #define HID_BPF_ASYNC_MAX_CTX 1 #include "hid_bpf_async.h" #define VID_UGEE 0x28BD /* same PID whether connected directly or through the provided dongle: */ #define PID_ACK05_REMOTE 0x0202 HID_BPF_CONFIG( HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, VID_UGEE, PID_ACK05_REMOTE), ); /* * By default, the pad reports the buttons through a set of key sequences. * * The pad reports a classic keyboard report descriptor: * # HANVON UGEE Shortcut Remote * Report descriptor length: 102 bytes * 0x05, 0x01, // Usage Page (Generic Desktop) 0 * 0x09, 0x02, // Usage (Mouse) 2 * 0xa1, 0x01, // Collection (Application) 4 * 0x85, 0x09, // Report ID (9) 6 * 0x09, 0x01, // Usage (Pointer) 8 * 0xa1, 0x00, // Collection (Physical) 10 * 0x05, 0x09, // Usage Page (Button) 12 * 0x19, 0x01, // UsageMinimum (1) 14 * 0x29, 0x03, // UsageMaximum (3) 16 * 0x15, 0x00, // Logical Minimum (0) 18 * 0x25, 0x01, // Logical Maximum (1) 20 * 0x95, 0x03, // Report Count (3) 22 * 0x75, 0x01, // Report Size (1) 24 * 0x81, 0x02, // Input (Data,Var,Abs) 26 * 0x95, 0x05, // Report Count (5) 28 * 0x81, 0x01, // Input (Cnst,Arr,Abs) 30 * 0x05, 0x01, // Usage Page (Generic Desktop) 32 * 0x09, 0x30, // Usage (X) 34 * 0x09, 0x31, // Usage (Y) 36 * 0x26, 0xff, 0x7f, // Logical Maximum (32767) 38 * 0x95, 0x02, // Report Count (2) 41 * 0x75, 0x10, // Report Size (16) 43 * 0x81, 0x02, // Input (Data,Var,Abs) 45 * 0x05, 0x0d, // Usage Page (Digitizers) 47 * 0x09, 0x30, // Usage (Tip Pressure) 49 * 0x26, 0xff, 0x07, // Logical Maximum (2047) 51 * 0x95, 0x01, // Report Count (1) 54 * 0x75, 0x10, // Report Size (16) 56 * 0x81, 0x02, // Input (Data,Var,Abs) 58 * 0xc0, // End Collection 60 * 0xc0, // End Collection 61 * 0x05, 0x01, // Usage Page (Generic Desktop) 62 * 0x09, 0x06, // Usage (Keyboard) 64 * 0xa1, 0x01, // Collection (Application) 66 * 0x85, 0x06, // Report ID (6) 68 * 0x05, 0x07, // Usage Page (Keyboard/Keypad) 70 * 0x19, 0xe0, // UsageMinimum (224) 72 * 0x29, 0xe7, // UsageMaximum (231) 74 * 0x15, 0x00, // Logical Minimum (0) 76 * 0x25, 0x01, // Logical Maximum (1) 78 * 0x75, 0x01, // Report Size (1) 80 * 0x95, 0x08, // Report Count (8) 82 * 0x81, 0x02, // Input (Data,Var,Abs) 84 * 0x05, 0x07, // Usage Page (Keyboard/Keypad) 86 * 0x19, 0x00, // UsageMinimum (0) 88 * 0x29, 0xff, // UsageMaximum (255) 90 * 0x26, 0xff, 0x00, // Logical Maximum (255) 92 * 0x75, 0x08, // Report Size (8) 95 * 0x95, 0x06, // Report Count (6) 97 * 0x81, 0x00, // Input (Data,Arr,Abs) 99 * 0xc0, // End Collection 101 * * Each button gets assigned the following events: * * Buttons released: 06 00 00 00 00 00 00 00 * Button 1: 06 01 12 00 00 00 00 00 -> LControl + o * Button 2: 06 01 11 00 00 00 00 00 -> LControl + n * Button 3: 06 00 3e 00 00 00 00 00 -> F5 * Button 4: 06 02 00 00 00 00 00 00 -> LShift * Button 5: 06 01 00 00 00 00 00 00 -> LControl * Button 6: 06 04 00 00 00 00 00 00 -> LAlt * Button 7: 06 01 16 00 00 00 00 00 -> LControl + s * Button 8: 06 01 1d 00 00 00 