projects/linux·blob master · refs

742 lines · 16.9 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (c) 2009, Citrix Systems, Inc.
4 * Copyright (c) 2010, Microsoft Corporation.
5 * Copyright (c) 2011, Novell Inc.
6 */
7#include <linux/init.h>
8#include <linux/module.h>
9#include <linux/device.h>
10#include <linux/completion.h>
11#include <linux/input.h>
12#include <linux/hid.h>
13#include <linux/hiddev.h>
14#include <linux/hyperv.h>
15
16#if IS_ENABLED(CONFIG_HID_HYPERV_MOUSE_KUNIT_TEST)
17#include <kunit/test.h>
18#endif
19
20struct hv_input_dev_info {
21 unsigned int size;
22 unsigned short vendor;
23 unsigned short product;
24 unsigned short version;
25 unsigned short reserved[11];
26};
27
28/*
29 * Current version
30 *
31 * History:
32 * Beta, RC < 2008/1/22 1,0
33 * RC > 2008/1/22 2,0
34 */
35#define SYNTHHID_INPUT_VERSION_MAJOR 2
36#define SYNTHHID_INPUT_VERSION_MINOR 0
37#define SYNTHHID_INPUT_VERSION (SYNTHHID_INPUT_VERSION_MINOR | \
38 (SYNTHHID_INPUT_VERSION_MAJOR << 16))
39
40
41#pragma pack(push, 1)
42/*
43 * Message types in the synthetic input protocol
44 */
45enum synthhid_msg_type {
46 SYNTH_HID_PROTOCOL_REQUEST,
47 SYNTH_HID_PROTOCOL_RESPONSE,
48 SYNTH_HID_INITIAL_DEVICE_INFO,
49 SYNTH_HID_INITIAL_DEVICE_INFO_ACK,
50 SYNTH_HID_INPUT_REPORT,
51 SYNTH_HID_MAX
52};
53
54/*
55 * Basic message structures.
56 */
57struct synthhid_msg_hdr {
58 enum synthhid_msg_type type;
59 u32 size;
60};
61
62union synthhid_version {
63 struct {
64 u16 minor_version;
65 u16 major_version;
66 };
67 u32 version;
68};
69
70/*
71 * Protocol messages
72 */
73struct synthhid_protocol_request {
74 struct synthhid_msg_hdr header;
75 union synthhid_version version_requested;
76};
77
78struct synthhid_protocol_response {
79 struct synthhid_msg_hdr header;
80 union synthhid_version version_requested;
81 unsigned char approved;
82};
83
84struct synthhid_device_info {
85 struct synthhid_msg_hdr header;
86 struct hv_input_dev_info hid_dev_info;
87 struct hid_descriptor hid_descriptor;
88};
89
90struct synthhid_device_info_ack {
91 struct synthhid_msg_hdr header;
92 unsigned char reserved;
93};
94
95struct synthhid_input_report {
96 struct synthhid_msg_hdr header;
97 char buffer[];
98};
99
100#pragma pack(pop)
101
102#define INPUTVSC_SEND_RING_BUFFER_SIZE VMBUS_RING_SIZE(36 * 1024)
103#define INPUTVSC_RECV_RING_BUFFER_SIZE VMBUS_RING_SIZE(36 * 1024)
104
105
106enum pipe_prot_msg_type {
107 PIPE_MESSAGE_INVALID,
108 PIPE_MESSAGE_DATA,
109 PIPE_MESSAGE_MAXIMUM
110};
111
112
113struct pipe_prt_msg {
114 enum pipe_prot_msg_type type;
115 u32 size;
116 char data[];
117};
118
119struct mousevsc_prt_msg {
120 enum pipe_prot_msg_type type;
121 u32 size;
122 union {
123 struct synthhid_protocol_request request;
124 struct synthhid_protocol_response response;
125 struct synthhid_device_info_ack ack;
126 };
127};
128
129/*
130 * Represents an mousevsc device
131 */
132struct mousevsc_dev {
133 struct hv_device *device;
134 bool init_complete;
135 bool connected;
136 struct mousevsc_prt_msg protocol_req;
137 struct mousevsc_prt_msg protocol_resp;
138 /* Synchronize the request/response if needed */
139 struct completion wait_event;
140 int dev_info_status;
