2 * Copyright (c) 2013, Microsoft Corporation.
4 * This program is free software; you can redistribute it and/or modify it
5 * under the terms and conditions of the GNU General Public License,
6 * version 2, as published by the Free Software Foundation.
8 * This program is distributed in the hope it will be useful, but WITHOUT
9 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
10 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
14 #include <linux/init.h>
15 #include <linux/module.h>
16 #include <linux/device.h>
17 #include <linux/completion.h>
18 #include <linux/hyperv.h>
19 #include <linux/serio.h>
20 #include <linux/slab.h>
26 #define SYNTH_KBD_VERSION_MAJOR 1
27 #define SYNTH_KBD_VERSION_MINOR 0
28 #define SYNTH_KBD_VERSION (SYNTH_KBD_VERSION_MINOR | \
29 (SYNTH_KBD_VERSION_MAJOR << 16))
33 * Message types in the synthetic input protocol
35 enum synth_kbd_msg_type
{
36 SYNTH_KBD_PROTOCOL_REQUEST
= 1,
37 SYNTH_KBD_PROTOCOL_RESPONSE
= 2,
39 SYNTH_KBD_LED_INDICATORS
= 4,
43 * Basic message structures.
45 struct synth_kbd_msg_hdr
{
49 struct synth_kbd_msg
{
50 struct synth_kbd_msg_hdr header
;
51 char data
[]; /* Enclosed message */
54 union synth_kbd_version
{
61 struct synth_kbd_protocol_request
{
62 struct synth_kbd_msg_hdr header
;
63 union synth_kbd_version version_requested
;
66 #define PROTOCOL_ACCEPTED BIT(0)
67 struct synth_kbd_protocol_response
{
68 struct synth_kbd_msg_hdr header
;
72 #define IS_UNICODE BIT(0)
73 #define IS_BREAK BIT(1)
76 struct synth_kbd_keystroke
{
77 struct synth_kbd_msg_hdr header
;
80 __le32 info
; /* Additional information */
84 #define HK_MAXIMUM_MESSAGE_SIZE 256
86 #define KBD_VSC_SEND_RING_BUFFER_SIZE (10 * PAGE_SIZE)
87 #define KBD_VSC_RECV_RING_BUFFER_SIZE (10 * PAGE_SIZE)
89 #define XTKBD_EMUL0 0xe0
90 #define XTKBD_EMUL1 0xe1
91 #define XTKBD_RELEASE 0x80
95 * Represents a keyboard device
98 struct hv_device
*hv_dev
;
99 struct serio
*hv_serio
;
100 struct synth_kbd_protocol_request protocol_req
;
101 struct synth_kbd_protocol_response protocol_resp
;
102 /* Synchronize the request/response if needed */
103 struct completion wait_event
;
104 spinlock_t lock
; /* protects 'started' field */
108 static void hv_kbd_on_receive(struct hv_device
*hv_dev
,
109 struct synth_kbd_msg
*msg
, u32 msg_length
)
111 struct hv_kbd_dev
*kbd_dev
= hv_get_drvdata(hv_dev
);
112 struct synth_kbd_keystroke
*ks_msg
;
114 u32 msg_type
= __le32_to_cpu(msg
->header
.type
);
119 case SYNTH_KBD_PROTOCOL_RESPONSE
:
121 * Validate the information provided by the host.
122 * If the host is giving us a bogus packet,
123 * drop the packet (hoping the problem
126 if (msg_length
< sizeof(struct synth_kbd_protocol_response
)) {
127 dev_err(&hv_dev
->device
,
128 "Illegal protocol response packet (len: %d)\n",
133 memcpy(&kbd_dev
->protocol_resp
, msg
,
134 sizeof(struct synth_kbd_protocol_response
));
135 complete(&kbd_dev
->wait_event
);
138 case SYNTH_KBD_EVENT
:
140 * Validate the information provided by the host.
141 * If the host is giving us a bogus packet,
142 * drop the packet (hoping the problem
145 if (msg_length
< sizeof(struct synth_kbd_keystroke
)) {
146 dev_err(&hv_dev
->device
,
147 "Illegal keyboard event packet (len: %d)\n",
152 ks_msg
= (struct synth_kbd_keystroke
*)msg
;
153 info
= __le32_to_cpu(ks_msg
->info
);
156 * Inject the information through the serio interrupt.