00 00 -> LControl + z * Button 9: 06 00 2c 00 00 00 00 00 -> Space * Button 10: 06 03 1d 00 00 00 00 00 -> LControl + LShift + z * Wheel: 06 01 57 00 00 00 00 00 -> clockwise rotation (LControl + Keypad Plus) * Wheel: 06 01 56 00 00 00 00 00 -> counter-clockwise rotation * (LControl + Keypad Minus) * * However, multiple buttons can be pressed at the same time, and when this happens, * each button gets assigned a new slot in the Input (Data,Arr,Abs): * * Button 1 + 3: 06 01 12 3e 00 00 00 00 -> LControl + o + F5 * * When a modifier is pressed (Button 4, 5, or 6), the assigned key is set to 00: * * Button 5 + 7: 06 01 00 16 00 00 00 00 -> LControl + s * * This is mostly fine, but with Button 8 and Button 10 sharing the same * key value ("z"), there are cases where we can not know which is which. * */ #define PAD_WIRED_DESCRIPTOR_LENGTH 102 #define PAD_DONGLE_DESCRIPTOR_LENGTH 177 #define STYLUS_DESCRIPTOR_LENGTH 109 #define VENDOR_DESCRIPTOR_LENGTH 36 #define PAD_REPORT_ID 6 #define RAW_PAD_REPORT_ID 0xf0 #define RAW_BATTERY_REPORT_ID 0xf2 #define VENDOR_REPORT_ID 2 #define PAD_REPORT_LENGTH 8 #define VENDOR_REPORT_LENGTH 12 __u16 last_button_state; static const __u8 disabled_rdesc[] = { // Make sure we match our original report length FixedSizeVendorReport(VENDOR_REPORT_LENGTH) }; static const __u8 fixed_rdesc_vendor[] = { UsagePage_GenericDesktop Usage_GD_Keypad CollectionApplication( // -- Byte 0 in report ReportId(RAW_PAD_REPORT_ID) // Byte 1 in report - same than report ID ReportCount(1) ReportSize(8) Input(Const) // padding (internal report ID) LogicalMaximum_i8(0) LogicalMaximum_i8(1) UsagePage_Digitizers Usage_Dig_TabletFunctionKeys CollectionPhysical( // Byte 2-3 is the button state UsagePage_Button UsageMinimum_i8(0x01) UsageMaximum_i8(0x0a) LogicalMinimum_i8(0x0) LogicalMaximum_i8(0x1) ReportCount(10) ReportSize(1) Input(Var|Abs) Usage_i8(0x31) // will be mapped as BTN_A / BTN_SOUTH ReportCount(1) Input(Var|Abs) ReportCount(5) // padding Input(Const) // Byte 4 in report - just exists so we get to be a tablet pad UsagePage_Digitizers Usage_Dig_BarrelSwitch // BTN_STYLUS ReportCount(1) ReportSize(1) Input(Var|Abs) ReportCount(7) // padding Input(Const) // Bytes 5/6 in report - just exists so we get to be a tablet pad UsagePage_GenericDesktop Usage_GD_X Usage_GD_Y ReportCount(2) ReportSize(8) Input(Var|Abs) // Byte 7 in report is the dial Usage_GD_Wheel LogicalMinimum_i8(-1) LogicalMaximum_i8(1) ReportCount(1) ReportSize(8) Input(Var|Rel) ) // -- Byte 0 in report ReportId(RAW_BATTERY_REPORT_ID) // Byte 1 in report - same than report ID ReportCount(1) ReportSize(8) Input(Const) // padding (internal report ID) // Byte 2 in report - always 0x01 Input(Const) // padding (internal report ID) UsagePage_Digitizers /* * We represent the device as a stylus to force the kernel to not * directly query its battery state. Instead the kernel will rely * only on the provided events. */ Usage_Dig_Stylus CollectionPhysical( // Byte 