141
142 struct hid_descriptor *hid_desc;
143 unsigned char *report_desc;
144 u32 report_desc_size;
145 struct hv_input_dev_info hid_dev_info;
146 struct hid_device *hid_device;
147 u8 input_buf[HID_MAX_BUFFER_SIZE];
148};
149
150
151static struct mousevsc_dev *mousevsc_alloc_device(struct hv_device *device)
152{
153 struct mousevsc_dev *input_dev;
154
155 input_dev = kzalloc_obj(struct mousevsc_dev);
156
157 if (!input_dev)
158 return NULL;
159
160 input_dev->device = device;
161 hv_set_drvdata(device, input_dev);
162 init_completion(&input_dev->wait_event);
163 input_dev->init_complete = false;
164
165 return input_dev;
166}
167
168static void mousevsc_free_device(struct mousevsc_dev *device)
169{
170 kfree(device->hid_desc);
171 kfree(device->report_desc);
172 hv_set_drvdata(device->device, NULL);
173 kfree(device);
174}
175
176static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device,
177 struct synthhid_device_info *device_info,
178 u32 device_info_size)
179{
180 int ret = 0;
181 struct hid_descriptor *desc;
182 struct mousevsc_prt_msg ack;
183 size_t desc_offset;
184 size_t desc_size;
185
186 input_device->dev_info_status = -ENOMEM;
187
188 if (device_info_size < sizeof(*device_info)) {
189 input_device->dev_info_status = -EINVAL;
190 goto cleanup;
191 }
192
193 input_device->hid_dev_info = device_info->hid_dev_info;
194 desc = &device_info->hid_descriptor;
195 desc_offset = offsetof(struct synthhid_device_info, hid_descriptor);
196 desc_size = device_info_size - desc_offset;
197 if (desc->bLength == 0)
198 goto cleanup;
199 if (desc->bLength < sizeof(*desc) || desc->bLength > desc_size) {
200 input_device->dev_info_status = -EINVAL;
201 goto cleanup;
202 }
203
204 /* The pointer is not NULL when we resume from hibernation */
205 kfree(input_device->hid_desc);
206 input_device->hid_desc = kmemdup(desc, desc->bLength, GFP_ATOMIC);
207
208 if (!input_device->hid_desc)
209 goto cleanup;
210
211 input_device->report_desc_size = le16_to_cpu(
212 desc->rpt_desc.wDescriptorLength);
213 if (input_device->report_desc_size == 0) {
214 input_device->dev_info_status = -EINVAL;
215 goto cleanup;
216 }
217 if (input_device->report_desc_size > desc_size - desc->bLength) {
218 input_device->dev_info_status = -EINVAL;
219 goto cleanup;
220 }
221
222 /* The pointer is not NULL when we resume from hibernation */
223 kfree(input_device->report_desc);
224 input_device->report_desc = kzalloc(input_device->report_desc_size,
225 GFP_ATOMIC);
226
227 if (!input_device->report_desc) {
228 input_device->dev_info_status = -ENOMEM;
229 goto cleanup;
230 }
231
232 memcpy(input_device->report_desc,
233 ((unsigned char *)desc) + desc->bLength,
234 le16_to_cpu(desc->rpt_desc.wDescriptorLength));
235
236 /* Send the ack */
237 memset(&ack, 0, sizeof(struct mousevsc_prt_msg));
238
239 ack.type = PIPE_MESSAGE_DATA;
240 ack.size = sizeof(struct synthhid_device_info_ack);
241
242 ack.ack.header.type = SYNTH_HID_INITIAL_DEVICE_INFO_ACK;
243 ack.ack.header.size = 1;
244 ack.ack.reserved = 0;
245
246 if (IS_ENABLED(CONFIG_HID_HYPERV_MOUSE_KUNIT_TEST) &&
247 !input_device->device) {
248 ret = 0;
249 } else {
250 ret = vmbus_sendpacket(input_device->device->channel,
251 &ack,
252 sizeof(struct pipe_prt_msg) +
253 sizeof(struct synthhid_device_info_ack),
254 (unsigned long)&ack,
255 VM_PKT_DATA_INBAND,
256 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
257 }
258
259 if (!ret)
260 input_device->dev_info_status = 0;
261
262cleanup:
263 complete(&input_device->wait_event);
264
265 return;
266}
267
268static void mousevsc_on_receive(struct hv_device *device,
269 struct vmpacket_descriptor *packet)
270{
271 struct pipe_prt_msg *pipe_msg;
272 struct synthhid_msg_hdr *hid_msg_hdr;
273 struct mousevsc_dev *input_dev = hv_get_drvdata(device);
274 struct synthhid_input_report *input_report;
275 size_t len;
276
277 pipe_msg = (struct pipe_prt_msg *)((unsigned long)packet +
278 (packet->offset8 << 3));
279
280 if (pipe_msg->type != PIPE_MESSAGE_DATA)
281 return;
282
283 hid_msg_hdr = (struct synthhid_msg_hdr *)pipe_msg->data;
284
285 switch (hid_msg_hdr->type) {
286 case SYNTH_HID_PROTOCOL_RESPONSE:
287 len = struct_size(pipe_msg, data, pipe_msg->size);
288
289 /*
290 * While it will be impossible for us to protect against
291 * malicious/buggy hypervisor/host, add a check here to
292 * ensure we don't corrupt memory.
293 */
294 if (WARN_ON(len > sizeof(struct mousevsc_prt_msg)))
295 break;
296
297 memcpy(&input_dev->protocol_resp, pipe_msg, len);
298 complete(&input_dev->wait_event);
299 break;
300
301 case SYNTH_HID_INITIAL_DEVICE_INFO:
302 if (WARN_ON_ONCE(pipe_msg->size <
303 sizeof(struct synthhid_device_info)))
304 break;
305
306 /*
307 * Parse out the device info into device attr,
308 * hid desc and report desc
309 */
310 mousevsc_on_receive_device_info(input_dev,
311 (struct synthhid_device_info *)pipe_msg->data,
312 pipe_msg->size);
313 break;
314 case SYNTH_HID_INPUT_REPORT:
315 input_report =
316 (struct synthhid_input_report *)pipe_msg->data;
317 if (!input_dev->init_complete)
318 break;
319
320 len = min(input_report->header.size,
321 (u32)sizeof(input_dev->input_buf));
322 memcpy(input_dev->input_buf, input_report->buffer, len);
323 hid_input_report(input_dev->hid_device, HID_INPUT_REPORT,
324 input_dev->input_buf, len, 1);
325
326 pm_wakeup_hard_event(&input_dev->device->device);
327
328 break;
329 default:
330 pr_err("unsupported hid msg type - type %d len %d\n",
331 hid_msg_hdr->type, hid_msg_hdr->size);
332 break;
333 }
334
335}
336
337static void mousevsc_on_channel_callback(void *context)
338{
339 struct hv_device *device = context;
340 struct vmpacket_descriptor *desc;
341
342 foreach_vmbus_pkt(desc, device->channel) {
343 switch (desc->type) {
344 case VM_PKT_COMP:
345 break;
346
347 case VM_PKT_DATA_INBAND:
348 mousevsc_on_receive(device, desc);
349 break;
350
351 default:
352 pr_err("Unhandled packet type %d, tid %llx len %d\n",
353 desc->type, desc->trans_id, desc->len8 * 8);
354 break;
355 }
356 }
357}
358
359static int mousevsc_connect_to_vsp(struct hv_device *device)
360{
361 int ret = 0;
362 unsigned long t;
363 struct mousevsc_dev *input_dev = hv_get_drvdata(device);
364 struct mousevsc_prt_msg *request;
365 struct mousevsc_prt_msg *response;
366
367 reinit_completion(&input_dev->wait_event);
368
369 request = &input_dev->protocol_req;