158 spin_lock_irqsave(&kbd_dev
->lock
, flags
);
159 if (kbd_dev
->started
) {
161 serio_interrupt(kbd_dev
->hv_serio
,
164 serio_interrupt(kbd_dev
->hv_serio
,
166 scan_code
= __le16_to_cpu(ks_msg
->make_code
);
168 scan_code
|= XTKBD_RELEASE
;
170 serio_interrupt(kbd_dev
->hv_serio
, scan_code
, 0);
172 spin_unlock_irqrestore(&kbd_dev
->lock
, flags
);
175 * Only trigger a wakeup on key down, otherwise
176 * "echo freeze > /sys/power/state" can't really enter the
177 * state because the Enter-UP can trigger a wakeup at once.
179 if (!(info
& IS_BREAK
))
180 pm_wakeup_hard_event(&hv_dev
->device
);
185 dev_err(&hv_dev
->device
,
186 "unhandled message type %d\n", msg_type
);
190 static void hv_kbd_handle_received_packet(struct hv_device
*hv_dev
,
191 struct vmpacket_descriptor
*desc
,
195 struct synth_kbd_msg
*msg
;
198 switch (desc
->type
) {
202 case VM_PKT_DATA_INBAND
:
204 * We have a packet that has "inband" data. The API used
205 * for retrieving the packet guarantees that the complete
206 * packet is read. So, minimally, we should be able to
207 * parse the payload header safely (assuming that the host
208 * can be trusted. Trusting the host seems to be a
209 * reasonable assumption because in a virtualized
210 * environment there is not whole lot you can do if you
211 * don't trust the host.
213 * Nonetheless, let us validate if the host can be trusted
214 * (in a trivial way). The interesting aspect of this
215 * validation is how do you recover if we discover that the
216 * host is not to be trusted? Simply dropping the packet, I
217 * don't think is an appropriate recovery. In the interest
218 * of failing fast, it may be better to crash the guest.
219 * For now, I will just drop the packet!
222 msg_sz
= bytes_recvd
- (desc
->offset8
<< 3);
223 if (msg_sz
<= sizeof(struct synth_kbd_msg_hdr
)) {
225 * Drop the packet and hope
226 * the problem magically goes away.
228 dev_err(&hv_dev
->device
,
229 "Illegal packet (type: %d, tid: %llx, size: %d)\n",
230 desc
->type
, req_id
, msg_sz
);
234 msg
= (void *)desc
+ (desc
->offset8
<< 3);
235 hv_kbd_on_receive(hv_dev
, msg
, msg_sz
);
239 dev_err(&hv_dev
->device
,
240 "unhandled packet type %d, tid %llx len %d\n",
241 desc
->type
, req_id
, bytes_recvd
);
246 static void hv_kbd_on_channel_callback(void *context
)
248 struct hv_device
*hv_dev
= context
;
250 int bufferlen
= 0x100; /* Start with sensible size */
255 buffer
= kmalloc(bufferlen
, GFP_ATOMIC
);
260 error
= vmbus_recvpacket_raw(hv_dev
->channel
, buffer
, bufferlen
,
261 &bytes_recvd
, &req_id
);
264 if (bytes_recvd
== 0) {
269 hv_kbd_handle_received_packet(hv_dev
, buffer
,
270 bytes_recvd
, req_id
);
275 /* Handle large packet */
276 bufferlen
= bytes_recvd
;
277 buffer
= kmalloc(bytes_recvd
, GFP_ATOMIC
);
285 static int hv_kbd_connect_to_vsp(struct hv_device
*hv_dev
)
287 struct hv_kbd_dev
*kbd_dev
= hv_get_drvdata(hv_dev
);
288 struct synth_kbd_protocol_request
*request
;
289 struct synth_kbd_protocol_response
*response
;
293 request
= &kbd_dev
->protocol_req
;
294 memset(request
, 0, sizeof(struct synth_kbd_protocol_request
));
295 request
->header
.type
= __cpu_to_le32(SYNTH_KBD_PROTOCOL_REQUEST
);
296 request
->version_requested
.version
= __cpu_to_le32(SYNTH_KBD_VERSION
);
298 error
= vmbus_sendpacket(hv_dev
->channel
, request
,
299 sizeof(struct synth_kbd_protocol_request
),
300 (unsigned long)request
,
302 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED
);
306 if (!wait_for_completion_timeout(&kbd_dev
->wait_event
, 10 * HZ
))
309 response
= &kbd_dev
->protocol_resp
;
310 proto_status
= __le32_to_cpu(response
->proto_status
);
311 if (!(proto_status
& PROTOCOL_ACCEPTED
)) {
312 dev_err(&hv_dev
->device
,
313 "synth_kbd protocol request failed (version %d)\n",
321 static int hv_kbd_start(struct serio
*serio
)
323 struct hv_kbd_dev
*kbd_dev
= serio
->port_data
;
326 spin_lock_irqsave(&kbd_dev
->lock
, flags
);
327 kbd_dev
->started
= true;
328 spin_unlock_irqrestore(&kbd_dev
->lock
, flags
);
333 static void hv_kbd_stop(struct serio
*serio
)
335 struct hv_kbd_dev
*kbd_dev
= serio
->port_data
;
338 spin_lock_irqsave(&kbd_dev
->lock
, flags
);
339 kbd_dev
->started
= false;
340 spin_unlock_irqrestore(&kbd_dev
->lock
, flags
);
343 static int hv_kbd_probe(struct hv_device
*hv_dev
,
344 const struct hv_vmbus_device_id
*dev_id
)
346 struct hv_kbd_dev
*kbd_dev
;
347 struct serio
*hv_serio
;
350 kbd_dev
= kzalloc(sizeof(struct hv_kbd_dev
), GFP_KERNEL
);
351 hv_serio
= kzalloc(sizeof(struct serio
), GFP_KERNEL
);
352 if (!kbd_dev
|| !hv_serio
) {
357 kbd_dev
->hv_dev
= hv_dev
;
358 kbd_dev
->hv_serio
= hv_serio
;
359 spin_lock_init(&kbd_dev
->lock
);
360 init_completion(&kbd_dev
->wait_event
);
361 hv_set_drvdata(hv_dev
, kbd_dev
);
363 hv_serio
->dev
.parent
= &hv_dev
->device
;
364 hv_serio
->id
.type
= SERIO_8042_XL
;
365 hv_serio
->port_data
= kbd_dev
;
366 strlcpy(hv_serio
->name
, dev_name(&hv_dev
->device
),
367 sizeof(hv_serio
->name
));
368 strlcpy(hv_serio
->phys
, dev_name(&hv_dev
->device
),
369 sizeof(hv_serio
->phys
));
371 hv_serio
->start
= hv_kbd_start
;
372 hv_serio
->stop
= hv_kbd_stop
;
374 error
= vmbus_open(hv_dev
->channel
,
375 KBD_VSC_SEND_RING_BUFFER_SIZE
,
376 KBD_VSC_RECV_RING_BUFFER_SIZE
,
378 hv_kbd_on_channel_callback
,
383 error
= hv_kbd_connect_to_vsp(hv_dev
);
385 goto err_close_vmbus
;
387 serio_register_port(kbd_dev
->hv_serio
);
389 device_init_wakeup(&hv_dev
->device
, true);
394 vmbus_close(hv_dev
->channel
);
401 static int hv_kbd_remove(struct hv_device
*hv_dev
)
403 struct hv_kbd_dev
*kbd_dev
= hv_get_drvdata(hv_dev
);
405 serio_unregister_port(kbd_dev
->hv_serio
);
406 vmbus_close(hv_dev
->channel
);
409 hv_set_drvdata(hv_dev
, NULL
);
414 static const struct hv_vmbus_device_id id_table
[] = {
420 MODULE_DEVICE_TABLE(vmbus
, id_table
);
422 static struct hv_driver hv_kbd_drv
= {
423 .name
= KBUILD_MODNAME
,
424 .id_table
= id_table
,
425 .probe
= hv_kbd_probe
,
426 .remove
= hv_kbd_remove
,
428 .probe_type
= PROBE_PREFER_ASYNCHRONOUS
,
432 static int __init
hv_kbd_init(void)
434 return vmbus_driver_register(&hv_kbd_drv
);
437 static void __exit
hv_kbd_exit(void)
439 vmbus_driver_unregister(&hv_kbd_drv
);
442 MODULE_LICENSE("GPL");
443 MODULE_DESCRIPTION("Microsoft Hyper-V Synthetic Keyboard Driver");
445 module_init(hv_kbd_init
);
446 module_exit(hv_kbd_exit
);