3 in report - battery value UsagePage_BatterySystem Usage_BS_AbsoluteStateOfCharge LogicalMinimum_i8(0) LogicalMaximum_i8(100) ReportCount(1) ReportSize(8) Input(Var|Abs) // Byte 4 in report - charging state Usage_BS_Charging LogicalMinimum_i8(0) LogicalMaximum_i8(1) ReportCount(1) ReportSize(8) Input(Var|Abs) ) ) }; SEC(HID_BPF_RDESC_FIXUP) int BPF_PROG(ack05_fix_rdesc, struct hid_bpf_ctx *hctx) { __u8 *data = hid_bpf_get_data(hctx, 0 /* offset */, HID_MAX_DESCRIPTOR_SIZE /* size */); __s32 rdesc_size = hctx->size; if (!data) return 0; /* EPERM check */ if (rdesc_size == VENDOR_DESCRIPTOR_LENGTH) { /* * The vendor fixed rdesc is appended after the current one, * to keep the output reports working. */ __builtin_memcpy(data + rdesc_size, fixed_rdesc_vendor, sizeof(fixed_rdesc_vendor)); return sizeof(fixed_rdesc_vendor) + rdesc_size; } hid_set_name(hctx->hid, "Disabled by HID-BPF Hanvon Ugee Shortcut Remote"); __builtin_memcpy(data, disabled_rdesc, sizeof(disabled_rdesc)); return sizeof(disabled_rdesc); } static int HID_BPF_ASYNC_FUN(switch_to_raw_mode)(struct hid_bpf_ctx *hid) { static __u8 magic_0[32] = {0x02, 0xb0, 0x04, 0x00, 0x00}; int err; /* * The proprietary driver sends the 3 following packets after the * above one. * These don't seem to have any effect, so we don't send them to save * some processing time. * * static __u8 magic_1[32] = {0x02, 0xb4, 0x01, 0x00, 0x01}; * static __u8 magic_2[32] = {0x02, 0xb4, 0x01, 0x00, 0xff}; * static __u8 magic_3[32] = {0x02, 0xb8, 0x04, 0x00, 0x00}; */ err = hid_bpf_hw_output_report(hid, magic_0, sizeof(magic_0)); if (err < 0) return err; return 0; } SEC(HID_BPF_DEVICE_EVENT) int BPF_PROG(ack05_fix_events, struct hid_bpf_ctx *hctx) { __u8 *data = hid_bpf_get_data(hctx, 0 /* offset */, PAD_REPORT_LENGTH); int ret = 0; if (!data) return 0; /* EPERM check */ if (data[0] != VENDOR_REPORT_ID) return 0; /* reconnect event */ if (data[1] == 0xf8 && data[2] == 02 && data[3] == 0x01) HID_BPF_ASYNC_DELAYED_CALL(switch_to_raw_mode, hctx, 10); /* button event */ if (data[1] == RAW_PAD_REPORT_ID) { data[0] = data[1]; if (data[7] == 0x02) data[7] = 0xff; ret = 8; } else if (data[1] == RAW_BATTERY_REPORT_ID) { data[0] = data[1]; ret = 5; } return ret; } HID_BPF_OPS(xppen_ack05_remote) = { .hid_device_event = (void *)ack05_fix_events, .hid_rdesc_fixup = (void *)ack05_fix_rdesc, }; SEC("syscall") int probe(struct hid_bpf_probe_args *ctx) { switch (ctx->rdesc_size) { case PAD_WIRED_DESCRIPTOR_LENGTH: case PAD_DONGLE_DESCRIPTOR_LENGTH: case STYLUS_DESCRIPTOR_LENGTH: case VENDOR_DESCRIPTOR_LENGTH: ctx->retval = 0; break; default: ctx->retval = -EINVAL; break; } if (ctx->rdesc_size == VENDOR_DESCRIPTOR_LENGTH) { struct hid_bpf_ctx *hctx = hid_bpf_allocate_context(ctx->hid); if (!hctx) { ctx->retval = -EINVAL; return 0; } ctx->retval = HID_BPF_ASYNC_INIT(switch_to_raw_mode) || switch_to_raw_mode(hctx); hid_bpf_release_context(hctx); } return 0; } char _license[] SEC("license") = "GPL";
