| 578e1b96 | 12-May-2025 |
Rong Zhang <i@rong.moe> |
HID: bpf: abort dispatch if device destroyed
The current HID bpf implementation assumes no output report/request will
go through it after hid_bpf_destroy_device() has been called. This leads
to a bu
HID: bpf: abort dispatch if device destroyed
The current HID bpf implementation assumes no output report/request will
go through it after hid_bpf_destroy_device() has been called. This leads
to a bug that unplugging certain types of HID devices causes a cleaned-
up SRCU to be accessed. The bug was previously a hidden failure until a
recent x86 percpu change [1] made it access not-present pages.
The bug will be triggered if the conditions below are met:
A) a device under the driver has some LEDs on
B) hid_ll_driver->request() is uninplemented (e.g., logitech-djreceiver)
If condition A is met, hidinput_led_worker() is always scheduled *after*
hid_bpf_destroy_device().
hid_destroy_device
` hid_bpf_destroy_device
` cleanup_srcu_struct(&hdev->bpf.srcu)
` hid_remove_device
` ...
` led_classdev_unregister
` led_trigger_set(led_cdev, NULL)
` led_set_brightness(led_cdev, LED_OFF)
` ...
` input_inject_event
` input_event_dispose
` hidinput_input_event
` schedule_work(&hid->led_work) [hidinput_led_worker]
This is fine when condition B is not met, where hidinput_led_worker()
calls hid_ll_driver->request(). This is the case for most HID drivers,
which implement it or use the generic one from usbhid. The driver itself
or an underlying driver will then abort processing the request.
Otherwise, hidinput_led_worker() tries hid_hw_output_report() and leads
to the bug.
hidinput_led_worker
` hid_hw_output_report
` dispatch_hid_bpf_output_report
` srcu_read_lock(&hdev->bpf.srcu)
` srcu_read_unlock(&hdev->bpf.srcu, idx)
The bug has existed since the introduction [2] of
dispatch_hid_bpf_output_report(). However, the same bug also exists in
dispatch_hid_bpf_raw_requests(), and I've reproduced (no visible effect
because of the lack of [1], but confirmed bpf.destroyed == 1) the bug
against the commit (i.e., the Fixes:) introducing the function. This is
because hidinput_led_worker() falls back to hid_hw_raw_request() when
hid_ll_driver->output_report() is uninplemented (e.g., logitech-
djreceiver).
hidinput_led_worker
` hid_hw_output_report: -ENOSYS
` hid_hw_raw_request
` dispatch_hid_bpf_raw_requests
` srcu_read_lock(&hdev->bpf.srcu)
` srcu_read_unlock(&hdev->bpf.srcu, idx)
Fix the issue by returning early in the two mentioned functions if
hid_bpf has been marked as destroyed. Though
dispatch_hid_bpf_device_event() handles input events, and there is no
evidence that it may be called after the destruction, the same check, as
a safety net, is also added to it to maintain the consistency among all
dispatch functions.
The impact of the bug on other architectures is unclear. Even if it acts
as a hidden failure, this is still dangerous because it corrupts
whatever is on the address calculated by SRCU. Thus, CC'ing the stable
list.
[1]: commit 9d7de2aa8b41 ("x86/percpu/64: Use relative percpu offsets")
[2]: commit 9286675a2aed ("HID: bpf: add HID-BPF hooks for
hid_hw_output_report")
Closes: https://lore.kernel.org/all/20250506145548.GGaBoi9Jzp3aeJizTR@fat_crate.local/
Fixes: 8bd0488b5ea5 ("HID: bpf: add HID-BPF hooks for hid_hw_raw_requests")
Cc: stable@vger.kernel.org
Signed-off-by: Rong Zhang <i@rong.moe>
Tested-by: Petr Tesarik <petr@tesarici.cz>
Link: https://patch.msgid.link/20250512152420.87441-1-i@rong.moe
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 834da375 | 07-Feb-2025 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: add a v6.11+ compatible BPF fixup for the XPPen ACK05 remote
With v6.11+, we can actually call hid_hw_output_report() and put the device
into raw mode, thus getting accurate events without
HID: bpf: add a v6.11+ compatible BPF fixup for the XPPen ACK05 remote
With v6.11+, we can actually call hid_hw_output_report() and put the device
into raw mode, thus getting accurate events without being messed up.
Technically we could do the same on v6.10, but given that wayland, gnome
and KDE are still not capable of handling the dial, and that v6.10 is EOL,
we can safely save a little bit of compilation by only allowing v6.11+.
We can easily export the battery information to userspace by adding a
dedicated report. However, we need to cheat on the kernel to force it
not to query the battery by making the physical collection a stylus. The
kernel will then only rely on the events it gets from the device.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/133
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-7-6048fdd5a206@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 4a94deb9 | 07-Feb-2025 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: new hid_bpf_async.h common header
The purpose is to simplify the use of bpf_wq to defer blocking
operations in a sleepable context. Compared to a more "classic"
async approach, there is no
HID: bpf: new hid_bpf_async.h common header
The purpose is to simplify the use of bpf_wq to defer blocking
operations in a sleepable context. Compared to a more "classic"
async approach, there is no sync mechanism to wait for the async
to finish.
The "simple" API is the following:
```
static int HID_BPF_ASYNC(async_fun)(struct hid_bpf_ctx *hctx)
{
bpf_printk("%s", __fun__);
return 0;
}
SEC("syscall")
int probe(struct hid_bpf_probe_args *ctx)
{
ctx->retval = HID_BPF_ASYNC_INIT(async_fun);
return 0;
}
SEC(HID_BPF_DEVICE_EVENT)
int BPF_PROG(event_handler, struct hid_bpf_ctx *hctx)
{
/* async_fun() can be called now, it's not a sleepable
* function in this example
*/
async_fun(hctx);
/* but we can also delay the call by 10 ms */
HID_BPF_ASYNC_DELAYED_CALL(async_fun, hctx, 10);
return 0;
}
HID_BPF_OPS(xppen_ack05_remote) = {
.hid_device_event = (void *)event_handler,
};
```
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/133
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-6-6048fdd5a206@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 91bb3115 | 07-Feb-2025 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: import new kfunc from v6.10 & v6.11
These kfunc are all in v6.10 except for the hid_bpf_try_input_report()
which will be in v6.11. Import their definition once now so we can make
use of it
HID: bpf: import new kfunc from v6.10 & v6.11
These kfunc are all in v6.10 except for the hid_bpf_try_input_report()
which will be in v6.11. Import their definition once now so we can make
use of it.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/114
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-5-6048fdd5a206@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 4be93352 | 07-Feb-2025 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: add support for the XP-Pen Artist Pro 19 (gen2)
The device behaves the same than the 16" and 14" models, so let's just
add support for it too.
Link: https://gitlab.freedesktop.org/libevde
HID: bpf: add support for the XP-Pen Artist Pro 19 (gen2)
The device behaves the same than the 16" and 14" models, so let's just
add support for it too.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/145
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-4-6048fdd5a206@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 531a1cc6 | 07-Feb-2025 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: Added updated Kamvas Pro 19 descriptor
This adds an updated HID descriptor for the Huion Kamvas Pro 19 that is
present on newer firmware revisions, while also trying to keep
compat with th
HID: bpf: Added updated Kamvas Pro 19 descriptor
This adds an updated HID descriptor for the Huion Kamvas Pro 19 that is
present on newer firmware revisions, while also trying to keep
compat with the older versions.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/164
Signed-off-by: Aki Van Ness <aki@lethalbit.net>
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-3-6048fdd5a206@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 43db1911 | 07-Feb-2025 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: Suppress bogus F13 trigger on Sirius keyboard full fan shortcut
The TUXEDO Sirius 16 Gen1 and the TUXEDO Sirius 16 Gen2 Notebooks have an
additional "fan" key next to F12.
