cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

surface_kbd.c (7898B)


      1// SPDX-License-Identifier: GPL-2.0+
      2/*
      3 * Surface System Aggregator Module (SSAM) HID transport driver for the legacy
      4 * keyboard interface (KBD/TC=0x08 subsystem). Provides support for the
      5 * integrated HID keyboard on Surface Laptops 1 and 2.
      6 *
      7 * Copyright (C) 2019-2021 Maximilian Luz <luzmaximilian@gmail.com>
      8 */
      9
     10#include <asm/unaligned.h>
     11#include <linux/hid.h>
     12#include <linux/kernel.h>
     13#include <linux/module.h>
     14#include <linux/platform_device.h>
     15#include <linux/types.h>
     16
     17#include <linux/surface_aggregator/controller.h>
     18
     19#include "surface_hid_core.h"
     20
     21
     22/* -- SAM interface (KBD). -------------------------------------------------- */
     23
     24#define KBD_FEATURE_REPORT_SIZE			7  /* 6 + report ID */
     25
     26enum surface_kbd_cid {
     27	SURFACE_KBD_CID_GET_DESCRIPTOR		= 0x00,
     28	SURFACE_KBD_CID_SET_CAPSLOCK_LED	= 0x01,
     29	SURFACE_KBD_CID_EVT_INPUT_GENERIC	= 0x03,
     30	SURFACE_KBD_CID_EVT_INPUT_HOTKEYS	= 0x04,
     31	SURFACE_KBD_CID_GET_FEATURE_REPORT	= 0x0b,
     32};
     33
     34static int ssam_kbd_get_descriptor(struct surface_hid_device *shid, u8 entry, u8 *buf, size_t len)
     35{
     36	struct ssam_request rqst;
     37	struct ssam_response rsp;
     38	int status;
     39
     40	rqst.target_category = shid->uid.category;
     41	rqst.target_id = shid->uid.target;
     42	rqst.command_id = SURFACE_KBD_CID_GET_DESCRIPTOR;
     43	rqst.instance_id = shid->uid.instance;
     44	rqst.flags = SSAM_REQUEST_HAS_RESPONSE;
     45	rqst.length = sizeof(entry);
     46	rqst.payload = &entry;
     47
     48	rsp.capacity = len;
     49	rsp.length = 0;
     50	rsp.pointer = buf;
     51
     52	status = ssam_retry(ssam_request_sync_onstack, shid->ctrl, &rqst, &rsp, sizeof(entry));
     53	if (status)
     54		return status;
     55
     56	if (rsp.length != len) {
     57		dev_err(shid->dev, "invalid descriptor length: got %zu, expected, %zu\n",
     58			rsp.length, len);
     59		return -EPROTO;
     60	}
     61
     62	return 0;
     63}
     64
     65static int ssam_kbd_set_caps_led(struct surface_hid_device *shid, bool value)
     66{
     67	struct ssam_request rqst;
     68	u8 value_u8 = value;
     69
     70	rqst.target_category = shid->uid.category;
     71	rqst.target_id = shid->uid.target;
     72	rqst.command_id = SURFACE_KBD_CID_SET_CAPSLOCK_LED;
     73	rqst.instance_id = shid->uid.instance;
     74	rqst.flags = 0;
     75	rqst.length = sizeof(value_u8);
     76	rqst.payload = &value_u8;
     77
     78	return ssam_retry(ssam_request_sync_onstack, shid->ctrl, &rqst, NULL, sizeof(value_u8));
     79}
     80
     81static int ssam_kbd_get_feature_report(struct surface_hid_device *shid, u8 *buf, size_t len)
     82{
     83	struct ssam_request rqst;
     84	struct ssam_response rsp;
     85	u8 payload = 0;
     86	int status;
     87
     88	rqst.target_category = shid->uid.category;
     89	rqst.target_id = shid->uid.target;
     90	rqst.command_id = SURFACE_KBD_CID_GET_FEATURE_REPORT;
     91	rqst.instance_id = shid->uid.instance;
     92	rqst.flags = SSAM_REQUEST_HAS_RESPONSE;
     93	rqst.length = sizeof(payload);
     94	rqst.payload = &payload;
     95
     96	rsp.capacity = len;
     97	rsp.length = 0;
     98	rsp.pointer = buf;
     99
