1 // SPDX-License-Identifier: GPL-2.0-only 2 3 /* 4 * HID-BPF support for Linux 5 * 6 * Copyright (c) 2022-2024 Benjamin Tissoires 7 */ 8 9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 10 #include <linux/bitops.h> 11 #include <linux/btf.h> 12 #include <linux/btf_ids.h> 13 #include <linux/filter.h> 14 #include <linux/hid.h> 15 #include <linux/hid_bpf.h> 16 #include <linux/init.h> 17 #include <linux/kfifo.h> 18 #include <linux/minmax.h> 19 #include <linux/module.h> 20 #include "hid_bpf_dispatch.h" 21 22 struct hid_ops *hid_ops; 23 EXPORT_SYMBOL(hid_ops); 24 25 u8 * 26 dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type, u8 *data, 27 u32 *size, int interrupt, u64 source, bool from_bpf) 28 { 29 struct hid_bpf_ctx_kern ctx_kern = { 30 .ctx = { 31 .hid = hdev, 32 .allocated_size = hdev->bpf.allocated_data, 33 .size = *size, 34 }, 35 .data = hdev->bpf.device_data, 36 .from_bpf = from_bpf, 37 }; 38 struct hid_bpf_ops *e; 39 int ret; 40 41 if (type >= HID_REPORT_TYPES) 42 return ERR_PTR(-EINVAL); 43 44 /* no program has been attached yet */ 45 if (!hdev->bpf.device_data) 46 return data; 47 48 memset(ctx_kern.data, 0, hdev->bpf.allocated_data); 49 memcpy(ctx_kern.data, data, *size); 50 51 rcu_read_lock(); 52 list_for_each_entry_rcu(e, &hdev->bpf.prog_list, list) { 53 if (e->hid_device_event) { 54 ret = e->hid_device_event(&ctx_kern.ctx, type, source); 55 if (ret < 0) { 56 rcu_read_unlock(); 57 return ERR_PTR(ret); 58 } 59 60 if (ret) 61 ctx_kern.ctx.size = ret; 62 } 63 } 64 rcu_read_unlock(); 65 66 ret = ctx_kern.ctx.size; 67 if (ret) { 68 if (ret > ctx_kern.ctx.allocated_size) 69 return ERR_PTR(-EINVAL); 70 71 *size = ret; 72 } 73 74 return ctx_kern.data; 75 } 76 EXPORT_SYMBOL_GPL(dispatch_hid_bpf_device_event); 77 78 int dispatch_hid_bpf_raw_requests(struct hid_device *hdev, 79 unsigned char reportnum, u8 *buf, 80 u32 size, enum hid_report_type rtype, 81 enum hid_class_request reqtype, 82 u64 source, bool from_bpf) 83 { 84 struct hid_bpf_ctx_kern ctx_kern = { 85 .ctx = { 86 .hid = hdev, 87 .allocated_size = size, 88 .size = size, 89 }, 90 .data = buf, 91 .from_bpf = from_bpf, 92 }; 93 struct hid_bpf_ops *e; 94 int ret, idx; 95 96 if (rtype >= HID_REPORT_TYPES) 97 return -EINVAL; 98 99 idx = srcu_read_lock(&hdev->bpf.srcu); 100 list_for_each_entry_srcu(e, &hdev->bpf.prog_list, list, 101 srcu_read_lock_held(&hdev->bpf.srcu)) { 102 if (!e->hid_hw_request) 103 continue; 104 105 ret = e->hid_hw_request(&ctx_kern.ctx, reportnum, rtype, reqtype, source); 106 if (ret) 107 goto out; 108 } 109 ret = 0; 110 111 out: 112 srcu_read_unlock(&hdev->bpf.srcu, idx); 113 return ret; 114 } 115 EXPORT_SYMBOL_GPL(dispatch_hid_bpf_raw_requests); 116 117 int dispatch_hid_bpf_output_report(struct hid_device *hdev, 118 __u8 *buf, u32 size, u64 source, 119 bool from_bpf) 120 { 121 struct hid_bpf_ctx_kern ctx_kern = { 122 .ctx = { 123 .hid = hdev, 124 .allocated_size = size, 125 .size = size, 126 }, 127 .data = buf, 128 .from_bpf = from_bpf, 129 }; 130 struct hid_bpf_ops *e; 131 int ret, idx; 132 133 idx = srcu_read_lock(&hdev->bpf.srcu); 134 list_for_each_entry_srcu(e, &hdev->bpf.prog_list, list, 135 srcu_read_lock_held(&hdev->bpf.srcu)) { 136 if (!e->hid_hw_output_report) 137 continue; 138 139 ret = e->hid_hw_output_report(&ctx_kern.ctx, source); 140 if (ret) 141 goto out; 142 } 143 ret = 0; 144 145 out: 146 srcu_read_unlock(&hdev->bpf.srcu, idx); 147 return ret; 148 } 149 EXPORT_SYMBOL_GPL(dispatch_hid_bpf_output_report); 150 151 const u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, const u8 *rdesc, unsigned int *size) 152 { 153 int ret; 154 struct hid_bpf_ctx_kern ctx_kern = { 155 .ctx = { 156 .hid = hdev, 157 .size = *size, 158 .allocated_size = HID_MAX_DESCRIPTOR_SIZE, 159 }, 160 }; 161 162 if (!hdev->bpf.rdesc_ops) 163 goto ignore_bpf; 164 165 ctx_kern.data = kzalloc(ctx_kern.ctx.allocated_size, GFP_KERNEL); 166 if (!ctx_kern.data) 167 goto ignore_bpf; 168 169 memcpy(ctx_kern.data, rdesc, min_t(unsigned int, *size, HID_MAX_DESCRIPTOR_SIZE)); 170 171 ret = hdev->bpf.rdesc_ops->hid_rdesc_fixup(&ctx_kern.ctx); 172 if (ret < 0) 173 goto ignore_bpf; 174 175 if (ret) { 176 if (ret > ctx_kern.ctx.allocated_size) 177 goto ignore_bpf; 178 179 *size = ret; 180 } 181 182 return krealloc(ctx_kern.data, *size, GFP_KERNEL); 183 184 ignore_bpf: 185 kfree(ctx_kern.data); 186 return rdesc; 187 } 188 EXPORT_SYMBOL_GPL(call_hid_bpf_rdesc_fixup); 189 190 static int device_match_id(struct device *dev, const void *id) 191 { 192 struct hid_device *hdev = to_hid_device(dev); 193 194 return hdev->id == *(int *)id; 195 } 196 197 struct hid_device *hid_get_device(unsigned int hid_id) 198 { 199 struct device *dev; 200 201 if (!hid_ops) 202 return ERR_PTR(-EINVAL); 203 204 dev = bus_find_device(hid_ops->bus_type, NULL, &hid_id, device_match_id); 205 if (!dev) 206 return ERR_PTR(-EINVAL); 207 208 return to_hid_device(dev); 209 } 210 211 void hid_put_device(struct hid_device *hid) 212 { 213 put_device(&hid->dev); 214 } 215 216 static int __hid_bpf_allocate_data(struct hid_device *hdev, u8 **data, u32 *size) 217 { 218 u8 *alloc_data; 219 unsigned int i, j, max_report_len = 0; 220 size_t alloc_size = 0; 221 222 /* compute the maximum report length for this device */ 223 for (i = 0; i < HID_REPORT_TYPES; i++) { 224 struct hid_report_enum *report_enum = hdev->report_enum + i; 225 226 for (j = 0; j < HID_MAX_IDS; j++) { 227 struct hid_report *report = report_enum->report_id_hash[j]; 228 229 if (report) 230 max_report_len = max(max_report_len, hid_report_len(report)); 231 } 232 } 233 234 /* 235 * Give us a little bit of extra space and some predictability in the 236 * buffer length we create. This way, we can tell users that they can 237 * work on chunks of 64 bytes of memory without having the bpf verifier 238 * scream at them. 239 */ 240 alloc_size = DIV_ROUND_UP(max_report_len, 64) * 64; 241 242 alloc_data = kzalloc(alloc_size, GFP_KERNEL); 243 if (!alloc_data) 244 return -ENOMEM; 245 246 *data = alloc_data; 247 *size = alloc_size; 248 249 return 0; 250 } 251 252 int hid_bpf_allocate_event_data(struct hid_device *hdev) 253 { 254 /* hdev->bpf.device_data is already allocated, abort */ 255 if (hdev->bpf.device_data) 256 return 0; 257 258 return __hid_bpf_allocate_data(hdev, &hdev->bpf.device_data, &hdev->bpf.allocated_data); 259 } 260 261 int hid_bpf_reconnect(struct hid_device *hdev) 262 { 263 if (!test_and_set_bit(ffs(HID_STAT_REPROBED), &hdev->status)) { 264 /* trigger call to call_hid_bpf_rdesc_fixup() during the next probe */ 265 hdev->bpf_rsize = 0; 266 return device_reprobe(&hdev->dev); 267 } 268 269 return 0; 270 } 271 272 /* Disables missing prototype warnings */ 273 __bpf_kfunc_start_defs(); 274 275 /** 276 * hid_bpf_get_data - Get the kernel memory pointer associated with the context @ctx 277 * 278 * @ctx: The HID-BPF context 279 * @offset: The offset within the memory 280 * @rdwr_buf_size: the const size of the buffer 281 * 282 * @returns %NULL on error, an %__u8 memory pointer on success 283 */ 284 __bpf_kfunc __u8 * 285 hid_bpf_get_data(struct hid_bpf_ctx *ctx, unsigned int offset, const size_t rdwr_buf_size) 286 { 287 struct hid_bpf_ctx_kern *ctx_kern; 288 289 if (!ctx) 290 return NULL; 291 292 ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx); 293 294 if (rdwr_buf_size + offset > ctx->allocated_size) 295 return NULL; 296 297 return ctx_kern->data + offset; 298 } 299 300 /** 301 * hid_bpf_allocate_context - Allocate a context to the given HID device 302 * 303 * @hid_id: the system unique identifier of the HID device 304 * 305 * @returns A pointer to &struct hid_bpf_ctx on success, %NULL on error. 306 */ 307 __bpf_kfunc struct hid_bpf_ctx * 308 hid_bpf_allocate_context(unsigned int hid_id) 309 { 310 struct hid_device *hdev; 311 struct hid_bpf_ctx_kern *ctx_kern = NULL; 312 313 hdev = hid_get_device(hid_id); 314 if (IS_ERR(hdev)) 315 return NULL; 316 317 ctx_kern = kzalloc(sizeof(*ctx_kern), GFP_KERNEL); 318 if (!ctx_kern) { 319 hid_put_device(hdev); 320 return NULL; 321 } 322 323 ctx_kern->ctx.hid = hdev; 324 325 return &ctx_kern->ctx; 326 } 327 328 /** 329 * hid_bpf_release_context - Release the previously allocated context @ctx 330 * 331 * @ctx: the HID-BPF context to release 332 * 333 */ 334 __bpf_kfunc void 335 hid_bpf_release_context(struct hid_bpf_ctx *ctx) 336 { 337 struct hid_bpf_ctx_kern *ctx_kern; 338 struct hid_device *hid; 339 340 ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx); 341 hid = (struct hid_device *)ctx_kern->ctx.hid; /* ignore const */ 342 343 kfree(ctx_kern); 344 345 /* get_device() is called by bus_find_device() */ 346 hid_put_device(hid); 347 } 348 349 static int 350 __hid_bpf_hw_check_params(struct hid_bpf_ctx *ctx, __u8 *buf, size_t *buf__sz, 351 enum hid_report_type rtype) 352 { 353 struct hid_report_enum *report_enum; 354 struct hid_report *report; 355 struct hid_device *hdev; 356 u32 report_len; 357 358 /* check arguments */ 359 if (!ctx || !hid_ops || !buf) 360 return -EINVAL; 361 362 switch (rtype) { 363 case HID_INPUT_REPORT: 364 case HID_OUTPUT_REPORT: 365 case HID_FEATURE_REPORT: 366 break; 367 default: 368 return -EINVAL; 369 } 370 371 if (*buf__sz < 1) 372 return -EINVAL; 373 374 hdev = (struct hid_device *)ctx->hid; /* discard const */ 375 376 report_enum = hdev->report_enum + rtype; 377 report = hid_ops->hid_get_report(report_enum, buf); 378 if (!report) 379 return -EINVAL; 380 381 report_len = hid_report_len(report); 382 383 if (*buf__sz > report_len) 384 *buf__sz = report_len; 385 386 return 0; 387 } 388 389 /** 390 * hid_bpf_hw_request - Communicate with a HID device 391 * 392 * @ctx: the HID-BPF context previously allocated in hid_bpf_allocate_context() 393 * @buf: a %PTR_TO_MEM buffer 394 * @buf__sz: the size of the data to transfer 395 * @rtype: the type of the report (%HID_INPUT_REPORT, %HID_FEATURE_REPORT, %HID_OUTPUT_REPORT) 396 * @reqtype: the type of the request (%HID_REQ_GET_REPORT, %HID_REQ_SET_REPORT, ...) 397 * 398 * @returns %0 on success, a negative error code otherwise. 399 */ 400 __bpf_kfunc int 401 hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz, 402 enum hid_report_type rtype, enum hid_class_request reqtype) 403 { 404 struct hid_bpf_ctx_kern *ctx_kern; 405 struct hid_device *hdev; 406 size_t size = buf__sz; 407 u8 *dma_data; 408 int ret; 409 410 ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx); 411 412 if (ctx_kern->from_bpf) 413 return -EDEADLOCK; 414 415 /* check arguments */ 416 ret = __hid_bpf_hw_check_params(ctx, buf, &size, rtype); 417 if (ret) 418 return ret; 419 420 switch (reqtype) { 421 case HID_REQ_GET_REPORT: 422 case HID_REQ_GET_IDLE: 423 case HID_REQ_GET_PROTOCOL: 424 case HID_REQ_SET_REPORT: 425 case HID_REQ_SET_IDLE: 426 case HID_REQ_SET_PROTOCOL: 427 break; 428 default: 429 return -EINVAL; 430 } 431 432 hdev = (struct hid_device *)ctx->hid; /* discard const */ 433 434 dma_data = kmemdup(buf, size, GFP_KERNEL); 435 if (!dma_data) 436 return -ENOMEM; 437 438 ret = hid_ops->hid_hw_raw_request(hdev, 439 dma_data[0], 440 dma_data, 441 size, 442 rtype, 443 reqtype, 444 (u64)(long)ctx, 445 true); /* prevent infinite recursions */ 446 447 if (ret > 0) 448 memcpy(buf, dma_data, ret); 449 450 kfree(dma_data); 451 return ret; 452 } 453 454 /** 455 * hid_bpf_hw_output_report - Send an output report to a HID device 456 * 457 * @ctx: the HID-BPF context previously allocated in hid_bpf_allocate_context() 458 * @buf: a %PTR_TO_MEM buffer 459 * @buf__sz: the size of the data to transfer 460 * 461 * Returns the number of bytes transferred on success, a negative error code otherwise. 462 */ 463 __bpf_kfunc int 464 hid_bpf_hw_output_report(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz) 465 { 466 struct hid_bpf_ctx_kern *ctx_kern; 467 struct hid_device *hdev; 468 size_t size = buf__sz; 469 u8 *dma_data; 470 int ret; 471 472 ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx); 473 if (ctx_kern->from_bpf) 474 return -EDEADLOCK; 475 476 /* check arguments */ 477 ret = __hid_bpf_hw_check_params(ctx, buf, &size, HID_OUTPUT_REPORT); 478 if (ret) 479 return ret; 480 481 hdev = (struct hid_device *)ctx->hid; /* discard const */ 482 483 dma_data = kmemdup(buf, size, GFP_KERNEL); 484 if (!dma_data) 485 return -ENOMEM; 486 487 ret = hid_ops->hid_hw_output_report(hdev, dma_data, size, (u64)(long)ctx, true); 488 489 kfree(dma_data); 490 return ret; 491 } 492 493 static int 494 __hid_bpf_input_report(struct hid_bpf_ctx *ctx, enum hid_report_type type, u8 *buf, 495 size_t size, bool lock_already_taken) 496 { 497 struct hid_bpf_ctx_kern *ctx_kern; 498 int ret; 499 500 ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx); 501 if (ctx_kern->from_bpf) 502 return -EDEADLOCK; 503 504 /* check arguments */ 505 ret = __hid_bpf_hw_check_params(ctx, buf, &size, type); 506 if (ret) 507 return ret; 508 509 return hid_ops->hid_input_report(ctx->hid, type, buf, size, 0, (u64)(long)ctx, true, 510 lock_already_taken); 511 } 512 513 /** 514 * hid_bpf_try_input_report - Inject a HID report in the kernel from a HID device 515 * 516 * @ctx: the HID-BPF context previously allocated in hid_bpf_allocate_context() 517 * @type: the type of the report (%HID_INPUT_REPORT, %HID_FEATURE_REPORT, %HID_OUTPUT_REPORT) 518 * @buf: a %PTR_TO_MEM buffer 519 * @buf__sz: the size of the data to transfer 520 * 521 * Returns %0 on success, a negative error code otherwise. This function will immediately 522 * fail if the device is not available, thus can be safely used in IRQ context. 523 */ 524 __bpf_kfunc int 525 hid_bpf_try_input_report(struct hid_bpf_ctx *ctx, enum hid_report_type type, u8 *buf, 526 const size_t buf__sz) 527 { 528 struct hid_bpf_ctx_kern *ctx_kern; 529 bool from_hid_event_hook; 530 531 ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx); 532 from_hid_event_hook = ctx_kern->data && ctx_kern->data == ctx->hid->bpf.device_data; 533 534 return __hid_bpf_input_report(ctx, type, buf, buf__sz, from_hid_event_hook); 535 } 536 537 /** 538 * hid_bpf_input_report - Inject a HID report in the kernel from a HID device 539 * 540 * @ctx: the HID-BPF context previously allocated in hid_bpf_allocate_context() 541 * @type: the type of the report (%HID_INPUT_REPORT, %HID_FEATURE_REPORT, %HID_OUTPUT_REPORT) 542 * @buf: a %PTR_TO_MEM buffer 543 * @buf__sz: the size of the data to transfer 544 * 545 * Returns %0 on success, a negative error code otherwise. This function will wait for the 546 * device to be available before injecting the event, thus needs to be called in sleepable 547 * context. 548 */ 549 __bpf_kfunc int 550 hid_bpf_input_report(struct hid_bpf_ctx *ctx, enum hid_report_type type, u8 *buf, 551 const size_t buf__sz) 552 { 553 int ret; 554 555 ret = down_interruptible(&ctx->hid->driver_input_lock); 556 if (ret) 557 return ret; 558 559 /* check arguments */ 560 ret = __hid_bpf_input_report(ctx, type, buf, buf__sz, true /* lock_already_taken */); 561 562 up(&ctx->hid->driver_input_lock); 563 564 return ret; 565 } 566 __bpf_kfunc_end_defs(); 567 568 /* 569 * The following set contains all functions we agree BPF programs 570 * can use. 571 */ 572 BTF_KFUNCS_START(hid_bpf_kfunc_ids) 573 BTF_ID_FLAGS(func, hid_bpf_get_data, KF_RET_NULL) 574 BTF_ID_FLAGS(func, hid_bpf_allocate_context, KF_ACQUIRE | KF_RET_NULL | KF_SLEEPABLE) 575 BTF_ID_FLAGS(func, hid_bpf_release_context, KF_RELEASE | KF_SLEEPABLE) 576 BTF_ID_FLAGS(func, hid_bpf_hw_request, KF_SLEEPABLE) 577 BTF_ID_FLAGS(func, hid_bpf_hw_output_report, KF_SLEEPABLE) 578 BTF_ID_FLAGS(func, hid_bpf_input_report, KF_SLEEPABLE) 579 BTF_ID_FLAGS(func, hid_bpf_try_input_report) 580 BTF_KFUNCS_END(hid_bpf_kfunc_ids) 581 582 static const struct btf_kfunc_id_set hid_bpf_kfunc_set = { 583 .owner = THIS_MODULE, 584 .set = &hid_bpf_kfunc_ids, 585 }; 586 587 /* for syscall HID-BPF */ 588 BTF_KFUNCS_START(hid_bpf_syscall_kfunc_ids) 589 BTF_ID_FLAGS(func, hid_bpf_allocate_context, KF_ACQUIRE | KF_RET_NULL) 590 BTF_ID_FLAGS(func, hid_bpf_release_context, KF_RELEASE) 591 BTF_ID_FLAGS(func, hid_bpf_hw_request) 592 BTF_ID_FLAGS(func, hid_bpf_hw_output_report) 593 BTF_ID_FLAGS(func, hid_bpf_input_report) 594 BTF_KFUNCS_END(hid_bpf_syscall_kfunc_ids) 595 596 static const struct btf_kfunc_id_set hid_bpf_syscall_kfunc_set = { 597 .owner = THIS_MODULE, 598 .set = &hid_bpf_syscall_kfunc_ids, 599 }; 600 601 int hid_bpf_connect_device(struct hid_device *hdev) 602 { 603 bool need_to_allocate = false; 604 struct hid_bpf_ops *e; 605 606 rcu_read_lock(); 607 list_for_each_entry_rcu(e, &hdev->bpf.prog_list, list) { 608 if (e->hid_device_event) { 609 need_to_allocate = true; 610 break; 611 } 612 } 613 rcu_read_unlock(); 614 615 /* only allocate BPF data if there are programs attached */ 616 if (!need_to_allocate) 617 return 0; 618 619 return hid_bpf_allocate_event_data(hdev); 620 } 621 EXPORT_SYMBOL_GPL(hid_bpf_connect_device); 622 623 void hid_bpf_disconnect_device(struct hid_device *hdev) 624 { 625 kfree(hdev->bpf.device_data); 626 hdev->bpf.device_data = NULL; 627 hdev->bpf.allocated_data = 0; 628 } 629 EXPORT_SYMBOL_GPL(hid_bpf_disconnect_device); 630 631 void hid_bpf_destroy_device(struct hid_device *hdev) 632 { 633 if (!hdev) 634 return; 635 636 /* mark the device as destroyed in bpf so we don't reattach it */ 637 hdev->bpf.destroyed = true; 638 639 __hid_bpf_ops_destroy_device(hdev); 640 641 synchronize_srcu(&hdev->bpf.srcu); 642 cleanup_srcu_struct(&hdev->bpf.srcu); 643 } 644 EXPORT_SYMBOL_GPL(hid_bpf_destroy_device); 645 646 int hid_bpf_device_init(struct hid_device *hdev) 647 { 648 INIT_LIST_HEAD(&hdev->bpf.prog_list); 649 mutex_init(&hdev->bpf.prog_list_lock); 650 return init_srcu_struct(&hdev->bpf.srcu); 651 } 652 EXPORT_SYMBOL_GPL(hid_bpf_device_init); 653 654 static int __init hid_bpf_init(void) 655 { 656 int err; 657 658 /* Note: if we exit with an error any time here, we would entirely break HID, which 659 * is probably not something we want. So we log an error and return success. 660 * 661 * This is not a big deal: nobody will be able to use the functionality. 662 */ 663 664 err = register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &hid_bpf_kfunc_set); 665 if (err) { 666 pr_warn("error while setting HID BPF tracing kfuncs: %d", err); 667 return 0; 668 } 669 670 err = register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &hid_bpf_syscall_kfunc_set); 671 if (err) { 672 pr_warn("error while setting HID BPF syscall kfuncs: %d", err); 673 return 0; 674 } 675 676 return 0; 677 } 678 679 late_initcall(hid_bpf_init); 680 MODULE_AUTHOR("Benjamin Tissoires"); 681 MODULE_LICENSE("GPL"); 682