A year ago, I bought a
Logitech Wireless Solar Keyboard
K750. I'm
particularly picky on keyboards, but this one is good. It has an incredible
useful feature: while being wireless, it has no need for disposable or
rechargeable batteries, it uses solar power!
My problem is that there's obviously no way to know the battery status from
Linux, the provided application only working on Windows.
And one dark night, while fragging on QuakeLive, my keyboard stopped
working: it had no battery left. This activity being quite energy consuming,
it emptied the whole battery.
Someone should write code to get the battery status and light meter from
Linux: challenge accepted!
How the keyboard works
This keyboard, like many of the new wireless devices from Logitech, uses the
Unifying interface. It's an USB receiver that can be attached up to 6
differents devices (mouse, keyboards ). On old Linux kernel, the
Unifying
receiver is recognized as only one keyboard and/or one mouse device.
Recently, a driver called
hid-logitech-dj has been added to the Linux
kernel. With this driver, each device attached to the receiver is recognized
as one different device.
What the Logitech application does
The Logitech application under Windows works that way: you launch it, and it
displays the battery charge level. On the keyboard, there's a special
"light" button (up right). When pressed, a LED will light up on the
keyboard: green if the keyboard is receiving enough light and is charging,
red if the keyboard does not receive enough light and is therefore
discharging. Pushing this same button while the application is running will
makes the light meter activated: the application will tell you how much
lux your keyboard is receiving.
Let's reverse engineer this
As far as I know, there's nothing in the USB HID protocol that handles this
kind of functionality (battery status, light meter ) in a standard way. So
the first task to accomplish is, unfortunately, to reverse engineer the
program.
I discovered a bit too late that
Drew Fisher did a good presentation on USB
reverse engineering at 28c3.
You might want to take a look at it if you want to reverse engineer on USB.
I did not need it, but I learned a few things.
Anyway, my plan was the following: run the Logitech application inside a
virtual machine running Windows, give it direct access to the USB keyboard,
and sniff what happens on the USB wire.
To achieve that, you need a virtual machine emulator that can do USB
pass-through. Both
KVM and
VirtualBox can do that, but VirtualBox works
much better with USB and allow hot(un)plugging of devices, so I used it.
To sniff what happens on the USB, you need to load the
usbmon Linux kernel
module. Simply doing
modprobe usbmon will work. You can then
use
Wireshark which know how to use
usbmon
devices and understand the USB protocol.
USB stuff you need to know
You don't need to know much about USB to understand what I'll write about
below, but for the sake of comprehensibility I'll write a couple of things
here before jumping in.
To communicate with an USB device, we communicate with one of its
endpoints. Endpoints are regrouped into an
interface. Interfaces are
regrouped into a
configuration. A device might contains one or several
configurations.
There's also several types of packets in the USB wire protocol, and at least
two of them interest us there, they are:
- Interrupt packets, a packet send spontaneously;
- Controls packets, used for command and status operations.
All of this and more is well (and better) explained in the
chapter
13 of
Linux Device Drivers, Third
Edition.
Sniffed data
Once everything was set-up, I ran my beloved Wireshark. There's a
an
URB of type
interrupt sent each
time you press any key with some data in it. Therefore I advise you to plug
another keyboard (or use the laptop keyboard if you're doing this on a
laptop), otherwise you'll get crazy trying to sniff the keyboard you're
typing on.
At this point, just launching the application does a bunch of USB traffic.
Pressing the "light" button on the keyboard makes even more USB packets
coming in and out. Here's the interesting packets that I noticed once I
excluded the noise:
- When pressing the "light" button, an URB of type interrupt is sent by the
keyboard to the computer;
- An URB control packet is sent by the computer to the keyboard in
response;
- Regularly URB interrupt packets are sent just after.
With all this, the next step was clear: understand the packets and reproduce
that exchange under Linux.
What the packets mean
The "go for the light meter" packet
The packet sent from the computer to the keyboard is the following.
<figure>
Frame 17: 71 bytes on wire (568 bits), 71 bytes captured (568 bits)
Frame Length: 71 bytes (568 bits)
Capture Length: 71 bytes (568 bits)
USB URB
URB id: 0xffff880161997240
URB type: URB_SUBMIT ('S')
URB transfer type: URB_CONTROL (0x02)
Endpoint: 0x00, Direction: OUT
0... .... = Direction: OUT (0)
.000 0000 = Endpoint value: 0
Device: 6
URB bus id: 1
Device setup request: relevant (0)
Data: present (0)
URB sec: 1340124450
URB usec: 495643
URB status: Operation now in progress (-EINPROGRESS) (-115)
URB length [bytes]: 7
Data length [bytes]: 7
[Response in: 18]
[bInterfaceClass: HID (0x03)]
URB setup
bmRequestType: 0x21
0... .... = Direction: Host-to-device
.01. .... = Type: Class (0x01)
...0 0001 = Recipient: Interface (0x01)
bRequest: SET_REPORT (0x09)
wValue: 0x0210
ReportID: 16
ReportType: Output (2)
wIndex: 2
wLength: 7
0000 40 72 99 61 01 88 ff ff 53 02 00 06 01 00 00 00 @r.a....S.......
