1 /*
2 * Copyright (c) 2013, Microsoft Corporation.
3 *
4 * This program is free software; you can redistribute it and/or modify it
5 * under the terms and conditions of the GNU General Public License,
6 * version 2, as published by the Free Software Foundation.
7 *
8 * This program is distributed in the hope it will be useful, but WITHOUT
9 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
10 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
11 * more details.
12 */
13
14 #include <linux/init.h>
15 #include <linux/module.h>
16 #include <linux/device.h>
17 #include <linux/completion.h>
18 #include <linux/hyperv.h>
19 #include <linux/serio.h>
20 #include <linux/slab.h>
21
22 /*
23 * Current version 1.0
24 *
25 */
26 #define SYNTH_KBD_VERSION_MAJOR 1
27 #define SYNTH_KBD_VERSION_MINOR 0
28 #define SYNTH_KBD_VERSION (SYNTH_KBD_VERSION_MINOR | \
29 (SYNTH_KBD_VERSION_MAJOR << 16))
30
31
32 /*
33 * Message types in the synthetic input protocol
34 */
35 enum synth_kbd_msg_type {
36 SYNTH_KBD_PROTOCOL_REQUEST = 1,
37 SYNTH_KBD_PROTOCOL_RESPONSE = 2,
38 SYNTH_KBD_EVENT = 3,
39 SYNTH_KBD_LED_INDICATORS = 4,
40 };
41
42 /*
43 * Basic message structures.
44 */
45 struct synth_kbd_msg_hdr {
46 __le32 type;
47 };
48
49 struct synth_kbd_msg {
50 struct synth_kbd_msg_hdr header;
51 char data[]; /* Enclosed message */
52 };
53
54 union synth_kbd_version {
55 __le32 version;
56 };
57
58 /*
59 * Protocol messages
60 */
61 struct synth_kbd_protocol_request {
62 struct synth_kbd_msg_hdr header;
63 union synth_kbd_version version_requested;
64 };
65
66 #define PROTOCOL_ACCEPTED BIT(0)
67 struct synth_kbd_protocol_response {
68 struct synth_kbd_msg_hdr header;
69 __le32 proto_status;
70 };
71
72 #define IS_UNICODE BIT(0)
73 #define IS_BREAK BIT(1)
74 #define IS_E0 BIT(2)
75 #define IS_E1 BIT(3)
76 struct synth_kbd_keystroke {
77 struct synth_kbd_msg_hdr header;
78 __le16 make_code;
79 __le16 reserved0;
80 __le32 info; /* Additional information */
81 };
82
83
84 #define HK_MAXIMUM_MESSAGE_SIZE 256
85
86 #define KBD_VSC_SEND_RING_BUFFER_SIZE (10 * PAGE_SIZE)
87 #define KBD_VSC_RECV_RING_BUFFER_SIZE (10 * PAGE_SIZE)
88
89 #define XTKBD_EMUL0 0xe0
90 #define XTKBD_EMUL1 0xe1
91 #define XTKBD_RELEASE 0x80
92
93
94 /*
95 * Represents a keyboard device
96 */
97 struct hv_kbd_dev {
98 struct hv_device *hv_dev;
99 struct serio *hv_serio;
100 struct synth_kbd_protocol_request protocol_req;
101 struct synth_kbd_protocol_response protocol_resp;
102 /* Synchronize the request/response if needed */
103 struct completion wait_event;
104 spinlock_t lock; /* protects 'started' field */
105 bool started;
106 };
107
hv_kbd_on_receive(struct hv_device * hv_dev,struct synth_kbd_msg * msg,u32 msg_length)108 static void hv_kbd_on_receive(struct hv_device *hv_dev,
109 struct synth_kbd_msg *msg, u32 msg_length)
110 {
111 struct hv_kbd_dev *kbd_dev = hv_get_drvdata(hv_dev);
112 struct synth_kbd_keystroke *ks_msg;
113 unsigned long flags;
114 u32 msg_type = __le32_to_cpu(msg->header.type);
115 u32 info;
116 u16 scan_code;
117
118 switch (msg_type) {
119 case SYNTH_KBD_PROTOCOL_RESPONSE:
120 /*
121 * Validate the information provided by the host.