370 memset(request, 0, sizeof(struct mousevsc_prt_msg));
371
372 request->type = PIPE_MESSAGE_DATA;
373 request->size = sizeof(struct synthhid_protocol_request);
374 request->request.header.type = SYNTH_HID_PROTOCOL_REQUEST;
375 request->request.header.size = sizeof(unsigned int);
376 request->request.version_requested.version = SYNTHHID_INPUT_VERSION;
377
378 ret = vmbus_sendpacket(device->channel, request,
379 sizeof(struct pipe_prt_msg) +
380 sizeof(struct synthhid_protocol_request),
381 (unsigned long)request,
382 VM_PKT_DATA_INBAND,
383 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
384 if (ret)
385 goto cleanup;
386
387 t = wait_for_completion_timeout(&input_dev->wait_event, 5*HZ);
388 if (!t) {
389 ret = -ETIMEDOUT;
390 goto cleanup;
391 }
392
393 response = &input_dev->protocol_resp;
394
395 if (!response->response.approved) {
396 pr_err("synthhid protocol request failed (version %d)\n",
397 SYNTHHID_INPUT_VERSION);
398 ret = -ENODEV;
399 goto cleanup;
400 }
401
402 t = wait_for_completion_timeout(&input_dev->wait_event, 5*HZ);
403 if (!t) {
404 ret = -ETIMEDOUT;
405 goto cleanup;
406 }
407
408 /*
409 * We should have gotten the device attr, hid desc and report
410 * desc at this point
411 */
412 ret = input_dev->dev_info_status;
413
414cleanup:
415 return ret;
416}
417
418static int mousevsc_hid_parse(struct hid_device *hid)
419{
420 struct hv_device *dev = hid_get_drvdata(hid);
421 struct mousevsc_dev *input_dev = hv_get_drvdata(dev);
422
423 return hid_parse_report(hid, input_dev->report_desc,
424 input_dev->report_desc_size);
425}
426
427static int mousevsc_hid_open(struct hid_device *hid)
428{
429 return 0;
430}
431
432static int mousevsc_hid_start(struct hid_device *hid)
433{
434 return 0;
435}
436
437static void mousevsc_hid_close(struct hid_device *hid)
438{
439}
440
441static void mousevsc_hid_stop(struct hid_device *hid)
442{
443}
444
445static int mousevsc_hid_raw_request(struct hid_device *hid,
446 unsigned char report_num,
447 __u8 *buf, size_t len,
448 unsigned char rtype,
449 int reqtype)
450{
451 return 0;
452}
453
454static int mousevsc_hid_probe(struct hid_device *hid_dev, const struct hid_device_id *id)
455{
456 int ret;
457
458 ret = hid_parse(hid_dev);
459 if (ret) {
460 hid_err(hid_dev, "parse failed\n");
461 return ret;
462 }
463
464 ret = hid_hw_start(hid_dev, HID_CONNECT_HIDINPUT | HID_CONNECT_HIDDEV);
465 if (ret) {
466 hid_err(hid_dev, "hw start failed\n");
467 return ret;
468 }
469
470 return 0;
471}
472
473static const struct hid_ll_driver mousevsc_ll_driver = {
474 .parse = mousevsc_hid_parse,
475 .open = mousevsc_hid_open,
476 .close = mousevsc_hid_close,
477 .start = mousevsc_hid_start,
478 .stop = mousevsc_hid_stop,
479 .raw_request = mousevsc_hid_raw_request,
480};
481
482static const struct hid_device_id mousevsc_devices[] = {
483 { HID_DEVICE(BUS_VIRTUAL, HID_GROUP_ANY, 0x045E, 0x0621) },
484 { }
485};
486
487static struct hid_driver mousevsc_hid_driver = {
488 .name = "hid-hyperv",
489 .id_table = mousevsc_devices,
490 .probe = mousevsc_hid_probe,
491};
492
493static int mousevsc_probe(struct hv_device *device,
494 const struct hv_vmbus_device_id *dev_id)
495{
496 int ret;
497 struct mousevsc_dev *input_dev;
498 struct hid_device *hid_dev;
499
500 input_dev = mousevsc_alloc_device(device);
501
502 if (!input_dev)
503 return -ENOMEM;
504
505 ret = vmbus_open(device->channel,
506 INPUTVSC_SEND_RING_BUFFER_SIZE,
507 INPUTVSC_RECV_RING_BUFFER_SIZE,
508 NULL,
509 0,
510 mousevsc_on_channel_callback,
511 device
512 );
513
514 if (ret)
515 goto probe_err0;
516
517 ret = mousevsc_connect_to_vsp(device);
518
519 if (ret)
520 goto probe_err1;
521
522 /* workaround SA-167 */
523 if (input_dev->report_desc[14] == 0x25)
524 input_dev->report_desc[14] = 0x29;
525
526 hid_dev = hid_allocate_device();
527 if (IS_ERR(hid_dev)) {
528 ret = PTR_ERR(hid_dev);
529 goto probe_err1;
530 }
531
532 hid_dev->ll_driver = &mousevsc_ll_driver;
533 hid_dev->bus = BUS_VIRTUAL;
534 hid_dev->vendor = input_dev->hid_dev_info.vendor;
535 hid_dev->product = input_dev->hid_dev_info.product;
536 hid_dev->version = input_dev->hid_dev_info.version;
537 input_dev->hid_device = hid_dev;
538
539 sprintf(hid_dev->name, "%s", "Microsoft Vmbus HID-compliant Mouse");
540
541 hid_set_drvdata(hid_dev, device);
542
543 ret = hid_add_device(hid_dev);
544 if (ret)
545 goto probe_err2;
546
547 device_init_wakeup(&device->device, true);
548
549 input_dev->connected = true;
550 input_dev->init_complete = true;
551
552 return ret;
553
554probe_err2:
555 hid_destroy_device(hid_dev);
556
557probe_err1:
558 vmbus_close(device->channel);
559
560probe_err0:
561 mousevsc_free_device(input_dev);
562
563 return ret;
564}
565
566
567static void mousevsc_remove(struct hv_device *dev)
568{
569 struct mousevsc_dev *input_dev = hv_get_drvdata(dev);
570
571 device_init_wakeup(&dev->device, false);
572 vmbus_close(dev->channel);
573 hid_hw_stop(input_dev->hid_device);
574 hid_destroy_device(input_dev->hid_device);
575 mousevsc_free_device(input_dev);
576}
577
578static int mousevsc_suspend(struct hv_device *dev)
579{
580 vmbus_close(dev->channel);
581
582 return 0;
583}
584
585static int mousevsc_resume(struct hv_device *dev)
586{
587 int ret;
588
589 ret = vmbus_open(dev->channel,
590 INPUTVSC_SEND_RING_BUFFER_SIZE,
591 INPUTVSC_RECV_RING_BUFFER_SIZE,
592 NULL, 0,
593 mousevsc_on_channel_callback,
594 dev);
595 if (ret)
596 return ret;
597
598 ret = mousevsc_connect_to_vsp(dev);
599 return ret;
600}
601
602static const struct hv_vmbus_device_id id_table[] = {
603 /* Mouse guid */
604 { HV_MOUSE_GUID, },
605 { },
606};
607
608MODULE_DEVICE_TABLE(vmbus, id_table);
609
610static struct hv_driver mousevsc_drv = {
611 .name = KBUILD_MODNAME,
612 .id_table = id_table,
613 .probe = mousevsc_probe,
614 .remove = mousevsc_remove,
615 .suspend = mousevsc_suspend,
616 .resume = mousevsc_resume,
617 .driver = {
618 .probe_type = PROBE_PREFER_ASYNCHRONOUS,
619 },
620};
621
622static int __init mousevsc_init(void)
623{
624 int ret;
625
626 ret = hid_register_driver(&mousevsc_hid_driver);
627 if (ret)
628 return ret;
629
630 ret = vmbus_driver_register(&mousevsc_drv);
631 if (ret)
632 hid_unregister_driver(&mousevsc_hid_driver);
633
634 return ret;
635}
636
637static void __exit mousevsc_exit(void)
638{
639 vmbus_driver_unregister(&mousevsc_drv);
640 hid_unregister_driver(&mousevsc_hid_driver);
641}
642
643MODULE_LICENSE("GPL");
644MODULE_DESCRIPTION("Microsoft Hyper-V Synthetic HID Driver");
645
646#if IS_ENABLED(CONFIG_HID_HYPERV_MOUSE_KUNIT_TEST)
647static struct mousevsc_dev *mousevsc_kunit_alloc_dev(struct kunit *test)
648{
649 struct mousevsc_dev *input_dev;
650
651 input_dev = kunit_kzalloc(test, sizeof(*input_dev), GFP_KERNEL);
652 if (!input_dev)
653 return NULL;
654
655 init_completion(&input_dev->wait_event);
656
657 return input_dev;
658}
659
660static void mousevsc_device_info_zero_blength(struct kunit *test)
661{
662 struct synthhid_device_info *info;
663 struct mousevsc_dev *input_dev;
664
665 input_dev = mousevsc_kunit_alloc_dev(test);
666 KUNIT_ASSERT_NOT_NULL(test, input_dev);
667 info = kunit_kzalloc(test, sizeof(*info), GFP_KERNEL);
668 KUNIT_ASSERT_NOT_NULL(test, info);
669
670 info->hid_descriptor.bLength = 0;
671
672 mousevsc_on_receive_device_info(input_dev, info, sizeof(*info));
673
674 KUNIT_EXPECT_EQ(test, input_dev->dev_info_status, -ENOMEM);
675}
676
677static void mousevsc_device_info_valid_descriptor(struct kunit *test)
678{
679 struct synthhid_device_info *info;
680 struct mousevsc_dev *input_dev;
681 u8 *report;
682
683 input_dev = mousevsc_kunit_alloc_dev(test);
684 KUNIT_ASSERT_NOT_NULL(test, input_dev);
685 info = kunit_kzalloc(test, sizeof(*info) + 4, GFP_KERNEL);
686 KUNIT_ASSERT_NOT_NULL(test, info);
687
688 info->hid_descriptor.bLength = sizeof(struct hid_descriptor);
689 info->hid_descriptor.rpt_desc.wDescriptorLength = cpu_to_le16(4);
690 report = (u8 *)(info + 1);
691 memset(report, 0x42, 4);
692
693 mousevsc_on_receive_device_info(input_dev, info, sizeof(*info) + 4);
694
695 KUNIT_EXPECT_EQ(test, input_dev->dev_info_status, 0);
696 KUNIT_EXPECT_EQ(test, input_dev->report_desc_size, 4);
697 KUNIT_EXPECT_MEMEQ(test, input_dev->report_desc, report, 4);
698
699 kfree(input_dev->hid_desc);
700 kfree(input_dev->report_desc);
701}
702
703static void mousevsc_device_info_report_desc_oob(struct kunit *test)
704{
705 struct synthhid_device_info *info;
706 struct mousevsc_dev *input_dev;
707 u8 *report;
708
709 input_dev = mousevsc_kunit_alloc_dev(test);
710 KUNIT_ASSERT_NOT_NULL(test, input_dev);
711 info = kunit_kzalloc(test, sizeof(*info) + 8, GFP_KERNEL);
712 KUNIT_ASSERT_NOT_NULL(test, info);
713
714 info->hid_descriptor.bLength = sizeof(struct hid_descriptor);
715 info->hid_descriptor.rpt_desc.wDescriptorLength = cpu_to_le16(64);
716 report = (u8 *)(info + 1);
717 memset(report, 0x42, 8);
718
719 mousevsc_on_receive_device_info(input_dev, info, sizeof(*info) + 8);
720
721 KUNIT_EXPECT_EQ(test, input_dev->dev_info_status, -EINVAL);
722
723 kfree(input_dev->hid_desc);
724}
725
726static struct kunit_case mousevsc_test_cases[] = {
727 KUNIT_CASE(mousevsc_device_info_zero_blength),
728 KUNIT_CASE(mousevsc_device_info_valid_descriptor),
729 KUNIT_CASE(mousevsc_device_info_report_desc_oob),
730 {}
731};
732
733static struct kunit_suite mousevsc_test_suite = {
734 .name = "hid_hyperv_mouse",
735 .test_cases = mousevsc_test_cases,
736};
737
738kunit_test_suite(mousevsc_test_suite);
739#endif
740
741module_init(mousevsc_init);
742module_exit(mousevsc_exit);