    100	status = ssam_retry(ssam_request_sync_onstack, shid->ctrl, &rqst, &rsp, sizeof(payload));
    101	if (status)
    102		return status;
    103
    104	if (rsp.length != len) {
    105		dev_err(shid->dev, "invalid feature report length: got %zu, expected, %zu\n",
    106			rsp.length, len);
    107		return -EPROTO;
    108	}
    109
    110	return 0;
    111}
    112
    113static bool ssam_kbd_is_input_event(const struct ssam_event *event)
    114{
    115	if (event->command_id == SURFACE_KBD_CID_EVT_INPUT_GENERIC)
    116		return true;
    117
    118	if (event->command_id == SURFACE_KBD_CID_EVT_INPUT_HOTKEYS)
    119		return true;
    120
    121	return false;
    122}
    123
    124static u32 ssam_kbd_event_fn(struct ssam_event_notifier *nf, const struct ssam_event *event)
    125{
    126	struct surface_hid_device *shid = container_of(nf, struct surface_hid_device, notif);
    127
    128	/*
    129	 * Check against device UID manually, as registry and device target
    130	 * category doesn't line up.
    131	 */
    132
    133	if (shid->uid.category != event->target_category)
    134		return 0;
    135
    136	if (shid->uid.target != event->target_id)
    137		return 0;
    138
    139	if (shid->uid.instance != event->instance_id)
    140		return 0;
    141
    142	if (!ssam_kbd_is_input_event(event))
    143		return 0;
    144
    145	hid_input_report(shid->hid, HID_INPUT_REPORT, (u8 *)&event->data[0], event->length, 0);
    146	return SSAM_NOTIF_HANDLED;
    147}
    148
    149
    150/* -- Transport driver (KBD). ----------------------------------------------- */
    151
    152static int skbd_get_caps_led_value(struct hid_device *hid, u8 rprt_id, u8 *buf, size_t len)
    153{
    154	struct hid_field *field;
    155	unsigned int offset, size;
    156	int i;
    157
    158	/* Get LED field. */
    159	field = hidinput_get_led_field(hid);
    160	if (!field)
    161		return -ENOENT;
    162
    163	/* Check if we got the correct report. */
    164	if (len != hid_report_len(field->report))
    165		return -ENOENT;
    166
    167	if (rprt_id != field->report->id)
    168		return -ENOENT;
    169
    170	/* Get caps lock LED index. */
    171	for (i = 0; i < field->report_count; i++)
    172		if ((field->usage[i].hid & 0xffff) == 0x02)
    173			break;
    174
    175	if (i == field->report_count)
    176		return -ENOENT;
    177
    178	/* Extract value. */
    179	size = field->report_size;
    180	offset = field->report_offset + i * size;
    181	return !!hid_field_extract(hid, buf + 1, size, offset);
    182}
    183
    184static int skbd_output_report(struct surface_hid_device *shid, u8 rprt_id, u8 *buf, size_t len)
    185{
    186	int caps_led;
    187	int status;
    188
    189	caps_led = skbd_get_caps_led_value(shid->hid, rprt_id, buf, len);
    190	if (caps_led < 0)
    191		return -EIO;  /* Only caps LED output reports are supported. */
    192
    193	status = ssam_kbd_set_caps_led(shid, caps_led);
    194	if (status < 0)
    195		return status;
    196
    197	return len;
    198}
    199
    200static int skbd_get_feature_report(struct surface_hid_device *shid, u8 rprt_id, u8 *buf, size_t len)
    201{
    202	u8 report[KBD_FEATURE_REPORT_SIZE];
    203	int status;
    204
    205	/*
    206	 * The keyboard only has a single hard-coded read-only feature report
    207	 * of size KBD_FEATURE_REPORT_SIZE. Try to load it and compare its
    208	 * report ID against the requested one.
