Enhancement and fixes of "Secure" feature

quantum/process_keycode/process_secure.c

@@ -7,7 +7,9 @@
 
 bool preprocess_secure(uint16_t keycode, keyrecord_t *record) {
     if (secure_is_unlocking()) {
-        if (!record->event.pressed) {
+        // !pressed will trigger on any already held keys (such as layer keys),
+        // and cause the request secure check to prematurely fail.
+        if (record->event.pressed) {
             secure_keypress_event(record->event.key.row, record->event.key.col);
         }
 
@@ -36,4 +38,4 @@ bool process_secure(uint16_t keycode, keyrecord_t *record) {
     }
 #endif
     return true;
-}
+}

quantum/quantum.c

@@ -214,6 +214,13 @@ bool process_record_quantum(keyrecord_t *record) {
 
 #if defined(SECURE_ENABLE)
     if (!preprocess_secure(keycode, record)) {
+        // If keys are being held when this is triggered, they may not be released properly
+        // this can result in stuck keys, mods and layers.  To prevent that, manually
+        // clear these, when it is triggered.
+        if (!record->event.pressed) {
+            clear_keyboard();
+            layer_clear();
+        }
         return false;
     }
 #endif

quantum/secure.c

@@ -29,18 +29,21 @@ secure_status_t secure_get_status(void) {
 
 void secure_lock(void) {
     secure_status = SECURE_LOCKED;
+    secure_hook_quantum(secure_status);
 }
 
 void secure_unlock(void) {
     secure_status = SECURE_UNLOCKED;
     idle_time     = timer_read32();
+    secure_hook_quantum(secure_status);
 }
 
 void secure_request_unlock(void) {
     if (secure_status == SECURE_LOCKED) {
         secure_status = SECURE_PENDING;
         unlock_time   = timer_read32();
     }
+    secure_hook_quantum(secure_status);
 }
 
 void secure_activity_event(void) {
@@ -85,3 +88,16 @@ void secure_task(void) {
     }
 #endif
 }
+
+#if defined(SECURE_ENABLE)
+__attribute__((weak)) bool secure_hook_user(secure_status_t secure_status) {
+    return true;
+}
+__attribute__((weak)) bool secure_hook_kb(secure_status_t secure_status) {
+    return secure_hook_user(secure_status);
+}
+
+__attribute__((weak)) void secure_hook_quantum(secure_status_t secure_status) {
+    secure_hook_kb(secure_status);
+}
+#endif

quantum/secure.h

@@ -65,3 +65,15 @@ void secure_keypress_event(uint8_t row, uint8_t col);
 /** \brief Handle various secure subsystem background tasks
  */
 void secure_task(void);
+
+/** \brief quantum hook called when changing secure status device
+ */
+void secure_hook_quantum(secure_status_t secure_status);
+
+/** \brief user hook called when changing secure status device
+ */
+bool secure_hook_user(secure_status_t secure_status);
+
+/** \brief keyboard hook called when changing secure status device
+ */
+bool secure_hook_kb(secure_status_t secure_status);

tests/secure/config.h

@@ -0,0 +1,32 @@
+/* Copyright 2021 Stefan Kerkmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "test_common.h"
+
+// clang-format off
+#define SECURE_UNLOCK_SEQUENCE \
+    {                          \
+        {0, 1},                \
+        {0, 2},                \
+        {0, 3},                \
+        {0, 4}                 \
+    }
+// clang-format on
+
+#define SECURE_UNLOCK_TIMEOUT 20
+#define SECURE_IDLE_TIMEOUT 50

tests/secure/test.mk

@@ -0,0 +1,20 @@
+# Copyright 2021 Stefan Kerkmann
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# --------------------------------------------------------------------------------
+# Keep this file, even if it is empty, as a marker that this folder contains tests
+# --------------------------------------------------------------------------------
+
+SECURE_ENABLE = yes