Hi there!

As you can note from previous blogs, I love to buy strange devices directly from china :). This time I needed to connect one USB device to 2 computers (servers) so i fired up ebay and aliexpress and found this:
http://www.aliexpress.com/item/USB-2-0-Sharing-Switch-Hub-2-PC-to-1-Printer-Scanner-Newrok-Switcher-Wholesale/2037808594.html
The description doesn’t say anything about Linux support, but I thougt: “Come on… how complicated can it be?”

The device arrived yesterday any I was nicely surprised by it’s design because it looks much better than in the description and comes in a nice and solid box too. So I started with experimenting.

When I connected it to Windows PC, it was detected and the driver was installed automatically. The device was installed as HID so I know that a half of the work is done already because of the HID class there was no need for driver in Linux too. This also reminded me that my previous project USB phone worked on similar principle so there must be a way…

After installing control software from enclosed CD, a new icon appeared in traybar and I was able to take control of a mouse (connected to the switch) by clicking on “Switch”.

One LED on the switch turned off and the other lit up (the device has HW switches built-in under the light so you can switch manually too) and the mouse started working. Nice!

I found out that the switch most probably contains some controller which presents itself as HID. This controller is presented only to PC which currently doesn’t have the target device connected. When you request to connect the target device, the HID controller disconnects and connects to the other PC, while the target device disconnects from the other PC and connects to yours. After that, you are not able to release the device back to the other PC but I don’t mind that. So you always have only one of the two devices connected.

After successful test, I started SnoopyPro. The device id is 1a86:e040, so i started sniffing. After starting the control software, there was a ton of messages transmitted each second, but fortunately they were identical until clicking on “Switch”. After that a final message was sent and the HID device has disconnected.

When I connected the switch to Linux, new usb device appeared:

lsusb:
Bus 004 Device 023: ID 1a86:e040 QinHeng Electronics

dmesg:
[ 7106.216528] hid-generic 0003:046D:C05A.0017: input,hidraw1: USB HID v1.11 Mouse [Logitech USB Optical Mouse] on usb-0000:00:1d.0-1.8/input0
[ 7106.775937] usb 4-1.8: USB disconnect, device number 24
[ 7107.268274] usb 4-1.8: new low-speed USB device number 25 using ehci-pci
[ 7107.362874] usb 4-1.8: New USB device found, idVendor=1a86, idProduct=e040
[ 7107.362878] usb 4-1.8: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 7107.365969] hid-generic 0003:1A86:E040.0018: hiddev0,hidraw1: USB HID v1.00 Device [HID 1a86:e040] on usb-0000:00:1d.0-1.8/input0

ls -lah /dev/hidraw1
crw------- 1 root root 251, 1 May 30 12:27 /dev/hidraw1

I created an udev rule to have it always accessible under the same device name /dev/usbswitch:

cat /etc/udev/rules.d/10-usbswitch.rules
KERNEL=="hidraw*", ATTRS{idVendor}=="1a86", ATTRS{idProduct}=="e040", SYMLINK+="usbswitch"

Next I wrote a simple python script to test sending the same data as Windows did:

#!/usr/bin/python

file = open( "/dev/usbswitch", "w+b" );

while( 1 ):
    #cmd = "5502000000000000".decode("hex")
    cmd = "5501000000000000".decode("hex")
    file.write(cmd)
    file.flush()
    k = file.read(8)
    print k.encode("hex")

file.close();

After sending the command “5501000000000000” (probably “get status”), I’ve got the same response as in Windows (great!):

# ./switch.py
aa01000000000000
aa01000000000000
aa01000000000000
aa01000000000000
aa01000000000000
aa01000000000000
aa01000000000000
aa01000000000000
aa01000000000000
aa01000000000000
^CTraceback (most recent call last):
  File "./switch.py", line 10, in
    k = file.read(8)
KeyboardInterrupt

After sending command “5502000000000000” (probably “switch”), the HID device disconnected, LED switched and mouse connected. Hooray!

# ./switch.py
Traceback (most recent call last):
File "./switch.py", line 9, in <module>
file.flush()
IOError: [Errno 32] Broken pipe

I was curious if the status response has any meaning so after experimenting a little bit, I discovered that the 3rd byte is FF means target is not connected and 00 target is connected.

Links:

• http://www.wch.cn/product/CH536.html
• http://www.wch.cn/download/CH440DS1_PDF.html

Files:

• CH440DS1.pdf
• CH536DS0.pdf

Here are some pictures of the device: