327 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2 3/*4 * HID-BPF support for Linux5 *6 * Copyright (c) 2024 Benjamin Tissoires7 */8 9#include <linux/bitops.h>10#include <linux/bpf_verifier.h>11#include <linux/bpf.h>12#include <linux/btf.h>13#include <linux/btf_ids.h>14#include <linux/filter.h>15#include <linux/hid.h>16#include <linux/hid_bpf.h>17#include <linux/init.h>18#include <linux/module.h>19#include <linux/stddef.h>20#include <linux/workqueue.h>21#include "hid_bpf_dispatch.h"22 23static struct btf *hid_bpf_ops_btf;24 25static int hid_bpf_ops_init(struct btf *btf)26{27 hid_bpf_ops_btf = btf;28 return 0;29}30 31static bool hid_bpf_ops_is_valid_access(int off, int size,32 enum bpf_access_type type,33 const struct bpf_prog *prog,34 struct bpf_insn_access_aux *info)35{36 return bpf_tracing_btf_ctx_access(off, size, type, prog, info);37}38 39static int hid_bpf_ops_check_member(const struct btf_type *t,40 const struct btf_member *member,41 const struct bpf_prog *prog)42{43 u32 moff = __btf_member_bit_offset(t, member) / 8;44 45 switch (moff) {46 case offsetof(struct hid_bpf_ops, hid_rdesc_fixup):47 case offsetof(struct hid_bpf_ops, hid_hw_request):48 case offsetof(struct hid_bpf_ops, hid_hw_output_report):49 break;50 default:51 if (prog->sleepable)52 return -EINVAL;53 }54 55 return 0;56}57 58struct hid_bpf_offset_write_range {59 const char *struct_name;60 u32 struct_length;61 u32 start;62 u32 end;63};64 65static int hid_bpf_ops_btf_struct_access(struct bpf_verifier_log *log,66 const struct bpf_reg_state *reg,67 int off, int size)68{69#define WRITE_RANGE(_name, _field, _is_string) \70 { \71 .struct_name = #_name, \72 .struct_length = sizeof(struct _name), \73 .start = offsetof(struct _name, _field), \74 .end = offsetofend(struct _name, _field) - !!(_is_string), \75 }76 77 const struct hid_bpf_offset_write_range write_ranges[] = {78 WRITE_RANGE(hid_bpf_ctx, retval, false),79 WRITE_RANGE(hid_device, name, true),80 WRITE_RANGE(hid_device, uniq, true),81 WRITE_RANGE(hid_device, phys, true),82 };83#undef WRITE_RANGE84 const struct btf_type *state = NULL;85 const struct btf_type *t;86 const char *cur = NULL;87 int i;88 89 t = btf_type_by_id(reg->btf, reg->btf_id);90 91 for (i = 0; i < ARRAY_SIZE(write_ranges); i++) {92 const struct hid_bpf_offset_write_range *write_range = &write_ranges[i];93 s32 type_id;94 95 /* we already found a writeable struct, but there is a96 * new one, let's break the loop.97 */98 if (t == state && write_range->struct_name != cur)99 break;100 101 /* new struct to look for */102 if (write_range->struct_name != cur) {103 type_id = btf_find_by_name_kind(reg->btf, write_range->struct_name,104 BTF_KIND_STRUCT);105 if (type_id < 0)106 return -EINVAL;107 108 state = btf_type_by_id(reg->btf, type_id);109 }110 111 /* this is not the struct we are looking for */112 if (t != state) {113 cur = write_range->struct_name;114 continue;115 }116 117 /* first time we see this struct, check for out of bounds */118 if (cur != write_range->struct_name &&119 off + size > write_range->struct_length) {120 bpf_log(log, "write access for struct %s at off %d with size %d\n",121 write_range->struct_name, off, size);122 return -EACCES;123 }124 125 /* now check if we are in our boundaries */126 if (off >= write_range->start && off + size <= write_range->end)127 return NOT_INIT;128 129 cur = write_range->struct_name;130 }131 132 133 if (t != state)134 bpf_log(log, "write access to this struct is not supported\n");135 else136 bpf_log(log,137 "write access at off %d with size %d on read-only part of %s\n",138 off, size, cur);139 140 return -EACCES;141}142 143static const struct bpf_verifier_ops hid_bpf_verifier_ops = {144 .get_func_proto = bpf_base_func_proto,145 .is_valid_access = hid_bpf_ops_is_valid_access,146 .btf_struct_access = hid_bpf_ops_btf_struct_access,147};148 149static int hid_bpf_ops_init_member(const struct btf_type *t,150 const struct btf_member *member,151 void *kdata, const void *udata)152{153 const struct hid_bpf_ops *uhid_bpf_ops;154 struct hid_bpf_ops *khid_bpf_ops;155 u32 moff;156 157 uhid_bpf_ops = (const struct hid_bpf_ops *)udata;158 khid_bpf_ops = (struct hid_bpf_ops *)kdata;159 160 moff = __btf_member_bit_offset(t, member) / 8;161 162 switch (moff) {163 case offsetof(struct hid_bpf_ops, hid_id):164 /* For hid_id and flags fields, this function has to copy it165 * and return 1 to indicate that the data has been handled by166 * the struct_ops type, or the verifier will reject the map if167 * the value of those fields is not zero.168 */169 khid_bpf_ops->hid_id = uhid_bpf_ops->hid_id;170 return 1;171 case offsetof(struct hid_bpf_ops, flags):172 if (uhid_bpf_ops->flags & ~BPF_F_BEFORE)173 return -EINVAL;174 khid_bpf_ops->flags = uhid_bpf_ops->flags;175 return 1;176 }177 return 0;178}179 180static int hid_bpf_reg(void *kdata, struct bpf_link *link)181{182 struct hid_bpf_ops *ops = kdata;183 struct hid_device *hdev;184 int count, err = 0;185 186 /* prevent multiple attach of the same struct_ops */187 if (ops->hdev)188 return -EINVAL;189 190 hdev = hid_get_device(ops->hid_id);191 if (IS_ERR(hdev))192 return PTR_ERR(hdev);193 194 ops->hdev = hdev;195 196 mutex_lock(&hdev->bpf.prog_list_lock);197 198 count = list_count_nodes(&hdev->bpf.prog_list);199 if (count >= HID_BPF_MAX_PROGS_PER_DEV) {200 err = -E2BIG;201 goto out_unlock;202 }203 204 if (ops->hid_rdesc_fixup) {205 if (hdev->bpf.rdesc_ops) {206 err = -EINVAL;207 goto out_unlock;208 }209 210 hdev->bpf.rdesc_ops = ops;211 }212 213 if (ops->hid_device_event) {214 err = hid_bpf_allocate_event_data(hdev);215 if (err)216 goto out_unlock;217 }218 219 if (ops->flags & BPF_F_BEFORE)220 list_add_rcu(&ops->list, &hdev->bpf.prog_list);221 else222 list_add_tail_rcu(&ops->list, &hdev->bpf.prog_list);223 synchronize_srcu(&hdev->bpf.srcu);224 225out_unlock:226 mutex_unlock(&hdev->bpf.prog_list_lock);227 228 if (err) {229 if (hdev->bpf.rdesc_ops == ops)230 hdev->bpf.rdesc_ops = NULL;231 hid_put_device(hdev);232 } else if (ops->hid_rdesc_fixup) {233 hid_bpf_reconnect(hdev);234 }235 236 return err;237}238 239static void hid_bpf_unreg(void *kdata, struct bpf_link *link)240{241 struct hid_bpf_ops *ops = kdata;242 struct hid_device *hdev;243 bool reconnect = false;244 245 hdev = ops->hdev;246 247 /* check if __hid_bpf_ops_destroy_device() has been called */248 if (!hdev)249 return;250 251 mutex_lock(&hdev->bpf.prog_list_lock);252 253 list_del_rcu(&ops->list);254 synchronize_srcu(&hdev->bpf.srcu);255 ops->hdev = NULL;256 257 reconnect = hdev->bpf.rdesc_ops == ops;258 if (reconnect)259 hdev->bpf.rdesc_ops = NULL;260 261 mutex_unlock(&hdev->bpf.prog_list_lock);262 263 if (reconnect)264 hid_bpf_reconnect(hdev);265 266 hid_put_device(hdev);267}268 269static int __hid_bpf_device_event(struct hid_bpf_ctx *ctx, enum hid_report_type type, u64 source)270{271 return 0;272}273 274static int __hid_bpf_rdesc_fixup(struct hid_bpf_ctx *ctx)275{276 return 0;277}278 279static int __hid_bpf_hw_request(struct hid_bpf_ctx *ctx, unsigned char reportnum,280 enum hid_report_type rtype, enum hid_class_request reqtype,281 u64 source)282{283 return 0;284}285 286static int __hid_bpf_hw_output_report(struct hid_bpf_ctx *ctx, u64 source)287{288 return 0;289}290 291static struct hid_bpf_ops __bpf_hid_bpf_ops = {292 .hid_device_event = __hid_bpf_device_event,293 .hid_rdesc_fixup = __hid_bpf_rdesc_fixup,294 .hid_hw_request = __hid_bpf_hw_request,295 .hid_hw_output_report = __hid_bpf_hw_output_report,296};297 298static struct bpf_struct_ops bpf_hid_bpf_ops = {299 .verifier_ops = &hid_bpf_verifier_ops,300 .init = hid_bpf_ops_init,301 .check_member = hid_bpf_ops_check_member,302 .init_member = hid_bpf_ops_init_member,303 .reg = hid_bpf_reg,304 .unreg = hid_bpf_unreg,305 .name = "hid_bpf_ops",306 .cfi_stubs = &__bpf_hid_bpf_ops,307 .owner = THIS_MODULE,308};309 310void __hid_bpf_ops_destroy_device(struct hid_device *hdev)311{312 struct hid_bpf_ops *e;313 314 rcu_read_lock();315 list_for_each_entry_rcu(e, &hdev->bpf.prog_list, list) {316 hid_put_device(hdev);317 e->hdev = NULL;318 }319 rcu_read_unlock();320}321 322static int __init hid_bpf_struct_ops_init(void)323{324 return register_bpf_struct_ops(&bpf_hid_bpf_ops, hid_bpf_ops);325}326late_initcall(hid_bpf_struct_ops_init);327