1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2013, Microsoft Corporation.
6 #include <linux/init.h>
7 #include <linux/module.h>
8 #include <linux/device.h>
9 #include <linux/completion.h>
10 #include <linux/hyperv.h>
11 #include <linux/serio.h>
12 #include <linux/slab.h>
18 #define SYNTH_KBD_VERSION_MAJOR 1
19 #define SYNTH_KBD_VERSION_MINOR 0
20 #define SYNTH_KBD_VERSION (SYNTH_KBD_VERSION_MINOR | \
21 (SYNTH_KBD_VERSION_MAJOR << 16))
25 * Message types in the synthetic input protocol
27 enum synth_kbd_msg_type
{
28 SYNTH_KBD_PROTOCOL_REQUEST
= 1,
29 SYNTH_KBD_PROTOCOL_RESPONSE
= 2,
31 SYNTH_KBD_LED_INDICATORS
= 4,
35 * Basic message structures.
37 struct synth_kbd_msg_hdr
{
41 struct synth_kbd_msg
{
42 struct synth_kbd_msg_hdr header
;
43 char data
[]; /* Enclosed message */
46 union synth_kbd_version
{
53 struct synth_kbd_protocol_request
{
54 struct synth_kbd_msg_hdr header
;
55 union synth_kbd_version version_requested
;
58 #define PROTOCOL_ACCEPTED BIT(0)
59 struct synth_kbd_protocol_response
{
60 struct synth_kbd_msg_hdr header
;
64 #define IS_UNICODE BIT(0)
65 #define IS_BREAK BIT(1)
68 struct synth_kbd_keystroke
{
69 struct synth_kbd_msg_hdr header
;
72 __le32 info
; /* Additional information */
76 #define HK_MAXIMUM_MESSAGE_SIZE 256
78 #define KBD_VSC_SEND_RING_BUFFER_SIZE VMBUS_RING_SIZE(36 * 1024)
79 #define KBD_VSC_RECV_RING_BUFFER_SIZE VMBUS_RING_SIZE(36 * 1024)
81 #define XTKBD_EMUL0 0xe0
82 #define XTKBD_EMUL1 0xe1
83 #define XTKBD_RELEASE 0x80
87 * Represents a keyboard device
90 struct hv_device
*hv_dev
;
91 struct serio
*hv_serio
;
92 struct synth_kbd_protocol_request protocol_req
;
93 struct synth_kbd_protocol_response protocol_resp
;
94 /* Synchronize the request/response if needed */
95 struct completion wait_event
;
96 spinlock_t lock
; /* protects 'started' field */
100 static void hv_kbd_on_receive(struct hv_device
*hv_dev
,
101 struct synth_kbd_msg
*msg
, u32 msg_length
)
103 struct hv_kbd_dev
*kbd_dev
= hv_get_drvdata(hv_dev
);
104 struct synth_kbd_keystroke
*ks_msg
;
105 u32 msg_type
= __le32_to_cpu(msg
->header
.type
);
110 case SYNTH_KBD_PROTOCOL_RESPONSE
:
112 * Validate the information provided by the host.
113 * If the host is giving us a bogus packet,
114 * drop the packet (hoping the problem
117 if (msg_length
< sizeof(struct synth_kbd_protocol_response
)) {
118 dev_err(&hv_dev
->device
,
119 "Illegal protocol response packet (len: %d)\n",
124 memcpy(&kbd_dev
->protocol_resp
, msg
,
125 sizeof(struct synth_kbd_protocol_response
));
126 complete(&kbd_dev
->wait_event
);
129 case SYNTH_KBD_EVENT
:
131 * Validate the information provided by the host.
132 * If the host is giving us a bogus packet,
133 * drop the packet (hoping the problem
136 if (msg_length
< sizeof(struct synth_kbd_keystroke
)) {
137 dev_err(&hv_dev
->device
,
138 "Illegal keyboard event packet (len: %d)\n",
143 ks_msg
= (struct synth_kbd_keystroke
*)msg
;
144 info
= __le32_to_cpu(ks_msg
->info
);
147 * Inject the information through the serio interrupt.