0010 22 ad e0 4f 00 00 00 00 1b 90 07 00 8d ff ff ff "..O............
0020 07 00 00 00 07 00 00 00 21 09 10 02 02 00 07 00 ........!.......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 10 01 09 03 78 01 00 ....x..
</figure>
What's here interesting is the last part representing the data.
wLength
says that the length of the data is 7 bytes, so let's take a look at those 7
bytes:
10 01 09 03 78 01 00.
Well, actually, you can't decode them like that, unless you're a freak or a
Logitech engineer. And I have actually no idea what they mean. But sending
this to the keyboard will trigger an interesting thing: the keyboard will
start sending URB interrupt with some data without you pressing any more key.
The "light meter and battery values" packet
This is most interesting packet. This is the one sent by the keyboard to the
host and that contains the data we want to retrieve.
<figure>
Frame 1467: 84 bytes on wire (672 bits), 84 bytes captured (672 bits)
Frame Length: 84 bytes (672 bits)
Capture Length: 84 bytes (672 bits)
USB URB
URB id: 0xffff88010c43c380
URB type: URB_COMPLETE ('C')
URB transfer type: URB_INTERRUPT (0x01)
Endpoint: 0x83, Direction: IN
1... .... = Direction: IN (1)
.000 0011 = Endpoint value: 3
Device: 2
URB bus id: 6
Device setup request: not relevant ('-')
Data: present (0)
URB sec: 1334953309
URB usec: 728740
URB status: Success (0)
URB length [bytes]: 20
Data length [bytes]: 20
[Request in: 1466]
[Time from request: 0.992374000 seconds]
[bInterfaceClass: Unknown (0xffff)]
Leftover Capture Data: 1102091039000c061d474f4f4400000000000000
0000 80 c3 43 0c 01 88 ff ff 43 01 83 02 06 00 2d 00 ..C.....C.....-.
0010 5d c5 91 4f 00 00 00 00 a4 1e 0b 00 00 00 00 00 ]..O............
0020 14 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 ................
0030 02 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 ................
0040 11 02 09 10 39 00 0c 06 1d 47 4f 4f 44 00 00 00 ....9....GOOD...
0050 00 00 00 00 ....
</figure>
This packets come in regularly (1 per second) on the wire for some time once
you sent the "go for the light meter" packet. At one point they are emitted
less often and do not contain the value for the light meter anymore,
suggesting that the control packet sent earlier triggers the activation of
the light meter for a defined period.
Now you probably wonder where the data are in this. They're in the 20 bytes
leftover in the capture data part, indicated by Wireshark, at the end of the
packet:
11 02 09 10 39 00 0c 06 1d 47 4f 4f 44 00 00 00 00 00 00 00.
Fortunately, it was easy to decode. Knowing we're looking for 2 values
(battery charge and light meter), we just need to observe and compare the
packet emitted on the wire with the values displayed by the Logitech Solar
App.
To achieve this, I looked both at the
Logitech Solar App and
Wireshark
while bringing more and more light near the keyboard, increasing the lux
value received by the meter on the Solar App, and saw that the fields
represented in blue (see below) where changing in Wireshark. Since 2 bytes
were changing, I guessed that it was coded on 16 bits, and therefore it was
easy to correlate the value with the Solar App.
<figure>
[ ....9....GOOD....... ]
11 02 09 10 39 00 0c 06 1d 47 4f 4f 44 00 00 00 00 00 00 00
4 bytes - 1 byte for battery charge - 2 bytes for light meter - 2 bytes - 4 bytes for GOOD - 7 bytes
</figure>
In this example, the battery has a charge of
0x39 = 57 % and
the light meter receives
0x0c = 12 lux of light. It's basically
dark, and that makes sense: it was night and the light was off in my office,
the only light being the one coming from my screen.
I've no idea what the
GOOD part of the packet is about, but
it's present in every packet and it's actually very handy to recognize such
a packet. Therefore I'm considering this as some sort of useful mark for
now.
For the other bytes, they were always the same (
0x11 0x2 0x9
0x10 at the beginning, 7 times
0x00 at the end). The 2
bytes between the light meter and GOOD probably mean something, but I've no
idea what for now.
Building our solar app
Now we've enough information to build our own very basic solar application.
We know how to triggers the light meter, and we know how to decode the
packets.
We're going to write a small application using
libusb. Here's a quick example. It's not perfect
and does not check for error codes, be careful.