122 * If the host is giving us a bogus packet,
123 * drop the packet (hoping the problem
124 * goes away).
125 */
126 if (msg_length < sizeof(struct synth_kbd_protocol_response)) {
127 dev_err(&hv_dev->device,
128 "Illegal protocol response packet (len: %d)\n",
129 msg_length);
130 break;
131 }
132
133 memcpy(&kbd_dev->protocol_resp, msg,
134 sizeof(struct synth_kbd_protocol_response));
135 complete(&kbd_dev->wait_event);
136 break;
137
138 case SYNTH_KBD_EVENT:
139 /*
140 * Validate the information provided by the host.
141 * If the host is giving us a bogus packet,
142 * drop the packet (hoping the problem
143 * goes away).
144 */
145 if (msg_length < sizeof(struct synth_kbd_keystroke)) {
146 dev_err(&hv_dev->device,
147 "Illegal keyboard event packet (len: %d)\n",
148 msg_length);
149 break;
150 }
151
152 ks_msg = (struct synth_kbd_keystroke *)msg;
153 info = __le32_to_cpu(ks_msg->info);
154
155 /*
156 * Inject the information through the serio interrupt.
157 */
158 spin_lock_irqsave(&kbd_dev->lock, flags);
159 if (kbd_dev->started) {
160 if (info & IS_E0)
161 serio_interrupt(kbd_dev->hv_serio,
162 XTKBD_EMUL0, 0);
163 if (info & IS_E1)
164 serio_interrupt(kbd_dev->hv_serio,
165 XTKBD_EMUL1, 0);
166 scan_code = __le16_to_cpu(ks_msg->make_code);
167 if (info & IS_BREAK)
168 scan_code |= XTKBD_RELEASE;
169
170 serio_interrupt(kbd_dev->hv_serio, scan_code, 0);
171 }
172 spin_unlock_irqrestore(&kbd_dev->lock, flags);
173
174 /*
175 * Only trigger a wakeup on key down, otherwise
176 * "echo freeze > /sys/power/state" can't really enter the
177 * state because the Enter-UP can trigger a wakeup at once.
178 */
179 if (!(info & IS_BREAK))
180 pm_wakeup_event(&hv_dev->device, 0);
181
182 break;
183
184 default:
185 dev_err(&hv_dev->device,
186 "unhandled message type %d\n", msg_type);
187 }
188 }
189
hv_kbd_handle_received_packet(struct hv_device * hv_dev,struct vmpacket_descriptor * desc,u32 bytes_recvd,u64 req_id)190 static void hv_kbd_handle_received_packet(struct hv_device *hv_dev,
191 struct vmpacket_descriptor *desc,
192 u32 bytes_recvd,
193 u64 req_id)
194 {
195 struct synth_kbd_msg *msg;
196 u32 msg_sz;
197
198 switch (desc->type) {
199 case VM_PKT_COMP:
200 break;
201
202 case VM_PKT_DATA_INBAND:
203 /*
204 * We have a packet that has "inband" data. The API used
205 * for retrieving the packet guarantees that the complete
206 * packet is read. So, minimally, we should be able to
207 * parse the payload header safely (assuming that the host
208 * can be trusted. Trusting the host seems to be a
209 * reasonable assumption because in a virtualized
210 * environment there is not whole lot you can do if you
211 * don't trust the host.
212 *
213 * Nonetheless, let us validate if the host can be trusted
214 * (in a trivial way). The interesting aspect of this
215 * validation is how do you recover if we discover that the
216 * host is not to be trusted? Simply dropping the packet, I
217 * don't think is an appropriate recovery. In the interest
218 * of failing fast, it may be better to crash the guest.
219 * For now, I will just drop the packet!
220 */
221
222 msg_sz = bytes_recvd - (desc->offset8 << 3);
223 if (msg_sz <= sizeof(struct synth_kbd_msg_hdr)) {
224 /*
225 * Drop the packet and hope
226 * the problem magically goes away.
