Contributors: 2
Author Tokens Token Proportion Commits Commit Proportion
Benjamin Tissoires 692 99.86% 1 50.00%
Peter Hutterer 1 0.14% 1 50.00%
Total 693 2 


// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2024 Red Hat, Inc
 */

#include "vmlinux.h"
#include "hid_bpf.h"
#include "hid_bpf_helpers.h"
#include "hid_report_helpers.h"
#include <bpf/bpf_tracing.h>

#define HID_BPF_ASYNC_MAX_CTX 1
#include "hid_bpf_async.h"

#define VID_UGEE		0x28BD
/* same PID whether connected directly or through the provided dongle: */
#define PID_ACK05_REMOTE	0x0202


HID_BPF_CONFIG(
	HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, VID_UGEE, PID_ACK05_REMOTE),
);

/*
 * By default, the pad reports the buttons through a set of key sequences.
 *
 * The pad reports a classic keyboard report descriptor:
 * # HANVON UGEE Shortcut Remote
 * Report descriptor length: 102 bytes
 *  0x05, 0x01,                    // Usage Page (Generic Desktop)              0
 *  0x09, 0x02,                    // Usage (Mouse)                             2
 *  0xa1, 0x01,                    // Collection (Application)                  4
 *  0x85, 0x09,                    //   Report ID (9)                           6
 *  0x09, 0x01,                    //   Usage (Pointer)                         8
 *  0xa1, 0x00,                    //   Collection (Physical)                   10
 *  0x05, 0x09,                    //     Usage Page (Button)                   12
 *  0x19, 0x01,                    //     UsageMinimum (1)                      14
 *  0x29, 0x03,                    //     UsageMaximum (3)                      16
 *  0x15, 0x00,                    //     Logical Minimum (0)                   18
 *  0x25, 0x01,                    //     Logical Maximum (1)                   20
 *  0x95, 0x03,                    //     Report Count (3)                      22
 *  0x75, 0x01,                    //     Report Size (1)                       24
 *  0x81, 0x02,                    //     Input (Data,Var,Abs)                  26
 *  0x95, 0x05,                    //     Report Count (5)                      28
 *  0x81, 0x01,                    //     Input (Cnst,Arr,Abs)                  30
 *  0x05, 0x01,                    //     Usage Page (Generic Desktop)          32
 *  0x09, 0x30,                    //     Usage (X)                             34
 *  0x09, 0x31,                    //     Usage (Y)                             36
 *  0x26, 0xff, 0x7f,              //     Logical Maximum (32767)               38
 *  0x95, 0x02,                    //     Report Count (2)                      41
 *  0x75, 0x10,                    //     Report Size (16)                      43
 *  0x81, 0x02,                    //     Input (Data,Var,Abs)                  45
 *  0x05, 0x0d,                    //     Usage Page (Digitizers)               47
 *  0x09, 0x30,                    //     Usage (Tip Pressure)                  49
 *  0x26, 0xff, 0x07,              //     Logical Maximum (2047)                51
 *  0x95, 0x01,                    //     Report Count (1)                      54
 *  0x75, 0x10,                    //     Report Size (16)                      56
 *  0x81, 0x02,                    //     Input (Data,Var,Abs)                  58
 *  0xc0,                          //   End Collection                          60
 *  0xc0,                          // End Collection                            61
 *  0x05, 0x01,                    // Usage Page (Generic Desktop)              62
 *  0x09, 0x06,                    // Usage (Keyboard)                          64
 *  0xa1, 0x01,                    // Collection (Application)                  66
 *  0x85, 0x06,                    //   Report ID (6)                           68
 *  0x05, 0x07,                    //   Usage Page (Keyboard/Keypad)            70
 *  0x19, 0xe0,                    //   UsageMinimum (224)                      72
 *  0x29, 0xe7,                    //   UsageMaximum (231)                      74
 *  0x15, 0x00,                    //   Logical Minimum (0)                     76
 *  0x25, 0x01,                    //   Logical Maximum (1)                     78
 *  0x75, 0x01,                    //   Report Size (1)                         80
 *  0x95, 0x08,                    //   Report Count (8)                        82
 *  0x81, 0x02,                    //   Input (Data,Var,Abs)                    84
 *  0x05, 0x07,                    //   Usage Page (Keyboard/Keypad)            86
 *  0x19, 0x00,                    //   UsageMinimum (0)                        88
 *  0x29, 0xff,                    //   UsageMaximum (255)                      90
 *  0x26, 0xff, 0x00,              //   Logical Maximum (255)                   92
 *  0x75, 0x08,                    //   Report Size (8)                         95
 *  0x95, 0x06,                    //   Report Count (6)                        97
 *  0x81, 0x00,                    //   Input (Data,Arr,Abs)                    99
 *  0xc0,                          // End Collection                            101
 *
 * Each button gets assigned the following events:
 *
 *   Buttons released: 06 00 00 00 00 00 00 00
 *   Button 1:         06 01 12 00 00 00 00 00 -> LControl + o
 *   Button 2:         06 01 11 00 00 00 00 00 -> LControl + n
 *   Button 3:         06 00 3e 00 00 00 00 00 -> F5
 *   Button 4:         06 02 00 00 00 00 00 00 -> LShift
 *   Button 5:         06 01 00 00 00 00 00 00 -> LControl
 *   Button 6:         06 04 00 00 00 00 00 00 -> LAlt
 *   Button 7:         06 01 16 00 00 00 00 00 -> LControl + s
 *   Button 8:         06 01 1d 00 00 00 00 00 -> LControl + z
 *   Button 9:         06 00 2c 00 00 00 00 00 -> Space
 *   Button 10:        06 03 1d 00 00 00 00 00 -> LControl + LShift + z
 *   Wheel:            06 01 57 00 00 00 00 00 -> clockwise rotation (LControl + Keypad Plus)
 *   Wheel:            06 01 56 00 00 00 00 00 -> counter-clockwise rotation
 *						  (LControl + Keypad Minus)
 *
 * However, multiple buttons can be pressed at the same time, and when this happens,
 * each button gets assigned a new slot in the Input (Data,Arr,Abs):
 *
 *   Button 1 + 3:     06 01 12 3e 00 00 00 00 -> LControl + o + F5
 *
 * When a modifier is pressed (Button 4, 5, or 6), the assigned key is set to 00:
 *
 *   Button 5 + 7:     06 01 00 16 00 00 00 00 -> LControl + s
 *
 * This is mostly fine, but with Button 8 and Button 10 sharing the same
 * key value ("z"), there are cases where we can not know which is which.
 *
 */