<figure>
/* Written by Julien Danjou <julien> in 2012 */
#include <linux/hid.h>
#include <libusb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(void)
libusb_context *ctx;
libusb_init(&ctx);
libusb_set_debug(ctx, 3);
/* Look at the keyboard based on vendor and device id */
libusb_device_handle *device_handle = libusb_open_device_with_vid_pid(ctx, 0x046d, 0xc52b);
fprintf(stderr, "Found keyboard 0x%p\n", device_handle);
libusb_device *device = libusb_get_device(device_handle);
struct libusb_device_descriptor desc;
libusb_get_device_descriptor(device, &desc);
for(uint8_t config_index = 0; config_index < desc.bNumConfigurations; config_index++)
struct libusb_config_descriptor *config;
libusb_get_config_descriptor(device, config_index, &config);
/* We know we want interface 2 */
int iface_index = 2;
const struct libusb_interface *iface = &config->interface[iface_index];
for (int altsetting_index = 0; altsetting_index < iface->num_altsetting; altsetting_index++)
const struct libusb_interface_descriptor *iface_desc = &iface->altsetting[al>tsetting_index];
if (iface_desc->bInterfaceClass == LIBUSB_CLASS_HID)
libusb_detach_kernel_driver(device_handle, iface_index);
libusb_claim_interface(device_handle, iface_index);
unsigned char ret[65535];
unsigned char payload[] = "\x10\x02\x09\x03\x78\x01\x00";
if(libusb_control_transfer(device_handle,
LIBUSB_REQUEST_TYPE_CLASS LIBUSB_RECIPIENT_INTERFACE,
HID_REQ_SET_REPORT,
0x0210, iface_index, payload, sizeof(payload) - 1, 10000))
int actual_length = 0;
while(actual_length != 20 strncmp((const char *) &ret[9], "GOOD", 4))
libusb_interrupt_transfer(device_handle,
iface_desc->endpoint[0].bEndpointAddress,
ret, sizeof(ret), &actual_length, 100000);
uint16_t lux = ret[5] << 8 ret[6];
fprintf(stderr, "Charge: %d %%\nLight: %d lux\n", ret[4], lux);
libusb_release_interface(device_handle, iface_index);
libusb_attach_kernel_driver(device_handle, iface_index);
libusb_close(device_handle);
libusb_exit(ctx);
</figure>
What the program is doing is the following:
- Request for the Unifying Receiver device based on vendor and product ID
- Get the HID interface
- Detach the HID interface from the kernel driver
- Claim the interface
- Send a control packets, were parameters are defined using the same data we captured earlier
- Read interrupt packets coming in until we receive one we recognize (length
20 containing the "GOOD" string)
- Decode the content (battery charge & light meter)
- Release the interface
- Reattach the kernel driver to the interface
This gives the following:
Found keyboard 0x0x24ec8e0
Charge: 64 %
Light: 21 lux
Challenge accomplished!
To be continued
Unfortunately, this approach has at least one major drawback. We have to
disconnect the
Logitech Unifying Receiver from the kernel. That means that
while we're waiting for the packet, we're dropping packets corresponding to
other events from every connected device (key presses, pointer motions ).
In order to solve that, I sent a request for help on the
linux-input mailing
list. That way, I learned that Logitech is actually using the HID++ protocol
to communicate with the devices using the Unifying Receiver.
Lars-Dominik
Braun managed to get the HID++ specifications from Logitech
and
published
them
with their authorization.
This opens a whole new world. With that document, I may be able to
understand the part I reverse engineered and convert this to a more useful
and generic library using the hidraw interface (so we don't have to
disconnect the devices from the kernel driver).
When I previously wrote about the Retina display in the new Macbook Pro I was so excited that I forgot to even check whether the display reflects light [1]. A TFT display with a mirrored surface apparently permits more intense color which is generally a good thing. It also makes it easier to clean the surface which is really important for phones and tablets. The down-side of a mirrored surface on a display is that it can reflect whatever else is in the area.
This generally isn t a problem in an office as you can usually adjust the angle of the monitor and the background lighting to avoid the worst problems. It s also not a serious problem for a hand-held device as it s usually easy to hold it at an angle such that you don t have light from anything particularly bright reflecting.
But my experience of laptop use includes using them anywhere at any time. I ve done a lot of coding on all forms of public transport in all weather conditions. Doing that with a Thinkpad which has a matte surface on it s screen is often difficult but almost always possible. Doing that on a system with a mirrored display really isn t possible. The above photo of a 15 Macbook Pro model MD103X/A was taken at a Myer store which was specifically designed to make the computers look their best. The overall lighting wasn t particularly bright so that the background didn t reflect too much and the individual lights were diffuse to avoid dazzling point reflections. But even so the lights can be clearly seen. Note that the photo was taken with a Samsung Galaxy S, far from the best possible camera.