227 */
228 dev_err(&hv_dev->device,
229 "Illegal packet (type: %d, tid: %llx, size: %d)\n",
230 desc->type, req_id, msg_sz);
231 break;
232 }
233
234 msg = (void *)desc + (desc->offset8 << 3);
235 hv_kbd_on_receive(hv_dev, msg, msg_sz);
236 break;
237
238 default:
239 dev_err(&hv_dev->device,
240 "unhandled packet type %d, tid %llx len %d\n",
241 desc->type, req_id, bytes_recvd);
242 break;
243 }
244 }
245
hv_kbd_on_channel_callback(void * context)246 static void hv_kbd_on_channel_callback(void *context)
247 {
248 struct hv_device *hv_dev = context;
249 void *buffer;
250 int bufferlen = 0x100; /* Start with sensible size */
251 u32 bytes_recvd;
252 u64 req_id;
253 int error;
254
255 buffer = kmalloc(bufferlen, GFP_ATOMIC);
256 if (!buffer)
257 return;
258
259 while (1) {
260 error = vmbus_recvpacket_raw(hv_dev->channel, buffer, bufferlen,
261 &bytes_recvd, &req_id);
262 switch (error) {
263 case 0:
264 if (bytes_recvd == 0) {
265 kfree(buffer);
266 return;
267 }
268
269 hv_kbd_handle_received_packet(hv_dev, buffer,
270 bytes_recvd, req_id);
271 break;
272
273 case -ENOBUFS:
274 kfree(buffer);
275 /* Handle large packet */
276 bufferlen = bytes_recvd;
277 buffer = kmalloc(bytes_recvd, GFP_ATOMIC);
278 if (!buffer)
279 return;
280 break;
281 }
282 }
283 }
284
hv_kbd_connect_to_vsp(struct hv_device * hv_dev)285 static int hv_kbd_connect_to_vsp(struct hv_device *hv_dev)
286 {
287 struct hv_kbd_dev *kbd_dev = hv_get_drvdata(hv_dev);
288 struct synth_kbd_protocol_request *request;
289 struct synth_kbd_protocol_response *response;
290 u32 proto_status;
291 int error;
292
293 request = &kbd_dev->protocol_req;
294 memset(request, 0, sizeof(struct synth_kbd_protocol_request));
295 request->header.type = __cpu_to_le32(SYNTH_KBD_PROTOCOL_REQUEST);
296 request->version_requested.version = __cpu_to_le32(SYNTH_KBD_VERSION);
297
298 error = vmbus_sendpacket(hv_dev->channel, request,
299 sizeof(struct synth_kbd_protocol_request),
300 (unsigned long)request,
301 VM_PKT_DATA_INBAND,
302 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
303 if (error)
304 return error;
305
306 if (!wait_for_completion_timeout(&kbd_dev->wait_event, 10 * HZ))
307 return -ETIMEDOUT;
308
309 response = &kbd_dev->protocol_resp;
310 proto_status = __le32_to_cpu(response->proto_status);
311 if (!(proto_status & PROTOCOL_ACCEPTED)) {
312 dev_err(&hv_dev->device,
313 "synth_kbd protocol request failed (version %d)\n",
314 SYNTH_KBD_VERSION);
315 return -ENODEV;
316 }
317
318 return 0;
319 }
320
hv_kbd_start(struct serio * serio)321 static int hv_kbd_start(struct serio *serio)
322 {
323 struct hv_kbd_dev *kbd_dev = serio->port_data;
324 unsigned long flags;
325
326 spin_lock_irqsave(&kbd_dev->lock, flags);
327 kbd_dev->started = true;
328 spin_unlock_irqrestore(&kbd_dev->lock, flags);
329
330 return 0;
331 }
332
hv_kbd_stop(struct serio * serio)333 static void hv_kbd_stop(struct serio *serio)