#define PAD_WIRED_DESCRIPTOR_LENGTH 102
#define PAD_DONGLE_DESCRIPTOR_LENGTH 177
#define STYLUS_DESCRIPTOR_LENGTH 109
#define VENDOR_DESCRIPTOR_LENGTH 36
#define PAD_REPORT_ID 6
#define RAW_PAD_REPORT_ID 0xf0
#define RAW_BATTERY_REPORT_ID 0xf2
#define VENDOR_REPORT_ID 2
#define PAD_REPORT_LENGTH 8
#define VENDOR_REPORT_LENGTH 12

__u16 last_button_state;

static const __u8 disabled_rdesc[] = {
	// Make sure we match our original report length
	FixedSizeVendorReport(VENDOR_REPORT_LENGTH)
};

static const __u8 fixed_rdesc_vendor[] = {
	UsagePage_GenericDesktop
	Usage_GD_Keypad
	CollectionApplication(
		// -- Byte 0 in report
		ReportId(RAW_PAD_REPORT_ID)
		// Byte 1 in report - same than report ID
		ReportCount(1)
		ReportSize(8)
		Input(Const) // padding (internal report ID)
		LogicalMaximum_i8(0)
		LogicalMaximum_i8(1)
		UsagePage_Digitizers
		Usage_Dig_TabletFunctionKeys
		CollectionPhysical(
			// Byte 2-3 is the button state
			UsagePage_Button
			UsageMinimum_i8(0x01)
			UsageMaximum_i8(0x0a)
			LogicalMinimum_i8(0x0)
			LogicalMaximum_i8(0x1)
			ReportCount(10)
			ReportSize(1)
			Input(Var|Abs)
			Usage_i8(0x31) // will be mapped as BTN_A / BTN_SOUTH
			ReportCount(1)
			Input(Var|Abs)
			ReportCount(5) // padding
			Input(Const)
			// Byte 4 in report - just exists so we get to be a tablet pad
			UsagePage_Digitizers
			Usage_Dig_BarrelSwitch // BTN_STYLUS
			ReportCount(1)
			ReportSize(1)
			Input(Var|Abs)
			ReportCount(7) // padding
			Input(Const)
			// Bytes 5/6 in report - just exists so we get to be a tablet pad
			UsagePage_GenericDesktop
			Usage_GD_X
			Usage_GD_Y
			ReportCount(2)
			ReportSize(8)
			Input(Var|Abs)
			// Byte 7 in report is the dial
			Usage_GD_Wheel
			LogicalMinimum_i8(-1)
			LogicalMaximum_i8(1)
			ReportCount(1)
			ReportSize(8)
			Input(Var|Rel)
		)
		// -- Byte 0 in report
		ReportId(RAW_BATTERY_REPORT_ID)
		// Byte 1 in report - same than report ID
		ReportCount(1)
		ReportSize(8)
		Input(Const) // padding (internal report ID)
		// Byte 2 in report - always 0x01
		Input(Const) // padding (internal report ID)
		UsagePage_Digitizers
		/*
		 * We represent the device as a stylus to force the kernel to not
		 * directly query its battery state. Instead the kernel will rely
		 * only on the provided events.
		 */
		Usage_Dig_Stylus
		CollectionPhysical(
			// Byte 3 in report - battery value
			UsagePage_BatterySystem
			Usage_BS_AbsoluteStateOfCharge
			LogicalMinimum_i8(0)
			LogicalMaximum_i8(100)
			ReportCount(1)
			ReportSize(8)
			Input(Var|Abs)
			// Byte 4 in report - charging state
			Usage_BS_Charging
			LogicalMinimum_i8(0)
			LogicalMaximum_i8(1)
			ReportCount(1)
			ReportSize(8)
			Input(Var|Abs)
		)
	)
};