149 scoped_guard(spinlock_irqsave
, &kbd_dev
->lock
) {
150 if (kbd_dev
->started
) {
152 serio_interrupt(kbd_dev
->hv_serio
,
155 serio_interrupt(kbd_dev
->hv_serio
,
157 scan_code
= __le16_to_cpu(ks_msg
->make_code
);
159 scan_code
|= XTKBD_RELEASE
;
161 serio_interrupt(kbd_dev
->hv_serio
,
167 * Only trigger a wakeup on key down, otherwise
168 * "echo freeze > /sys/power/state" can't really enter the
169 * state because the Enter-UP can trigger a wakeup at once.
171 if (!(info
& IS_BREAK
))
172 pm_wakeup_hard_event(&hv_dev
->device
);
177 dev_err(&hv_dev
->device
,
178 "unhandled message type %d\n", msg_type
);
182 static void hv_kbd_handle_received_packet(struct hv_device
*hv_dev
,
183 struct vmpacket_descriptor
*desc
,
187 struct synth_kbd_msg
*msg
;
190 switch (desc
->type
) {
194 case VM_PKT_DATA_INBAND
:
196 * We have a packet that has "inband" data. The API used
197 * for retrieving the packet guarantees that the complete
198 * packet is read. So, minimally, we should be able to
199 * parse the payload header safely (assuming that the host
200 * can be trusted. Trusting the host seems to be a
201 * reasonable assumption because in a virtualized
202 * environment there is not whole lot you can do if you
203 * don't trust the host.
205 * Nonetheless, let us validate if the host can be trusted
206 * (in a trivial way). The interesting aspect of this
207 * validation is how do you recover if we discover that the
208 * host is not to be trusted? Simply dropping the packet, I
209 * don't think is an appropriate recovery. In the interest
210 * of failing fast, it may be better to crash the guest.
211 * For now, I will just drop the packet!
214 msg_sz
= bytes_recvd
- (desc
->offset8
<< 3);
215 if (msg_sz
<= sizeof(struct synth_kbd_msg_hdr
)) {
217 * Drop the packet and hope
218 * the problem magically goes away.
220 dev_err(&hv_dev
->device
,
221 "Illegal packet (type: %d, tid: %llx, size: %d)\n",
222 desc
->type
, req_id
, msg_sz
);
226 msg
= (void *)desc
+ (desc
->offset8
<< 3);
227 hv_kbd_on_receive(hv_dev
, msg
, msg_sz
);
231 dev_err(&hv_dev
->device
,
232 "unhandled packet type %d, tid %llx len %d\n",
233 desc
->type
, req_id
, bytes_recvd
);
238 static void hv_kbd_on_channel_callback(void *context
)
240 struct vmpacket_descriptor
*desc
;
241 struct hv_device
*hv_dev
= context
;
245 foreach_vmbus_pkt(desc
, hv_dev
->channel
) {
246 bytes_recvd
= desc
->len8
* 8;
247 req_id
= desc
->trans_id
;
249 hv_kbd_handle_received_packet(hv_dev
, desc
, bytes_recvd
,
254 static int hv_kbd_connect_to_vsp(struct hv_device
*hv_dev
)
256 struct hv_kbd_dev
*kbd_dev
= hv_get_drvdata(hv_dev
);
257 struct synth_kbd_protocol_request
*request
;
258 struct synth_kbd_protocol_response
*response
;
262 reinit_completion(&kbd_dev
->wait_event
);
264 request
= &kbd_dev
->protocol_req
;
265 memset(request
, 0, sizeof(struct synth_kbd_protocol_request
));
266 request
->header
.type
= __cpu_to_le32(SYNTH_KBD_PROTOCOL_REQUEST
);
267 request
->version_requested
.version
= __cpu_to_le32(SYNTH_KBD_VERSION
);
269 error
= vmbus_sendpacket(hv_dev
->channel
, request
,
270 sizeof(struct synth_kbd_protocol_request
),
271 (unsigned long)request
,
273 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED
);
277 if (!wait_for_completion_timeout(&kbd_dev
->wait_event
, 10 * HZ
))
280 response
= &kbd_dev
->protocol_resp
;
281 proto_status
= __le32_to_cpu(response
->proto_status
);
282 if (!(proto_status
& PROTOCOL_ACCEPTED
)) {
283 dev_err(&hv_dev
->device
,
284 "synth_kbd protocol request failed (version %d)\n",
292 static int hv_kbd_start(struct serio
*serio
)
294 struct hv_kbd_dev
*kbd_dev
= serio
->port_data
;
296 guard(spinlock_irqsave
)(&kbd_dev
->lock
);
298 kbd_dev
->started
= true;
303 static void hv_kbd_stop(struct serio
*serio
)
305 struct hv_kbd_dev
*kbd_dev
= serio
->port_data
;
307 guard(spinlock_irqsave
)(&kbd_dev
->lock
);
309 kbd_dev
->started
= false;
312 static int hv_kbd_probe(struct hv_device
*hv_dev
,
313 const struct hv_vmbus_device_id
*dev_id
)
315 struct hv_kbd_dev
*kbd_dev
;
316 struct serio
*hv_serio
;
319 kbd_dev
= kzalloc(sizeof(*kbd_dev
), GFP_KERNEL
);
320 hv_serio
= kzalloc(sizeof(*hv_serio
), GFP_KERNEL
);
321 if (!kbd_dev
|| !hv_serio
) {
326 kbd_dev
->hv_dev
= hv_dev
;
327 kbd_dev
->hv_serio
= hv_serio
;
328 spin_lock_init(&kbd_dev
->lock
);
329 init_completion(&kbd_dev
->wait_event
);
330 hv_set_drvdata(hv_dev
, kbd_dev
);
332 hv_serio
->dev
.parent
= &hv_dev
->device
;
333 hv_serio
->id
.type
= SERIO_8042_XL
;
334 hv_serio
->port_data
= kbd_dev
;
335 strscpy(hv_serio
->name
, dev_name(&hv_dev
->device
),
336 sizeof(hv_serio
->name
));
337 strscpy(hv_serio
->phys
, dev_name(&hv_dev
->device
),
338 sizeof(hv_serio
->phys
));
340 hv_serio
->start
= hv_kbd_start
;
341 hv_serio
->stop
= hv_kbd_stop
;
343 error
= vmbus_open(hv_dev
->channel
,
344 KBD_VSC_SEND_RING_BUFFER_SIZE
,
345 KBD_VSC_RECV_RING_BUFFER_SIZE
,
347 hv_kbd_on_channel_callback
,
352 error
= hv_kbd_connect_to_vsp(hv_dev
);
354 goto err_close_vmbus
;
356 serio_register_port(kbd_dev
->hv_serio
);
358 device_init_wakeup(&hv_dev
->device
, true);
363 vmbus_close(hv_dev
->channel
);
370 static void hv_kbd_remove(struct hv_device
*hv_dev
)
372 struct hv_kbd_dev
*kbd_dev
= hv_get_drvdata(hv_dev
);
374 serio_unregister_port(kbd_dev
->hv_serio
);
375 vmbus_close(hv_dev
->channel
);
378 hv_set_drvdata(hv_dev
, NULL
);
381 static int hv_kbd_suspend(struct hv_device
*hv_dev
)
383 vmbus_close(hv_dev
->channel
);
388 static int hv_kbd_resume(struct hv_device
*hv_dev
)
392 ret
= vmbus_open(hv_dev
->channel
,
393 KBD_VSC_SEND_RING_BUFFER_SIZE
,
394 KBD_VSC_RECV_RING_BUFFER_SIZE
,
396 hv_kbd_on_channel_callback
,
399 ret
= hv_kbd_connect_to_vsp(hv_dev
);
404 static const struct hv_vmbus_device_id id_table
[] = {
410 MODULE_DEVICE_TABLE(vmbus
, id_table
);
412 static struct hv_driver hv_kbd_drv
= {
413 .name
= KBUILD_MODNAME
,
414 .id_table
= id_table
,
415 .probe
= hv_kbd_probe
,
416 .remove
= hv_kbd_remove
,
417 .suspend
= hv_kbd_suspend
,
418 .resume
= hv_kbd_resume
,
420 .probe_type
= PROBE_PREFER_ASYNCHRONOUS
,
424 static int __init
hv_kbd_init(void)
426 return vmbus_driver_register(&hv_kbd_drv
);
429 static void __exit
hv_kbd_exit(void)
431 vmbus_driver_unregister(&hv_kbd_drv
);
434 MODULE_LICENSE("GPL");
435 MODULE_DESCRIPTION("Microsoft Hyper-V Synthetic Keyboard Driver");
437 module_init(hv_kbd_init
);
438 module_exit(hv_kbd_exit
);