334 {
335 struct hv_kbd_dev *kbd_dev = serio->port_data;
336 unsigned long flags;
337
338 spin_lock_irqsave(&kbd_dev->lock, flags);
339 kbd_dev->started = false;
340 spin_unlock_irqrestore(&kbd_dev->lock, flags);
341 }
342
hv_kbd_probe(struct hv_device * hv_dev,const struct hv_vmbus_device_id * dev_id)343 static int hv_kbd_probe(struct hv_device *hv_dev,
344 const struct hv_vmbus_device_id *dev_id)
345 {
346 struct hv_kbd_dev *kbd_dev;
347 struct serio *hv_serio;
348 int error;
349
350 kbd_dev = kzalloc(sizeof(struct hv_kbd_dev), GFP_KERNEL);
351 hv_serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
352 if (!kbd_dev || !hv_serio) {
353 error = -ENOMEM;
354 goto err_free_mem;
355 }
356
357 kbd_dev->hv_dev = hv_dev;
358 kbd_dev->hv_serio = hv_serio;
359 spin_lock_init(&kbd_dev->lock);
360 init_completion(&kbd_dev->wait_event);
361 hv_set_drvdata(hv_dev, kbd_dev);
362
363 hv_serio->dev.parent = &hv_dev->device;
364 hv_serio->id.type = SERIO_8042_XL;
365 hv_serio->port_data = kbd_dev;
366 strlcpy(hv_serio->name, dev_name(&hv_dev->device),
367 sizeof(hv_serio->name));
368 strlcpy(hv_serio->phys, dev_name(&hv_dev->device),
369 sizeof(hv_serio->phys));
370
371 hv_serio->start = hv_kbd_start;
372 hv_serio->stop = hv_kbd_stop;
373
374 error = vmbus_open(hv_dev->channel,
375 KBD_VSC_SEND_RING_BUFFER_SIZE,
376 KBD_VSC_RECV_RING_BUFFER_SIZE,
377 NULL, 0,
378 hv_kbd_on_channel_callback,
379 hv_dev);
380 if (error)
381 goto err_free_mem;
382
383 error = hv_kbd_connect_to_vsp(hv_dev);
384 if (error)
385 goto err_close_vmbus;
386
387 serio_register_port(kbd_dev->hv_serio);
388
389 device_init_wakeup(&hv_dev->device, true);
390
391 return 0;
392
393 err_close_vmbus:
394 vmbus_close(hv_dev->channel);
395 err_free_mem:
396 kfree(hv_serio);
397 kfree(kbd_dev);
398 return error;
399 }
400
hv_kbd_remove(struct hv_device * hv_dev)401 static int hv_kbd_remove(struct hv_device *hv_dev)
402 {
403 struct hv_kbd_dev *kbd_dev = hv_get_drvdata(hv_dev);
404
405 serio_unregister_port(kbd_dev->hv_serio);
406 vmbus_close(hv_dev->channel);
407 kfree(kbd_dev);
408
409 hv_set_drvdata(hv_dev, NULL);
410
411 return 0;
412 }
413
414 static const struct hv_vmbus_device_id id_table[] = {
415 /* Keyboard guid */
416 { HV_KBD_GUID, },
417 { },
418 };
419
420 MODULE_DEVICE_TABLE(vmbus, id_table);
421
422 static struct hv_driver hv_kbd_drv = {
423 .name = KBUILD_MODNAME,
424 .id_table = id_table,
425 .probe = hv_kbd_probe,
426 .remove = hv_kbd_remove,
427 .driver = {
428 .probe_type = PROBE_PREFER_ASYNCHRONOUS,
429 },
430 };
431
hv_kbd_init(void)432 static int __init hv_kbd_init(void)
433 {
434 return vmbus_driver_register(&hv_kbd_drv);
435 }
436
hv_kbd_exit(void)437 static void __exit hv_kbd_exit(void)
438 {
439 vmbus_driver_unregister(&hv_kbd_drv);
440 }
441
442 MODULE_LICENSE("GPL");
443 module_init(hv_kbd_init);
444 module_exit(hv_kbd_exit);
445