SEC(HID_BPF_RDESC_FIXUP)
int BPF_PROG(ack05_fix_rdesc, struct hid_bpf_ctx *hctx)
{
	__u8 *data = hid_bpf_get_data(hctx, 0 /* offset */, HID_MAX_DESCRIPTOR_SIZE /* size */);
	__s32 rdesc_size = hctx->size;

	if (!data)
		return 0; /* EPERM check */

	if (rdesc_size == VENDOR_DESCRIPTOR_LENGTH) {
		/*
		 * The vendor fixed rdesc is appended after the current one,
		 * to keep the output reports working.
		 */
		__builtin_memcpy(data + rdesc_size, fixed_rdesc_vendor, sizeof(fixed_rdesc_vendor));
		return sizeof(fixed_rdesc_vendor) + rdesc_size;
	}

	hid_set_name(hctx->hid, "Disabled by HID-BPF Hanvon Ugee Shortcut Remote");

	__builtin_memcpy(data, disabled_rdesc, sizeof(disabled_rdesc));
	return sizeof(disabled_rdesc);
}

static int HID_BPF_ASYNC_FUN(switch_to_raw_mode)(struct hid_bpf_ctx *hid)
{
	static __u8 magic_0[32] = {0x02, 0xb0, 0x04, 0x00, 0x00};
	int err;

	/*
	 * The proprietary driver sends the 3 following packets after the
	 * above one.
	 * These don't seem to have any effect, so we don't send them to save
	 * some processing time.
	 *
	 * static __u8 magic_1[32] = {0x02, 0xb4, 0x01, 0x00, 0x01};
	 * static __u8 magic_2[32] = {0x02, 0xb4, 0x01, 0x00, 0xff};
	 * static __u8 magic_3[32] = {0x02, 0xb8, 0x04, 0x00, 0x00};
	 */

	err = hid_bpf_hw_output_report(hid, magic_0, sizeof(magic_0));
	if (err < 0)
		return err;

	return 0;
}

SEC(HID_BPF_DEVICE_EVENT)
int BPF_PROG(ack05_fix_events, struct hid_bpf_ctx *hctx)
{
	__u8 *data = hid_bpf_get_data(hctx, 0 /* offset */, PAD_REPORT_LENGTH);
	int ret = 0;

	if (!data)
		return 0; /* EPERM check */

	if (data[0] != VENDOR_REPORT_ID)
		return 0;

	/* reconnect event */
	if (data[1] == 0xf8 && data[2] == 02 && data[3] == 0x01)
		HID_BPF_ASYNC_DELAYED_CALL(switch_to_raw_mode, hctx, 10);

	/* button event */
	if (data[1] == RAW_PAD_REPORT_ID) {
		data[0] = data[1];
		if (data[7] == 0x02)
			data[7] = 0xff;
		ret = 8;
	} else if (data[1] == RAW_BATTERY_REPORT_ID) {
		data[0] = data[1];
		ret = 5;
	}

	return ret;
}

HID_BPF_OPS(xppen_ack05_remote) = {
	.hid_device_event = (void *)ack05_fix_events,
	.hid_rdesc_fixup = (void *)ack05_fix_rdesc,
};

SEC("syscall")
int probe(struct hid_bpf_probe_args *ctx)
{
	switch (ctx->rdesc_size) {
	case PAD_WIRED_DESCRIPTOR_LENGTH:
	case PAD_DONGLE_DESCRIPTOR_LENGTH:
	case STYLUS_DESCRIPTOR_LENGTH:
	case VENDOR_DESCRIPTOR_LENGTH:
		ctx->retval = 0;
		break;
	default:
		ctx->retval = -EINVAL;
		break;
	}

	if (ctx->rdesc_size == VENDOR_DESCRIPTOR_LENGTH) {
		struct hid_bpf_ctx *hctx = hid_bpf_allocate_context(ctx->hid);

		if (!hctx) {
			ctx->retval = -EINVAL;
			return 0;
		}

		ctx->retval = HID_BPF_ASYNC_INIT(switch_to_raw_mode) ||
			      switch_to_raw_mode(hctx);

		hid_bpf_release_context(hctx);
	}

	return 0;
}

char _license[] SEC("license") = "GPL";