Re: [PATCH v10 fixup 2/2] input: serio: asus-transformer-ec: fix keyboard response framing

[Svyatoslav Ryhel]

пн, 21 вер. 2026 р. о 20:52 Florian Krischer <florian.krischer@xxxxxxx> пише:
>
> Real SL101 hardware exposes two issues in the v10 keyboard response
> handling.
>
> First, keyboard command responses may carry OBF without KEY or KBC.
> The downstream ASUS driver treats valid non-AUX OBF responses as
> keyboard data. Dropping these packets prevents PS/2 ACK responses from
> reaching atkbd.
>
> Second, the EC count byte is the number of bytes following the count
> byte, not the total packet size. For example, the SL101 returns the
> keyboard reset response:
>
>   03 09 fa aa
>
> where 03 counts status 09, ACK fa and BAT-success aa.
>
> v9 used data[0] - 1 after skipping the count and status bytes. v10
> changed this to data[0] - 2 while tightening the packet bound, which
> drops the final payload byte. Keep the v10 bound but restore the
> correct payload count.
>
> Tested on an ASUS Eee Pad Slider SL101 with EC firmware SL101-0202.
> Together with the SL101 8-byte event-read fixup, the physical sliding
> keyboard completes atkbd initialization and works.
>
> Signed-off-by: Florian Krischer <florian.krischer@xxxxxxx>
> ---
>  drivers/input/serio/asus-transformer-ec-kbc.c | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)
>
> --- a/drivers/input/serio/asus-transformer-ec-kbc.c
> +++ b/drivers/input/serio/asus-transformer-ec-kbc.c
> @@ -26,20 +26,26 @@
>                 return NOTIFY_DONE;
>         else if (action & ASUSEC_AUX_MASK)
>                 port_idx = 1;
> -       else if (action & (ASUSEC_KBC_MASK | ASUSEC_KEY_MASK))
> +       else if (action & ASUSEC_OBF_MASK)
> +               /*
> +                * Keyboard command responses can carry only OBF, without KEY or
> +                * KBC set. The original SL101 driver treated every valid non-AUX,
> +                * non-SMI/SCI OBF packet as keyboard data, including PS/2 ACKs.
> +                */

I have to test this on my ASUS Transformer Prime TF201 to be sure it
does not break other devices. But before that happens I would like to
get Dmitry's feedback regarding input patches.

>                 port_idx = 0;
>         else
>                 return NOTIFY_DONE;
>
>         /*
> -        * The data[0] is the length of the packet including itself. The data[]
> -        * buffer has to be at least 3 bytes (length + ctrl + 1 data byte) and
> -        * must not exceed the EC entry size.
> +        * data[0] is the number of bytes following the count byte: one status
> +        * byte plus the payload. The SL101 EC, for example, reports keyboard
> +        * reset as 03 09 fa aa (status 09, ACK fa, BAT aa). Skip the count and
> +        * status bytes and forward every payload byte to serio.
>          */
>         if (data[0] < 2 || data[0] > ASUSEC_ENTRY_SIZE)
>                 return NOTIFY_BAD;
>
> -       n = data[0] - 2;
> +       n = data[0] - 1;

This is legit, I will adjust in v11.

>         data += 2;
>
>         if (port_idx == 0) {
> --