Pressing it alo
HID: bpf: Suppress bogus F13 trigger on Sirius keyboard full fan shortcut
The TUXEDO Sirius 16 Gen1 and the TUXEDO Sirius 16 Gen2 Notebooks have an
additional "fan" key next to F12.
Pressing it alone sends a F14 key press which can be bound by user space.
Pressing it while holding the FN key triggers two things:
- The EC firmware locks the fan speed of the internal fans at 100%
- F13 key press is registered which by default is already bound in xkb and
desktop environments (e.g. in KDE Plasma it launches system settings)
To avoid this unexpected double duty of the FN shortcut, this bpf program
suppresses the F13 key press.
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/166
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-2-6048fdd5a206@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 0b1b0c11 | 27-Nov-2024 |
Thomas Weißschuh <linux@weissschuh.net> |
HID: bpf: drop unneeded casts discarding const
In commit 33c0fb85b571 ("HID: bpf: make part of struct hid_device writable")
the const qualifier was dropped from struct hid_bpf_ctx::hid.
The casts ar
HID: bpf: drop unneeded casts discarding const
In commit 33c0fb85b571 ("HID: bpf: make part of struct hid_device writable")
the const qualifier was dropped from struct hid_bpf_ctx::hid.
The casts are now unnecessary.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20241127-hid-bpf-cast-v1-1-f26424960e84@weissschuh.net
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| b6d8c474 | 17-Oct-2024 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: drop use of Logical|Physical|UsageRange
Replace with individual Minimum/Maximum calls to match the HID report
descriptor - HID doesn't have a Range field. Abstracting this is good
for hand
HID: bpf: drop use of Logical|Physical|UsageRange
Replace with individual Minimum/Maximum calls to match the HID report
descriptor - HID doesn't have a Range field. Abstracting this is good
for hand-written descriptors but almost all tools will output min/max
instead so let's stick with that.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20241017-import_bpf_6-13-v2-3-6a7acb89a97f@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| cee9faff | 17-Oct-2024 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: Fix Rapoo M50 Plus Silent side buttons
The Rapoo M50 Plus Silent mouse has 2 side buttons in addition to the
left, right and middles buttons. However, its original HID descriptor
has a Usa
HID: bpf: Fix Rapoo M50 Plus Silent side buttons
The Rapoo M50 Plus Silent mouse has 2 side buttons in addition to the
left, right and middles buttons. However, its original HID descriptor
has a Usage Maximum of 3, preventing the side buttons to work.
This HID-BPF driver changes that usage to 5.
Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/1015
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/116
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20241017-import_bpf_6-13-v2-2-6a7acb89a97f@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 9bc08930 | 17-Oct-2024 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: Fix NKRO on Mistel MD770
Mistel MD770 keyboard (using Holtek Semiconductor, Inc. controller) has
a quirk in report descriptor in one of its interfaces (more detail in
the source file). Fix
HID: bpf: Fix NKRO on Mistel MD770
Mistel MD770 keyboard (using Holtek Semiconductor, Inc. controller) has
a quirk in report descriptor in one of its interfaces (more detail in
the source file). Fix up the descriptor to allow NKRO to work again.
Tested by loading the BPF program and confirming that 8 simultaneous
keypresses work.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218495
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/122
Signed-off-by: Tatsuyuki Ishi <ishitatsuyuki@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20241017-import_bpf_6-13-v2-1-6a7acb89a97f@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 6fd47eff | 01-Oct-2024 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: allow write access to quirks field in struct hid_device
This allows to give more control from BPF during report descriptor fixup.
We already reset the quirks before calling ->probe(), so n
HID: bpf: allow write access to quirks field in struct hid_device
This allows to give more control from BPF during report descriptor fixup.
We already reset the quirks before calling ->probe(), so now we reset
it once before calling hid_bpf_rdesc_fixup().
