Skip to content

Latest commit

 

History

History
101 lines (67 loc) · 2.85 KB

README.md

File metadata and controls

101 lines (67 loc) · 2.85 KB

AOA-HID bug report sample

This sample project demonstrates that HID over AOA does not work on some devices, typically many Samsung devices released in 2017, but also some others, failing with a pipe error.

It attempts to send an HID mouse event to an Android device following the AOA2 protocol.

Build

Install the package libusb-1.0-0-dev (on Debian or Ubuntu):

sudo apt-get install libusb-1.0-0-dev

Build the sample:

make

Run

Find your Android device vendor id and product id in the output of lsusb:

$ lsusb
...
Bus 003 Device 016: ID 18d1:4ee1 Google Inc. Nexus 4
...

Here, the vendor id is 18d1 and the product id is 4ee1.

Then run the sample providing these ids:

./hid 18d1 4ee1

The output should look like:

$ ./hid 18d1 4ee1
Device 18d1:4ee1 found. Opening...
Registering HID...
Sending HID descriptor...
Sending HID event...
SUCCESS

However, on some devices, sending the event does not work. For instance, here is the result for a Lenovo TB3-850M:

$ ./hid 17ef 79f1
Device 17ef:79f1 found. Opening...
Registering HID...
Sending HID descriptor...
Sending HID event...
Pipe error

Investigations

On failing devices, dmesg displays these lines immediately after send_hid_descriptor():

(0)[8196:kworker/0:3]hid (null): transport driver missing .raw_request()
(0)[8196:kworker/0:3][g_android]can't add hid device: -22
(0)[8196:kworker/0:3][g_android]can't add HID deviceffffffc05bda8480

The error transport driver missing .raw_request() has been added by commit 3c86726 (integrated since kernel v3.15).

In the kernel sources of SM-A320F (A3 2017) from Samsung (SM-A320F_CIS_MM_Opensource.zip), we can see that they do not provide a raw_request callback (drivers/usb/gadget/function/f_accessory.c):

static struct hid_ll_driver acc_hid_ll_driver = {
    .parse = acc_hid_parse,
    .start = acc_hid_start,
    .stop = acc_hid_stop,
    .open = acc_hid_open,
    .close = acc_hid_close,
};

The raw_request callback is not provided while the commit that made it mandatory has been merged, hence the problem.

It should be provided like in commit 975a683.

Fix

The problem existed in the Common Android Kernel Tree. It has been fixed by commit a38efde.