    209	 */
    210
    211	if (len < ARRAY_SIZE(report))
    212		return -ENOSPC;
    213
    214	status = ssam_kbd_get_feature_report(shid, report, ARRAY_SIZE(report));
    215	if (status < 0)
    216		return status;
    217
    218	if (rprt_id != report[0])
    219		return -ENOENT;
    220
    221	memcpy(buf, report, ARRAY_SIZE(report));
    222	return len;
    223}
    224
    225static int skbd_set_feature_report(struct surface_hid_device *shid, u8 rprt_id, u8 *buf, size_t len)
    226{
    227	/* Not supported. See skbd_get_feature_report() for details. */
    228	return -EIO;
    229}
    230
    231
    232/* -- Driver setup. --------------------------------------------------------- */
    233
    234static int surface_kbd_probe(struct platform_device *pdev)
    235{
    236	struct ssam_controller *ctrl;
    237	struct surface_hid_device *shid;
    238
    239	/* Add device link to EC. */
    240	ctrl = ssam_client_bind(&pdev->dev);
    241	if (IS_ERR(ctrl))
    242		return PTR_ERR(ctrl) == -ENODEV ? -EPROBE_DEFER : PTR_ERR(ctrl);
    243
    244	shid = devm_kzalloc(&pdev->dev, sizeof(*shid), GFP_KERNEL);
    245	if (!shid)
    246		return -ENOMEM;
    247
    248	shid->dev = &pdev->dev;
    249	shid->ctrl = ctrl;
    250
    251	shid->uid.domain = SSAM_DOMAIN_SERIALHUB;
    252	shid->uid.category = SSAM_SSH_TC_KBD;
    253	shid->uid.target = 2;
    254	shid->uid.instance = 0;
    255	shid->uid.function = 0;
    256
    257	shid->notif.base.priority = 1;
    258	shid->notif.base.fn = ssam_kbd_event_fn;
    259	shid->notif.event.reg = SSAM_EVENT_REGISTRY_SAM;
    260	shid->notif.event.id.target_category = shid->uid.category;
    261	shid->notif.event.id.instance = shid->uid.instance;
    262	shid->notif.event.mask = SSAM_EVENT_MASK_NONE;
    263	shid->notif.event.flags = 0;
    264
    265	shid->ops.get_descriptor = ssam_kbd_get_descriptor;
    266	shid->ops.output_report = skbd_output_report;
    267	shid->ops.get_feature_report = skbd_get_feature_report;
    268	shid->ops.set_feature_report = skbd_set_feature_report;
    269
    270	platform_set_drvdata(pdev, shid);
    271	return surface_hid_device_add(shid);
    272}
    273
    274static int surface_kbd_remove(struct platform_device *pdev)
    275{
    276	surface_hid_device_destroy(platform_get_drvdata(pdev));
    277	return 0;
    278}
    279
    280static const struct acpi_device_id surface_kbd_match[] = {
    281	{ "MSHW0096" },
    282	{ },
    283};
    284MODULE_DEVICE_TABLE(acpi, surface_kbd_match);
    285
    286static struct platform_driver surface_kbd_driver = {
    287	.probe = surface_kbd_probe,
    288	.remove = surface_kbd_remove,
    289	.driver = {
    290		.name = "surface_keyboard",
    291		.acpi_match_table = surface_kbd_match,
    292		.pm = &surface_hid_pm_ops,
    293		.probe_type = PROBE_PREFER_ASYNCHRONOUS,
    294	},
    295};
    296module_platform_driver(surface_kbd_driver);
    297
    298MODULE_AUTHOR("Maximilian Luz <luzmaximilian@gmail.com>");
    299MODULE_DESCRIPTION("HID legacy transport driver for Surface System Aggregator Module");
    300MODULE_LICENSE("GPL");