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Link: https://patch.msgid.link/20241001-hid-bpf-hid-generic-v3-4-2ef1019468df@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| acd34cfc | 23-Jul-2024 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: prevent the same struct_ops to be attached more than once
If the struct_ops is already attached, we should bail out or we will
end up in various locks and pointer issues while unregisterin
HID: bpf: prevent the same struct_ops to be attached more than once
If the struct_ops is already attached, we should bail out or we will
end up in various locks and pointer issues while unregistering.
Link: https://patch.msgid.link/20240723-fix-6-11-bpf-v1-3-b9d770346784@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| bacc15e0 | 19-Jul-2024 |
Arnd Bergmann <arnd@arndb.de> |
hid: bpf: add BPF_JIT dependency
The module does not do anything when the JIT is disabled, but instead
causes a warning:
In file included from include/linux/bpf_verifier.h:7,
from
hid: bpf: add BPF_JIT dependency
The module does not do anything when the JIT is disabled, but instead
causes a warning:
In file included from include/linux/bpf_verifier.h:7,
from drivers/hid/bpf/hid_bpf_struct_ops.c:10:
drivers/hid/bpf/hid_bpf_struct_ops.c: In function 'hid_bpf_struct_ops_init':
include/linux/bpf.h:1853:50: error: statement with no effect [-Werror=unused-value]
1853 | #define register_bpf_struct_ops(st_ops, type) ({ (void *)(st_ops); 0; })
| ^~~~~~~~~~~~~~~~
drivers/hid/bpf/hid_bpf_struct_ops.c:305:16: note: in expansion of macro 'register_bpf_struct_ops'
305 | return register_bpf_struct_ops(&bpf_hid_bpf_ops, hid_bpf_ops);
| ^~~~~~~~~~~~~~~~~~~~~~~
Add a Kconfig dependency to only allow building the HID-BPF support
when a JIT is enabled.
Fixes: ebc0d8093e8c ("HID: bpf: implement HID-BPF through bpf_struct_ops")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/96a00b6f-eb81-4c67-8c4b-6b1f3f045034@app.fastmail.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| f58e7f40 | 27-Jun-2024 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: Thrustmaster TCA Yoke Boeing joystick fix
This joystick's original HID descriptor is wrong & it shows a
ABS_MISC axis in Linux that doesn't exist on the hardware.
Link: https://gitlab.fre
HID: bpf: Thrustmaster TCA Yoke Boeing joystick fix
This joystick's original HID descriptor is wrong & it shows a
ABS_MISC axis in Linux that doesn't exist on the hardware.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/82
Signed-off-by: K S Iyer <kumar.s.iyer65@gmail.com>
Link: https://patch.msgid.link/20240627-import-bpf-v1-6-0dbcda4a5b1f@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 9b52d811 | 27-Jun-2024 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: Add Huion Dial 2 bpf fixup
Pretty much similar to the Inspiroy 2, but with 2 wheels and 8 buttons.
This bpf also works in both normal and vendor mode. If the device is
switched into vendo
HID: bpf: Add Huion Dial 2 bpf fixup
Pretty much similar to the Inspiroy 2, but with 2 wheels and 8 buttons.
This bpf also works in both normal and vendor mode. If the device is
switched into vendor mode by huion-switcher, a udev property is set
which is then retrieved by this bpf object. This allows to hide the now
unused normal collections.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/103
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/104
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/111
Link: https://patch.msgid.link/20240627-import-bpf-v1-5-0dbcda4a5b1f@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| f0374154 | 27-Jun-2024 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: Add support for the XP-PEN Deco Mini 4
The XP-PEN Deco Mini 4 is a UGEE device with a frame with 6 buttons.
Its pen has 2 buttons and supports pressure reporting.
Fix their report descrip
HID: bpf: Add support for the XP-PEN Deco Mini 4
The XP-PEN Deco Mini 4 is a UGEE device with a frame with 6 buttons.
Its pen has 2 buttons and supports pressure reporting.
Fix their report descriptors and transform the frame button events to
support it.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/88
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Link: https://patch.msgid.link/20240627-import-bpf-v1-4-0dbcda4a5b1f@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|