If I was buying a laptop that would only ever be used in the more northern parts of Europe or if I was buying a laptop to use only at home and at the office then I might consider a mirror display. But as I mostly use my laptop in mainland Australia including trips to tropical parts of Australia and I use it in all manner of locations a mirror display isn t going to work for me.
This isn t necessarily a bad decision by Apple designers. My observation of Macbook use includes lots of people using them only in offices and homes. Of the serious geeks who describe their laptop as My Precious hardly anyone has a Macbook while Thinkpads seem quite popular in that market segment. I don t think that it s just the matte screen that attracts serious geeks to the Thinkpad, but it does seem like part of a series of design decisions (which include the past tradition of supporting hard drive removal without tools and the option of a second hard drive for RAID-1) that make Thinkpads more suitable for geeks than Macbooks. While the new tradition in Apple design of gluing things together so they can never be repaired, recycled, or even have their battery replaced seems part of a pattern that goes against geek use. Even when Apple products are technically superior in some ways their catering to the less technical buyers makes them unsuitable to people like me.
Maybe the ability to use a Macbook as a shaving mirror could be handy, but I d rather grow a beard and use a Thinkpad.
Related posts:
It is usually easy to see even in a thumbnail
P.S. Got over 5k photos in Flickr now with this set, and closing in for 500k views. That feels cool 
Playing around with LLC controls on Sandybridge today.
What I wanted to know was how caching backbuffers affects application
performance. The reason for this question is that when the driver uses
page flipping to display a new frame, we force the new scanout buffer
to be uncached because the display hardware only scans out from main
memory. However, when we go back to using this buffer as the next
back-buffer, we don t turn the caching bits back on as that requires
writing GTT entries to change caching modes.
This means that swapping via page-flipping and swapping via copying
has a large change in main memory access patterns during rendering
page flipping applications use an uncached back buffer while copying
applications use a cached back buffer.
What effect does the back-buffer caching-mode have on application
performance?
The changes
In the kernel, I have three modes
1) Existing code. Set buffer objects to cache mode none when
preparing them as scanout buffers. The first time the application
flips to a back buffer, caching is disabled on that buffer forever
2) Flip back and forth. Set buffers to cache mode none when used
as scanout. When that stops, flip them back to cache mode llc.
This involves a whole lot of clflushing and GTT rewriting, obviously.
3) Flush to memory, but don t disable caching. In this mode, the
buffer gets flushed (from both CPU and GPU) before being used as a
scanout, but the cache mode isn t changed.
Benchmarking with glxgears
The first test was pretty simple I hacked up glxgears (yes,
glxgears is not a benchmark) to redraw the same frame multiple times
(including the clear) per swap to provide a scalable amount of
work per swap. No pixel operations, so this is just writing to the
back buffer. Thes numbers are the median of 5 runs, except for those
obviously limited by the refresh rate.
After seeing 
I'm a heavy user of Debian's 
At the recent 
I just read reports about Boston marathon 2012. Incredibly though race
this year as the heat raised up to 32-35 C (around 90 F?) for the last
runners and 26 C at 10:00 at marathon start.
The outcome is indeed impressive: the 2012 winner won with a "not so
good" time of 2h12 while last year saw an unofficial world best time
of 2h03'02" (there can't be any world record in Boston because of the
race being one-way, thus prone to too favourable wind, plus a negative
slope between start and finish).
Even though this year is less likely to see great records (because
this is an olympic year and the best runners won't run another
marathon before the Olympics), we still had times around 2h05 in Paris,
Rotterdam....and this year's best time in London with 2h04'44" (Dubai
time is 2h04'23" but I do not count this one as a mass marathon).
So, 2h12 in Boston just says how hard this race was.
But, still, that's my dream marathon, even more than NYC marathon. And
I'll do it, I promise....though I now have to run below 3h30 to
qualify....unless I'm still running marathons when I reach 55, where
the qualificaiton mark will be only 3h40 (which is exactly my PB as of
now). Will I still be able to run in 3h40 in 4 years? Or will I
succeed in running in less than 3h30 in the meantime? We'll see..:-)
Until then....my first marathon for this year will be on June 9th, in
Caen, as planned. Target: less than 3h40, despite the quite hard
profile (and possible windy conditions as the first half of the race
is along the famous Normandy beaches code named Sword, Gold and Juno,
between Courseulles sur Mer and Ouistreham).
So, until then, I'll forget about my nice races in forests and plains,
and concentrate on interval trainings, boring sequences of 400m or
1000m runs, etc, etc. That will be the first time I'm doing this but
everybody keeps telling me I need to do that if I want to lower my PB
(and every marathoner wants to!).
I still get lot of questions why I wrote 
I'm honored and pleased to be the person who gets to complete 
I started by explaining why having root access to your system is really important, including 
The Google Maps client comes with every Android system, the above shows the location of the LUV meeting.
