1 // SPDX-License-Identifier: GPL-2.0-only 2 3 /* 4 * HID-BPF support for Linux 5 * 6 * Copyright (c) 2024 Benjamin Tissoires 7 */ 8 9 #include <linux/bitops.h> 10 #include <linux/bpf_verifier.h> 11 #include <linux/bpf.h> 12 #include <linux/btf.h> 13 #include <linux/btf_ids.h> 14 #include <linux/filter.h> 15 #include <linux/hid.h> 16 #include <linux/hid_bpf.h> 17 #include <linux/init.h> 18 #include <linux/module.h> 19 #include <linux/stddef.h> 20 #include <linux/workqueue.h> 21 #include "hid_bpf_dispatch.h" 22 23 static struct btf *hid_bpf_ops_btf; 24 25 static int hid_bpf_ops_init(struct btf *btf) 26 { 27 hid_bpf_ops_btf = btf; 28 return 0; 29 } 30 31 static bool hid_bpf_ops_is_valid_access(int off, int size, 32 enum bpf_access_type type, 33 const struct bpf_prog *prog, 34 struct bpf_insn_access_aux *info) 35 { 36 return bpf_tracing_btf_ctx_access(off, size, type, prog, info); 37 } 38 39 static int hid_bpf_ops_check_member(const struct btf_type *t, 40 const struct btf_member *member, 41 const struct bpf_prog *prog) 42 { 43 u32 moff = __btf_member_bit_offset(t, member) / 8; 44 45 switch (moff) { 46 case offsetof(struct hid_bpf_ops, hid_rdesc_fixup): 47 case offsetof(struct hid_bpf_ops, hid_hw_request): 48 case offsetof(struct hid_bpf_ops, hid_hw_output_report): 49 break; 50 default: 51 if (prog->sleepable) 52 return -EINVAL; 53 } 54 55 return 0; 56 } 57 58 struct hid_bpf_offset_write_range { 59 const char *struct_name; 60 u32 struct_length; 61 u32 start; 62 u32 end; 63 }; 64 65 struct hid_bpf_ctx__safe_trusted { 66 struct hid_device *hid; 67 }; 68 69 static int hid_bpf_ops_btf_struct_access(struct bpf_verifier_log *log, 70 const struct bpf_reg_state *reg, 71 int off, int size) 72 { 73 #define WRITE_RANGE(_name, _field, _is_string) \ 74 { \ 75 .struct_name = #_name, \ 76 .struct_length = sizeof(struct _name), \ 77 .start = offsetof(struct _name, _field), \ 78 .end = offsetofend(struct _name, _field) - !!(_is_string), \ 79 } 80 81 const struct hid_bpf_offset_write_range write_ranges[] = { 82 WRITE_RANGE(hid_bpf_ctx, retval, false), 83 WRITE_RANGE(hid_device, name, true), 84 WRITE_RANGE(hid_device, uniq, true), 85 WRITE_RANGE(hid_device, phys, true), 86 }; 87 #undef WRITE_RANGE 88 const struct btf_type *state = NULL; 89 const struct btf_type *t; 90 const char *cur = NULL; 91 int i; 92 93 BTF_TYPE_EMIT(struct hid_bpf_ctx__safe_trusted); 94 95 t = btf_type_by_id(reg->btf, reg->btf_id); 96 97 for (i = 0; i < ARRAY_SIZE(write_ranges); i++) { 98 const struct hid_bpf_offset_write_range *write_range = &write_ranges[i]; 99 s32 type_id; 100 101 /* we already found a writeable struct, but there is a 102 * new one, let's break the loop. 103 */ 104 if (t == state && write_range->struct_name != cur) 105 break; 106 107 /* new struct to look for */ 108 if (write_range->struct_name != cur) { 109 type_id = btf_find_by_name_kind(reg->btf, write_range->struct_name, 110 BTF_KIND_STRUCT); 111 if (type_id < 0) 112 return -EINVAL; 113 114 state = btf_type_by_id(reg->btf, type_id); 115 } 116 117 /* this is not the struct we are looking for */ 118 if (t != state) { 119 cur = write_range->struct_name; 120 continue; 121 } 122 123 /* first time we see this struct, check for out of bounds */ 124 if (cur != write_range->struct_name && 125 off + size > write_range->struct_length) { 126 bpf_log(log, "write access for struct %s at off %d with size %d\n", 127 write_range->struct_name, off, size); 128 return -EACCES; 129 } 130 131 /* now check if we are in our boundaries */ 132 if (off >= write_range->start && off + size <= write_range->end) 133 return NOT_INIT; 134 135 cur = write_range->struct_name; 136 } 137 138 139 if (t != state) 140 bpf_log(log, "write access to this struct is not supported\n"); 141 else 142 bpf_log(log, 143 "write access at off %d with size %d on read-only part of %s\n", 144 off, size, cur); 145 146 return -EACCES; 147 } 148 149 static const struct bpf_verifier_ops hid_bpf_verifier_ops = { 150 .get_func_proto = bpf_base_func_proto, 151 .is_valid_access = hid_bpf_ops_is_valid_access, 152 .btf_struct_access = hid_bpf_ops_btf_struct_access, 153 }; 154 155 static int hid_bpf_ops_init_member(const struct btf_type *t, 156 const struct btf_member *member, 157 void *kdata, const void *udata) 158 { 159 const struct hid_bpf_ops *uhid_bpf_ops; 160 struct hid_bpf_ops *khid_bpf_ops; 161 u32 moff; 162 163 uhid_bpf_ops = (const struct hid_bpf_ops *)udata; 164 khid_bpf_ops = (struct hid_bpf_ops *)kdata; 165 166 moff = __btf_member_bit_offset(t, member) / 8; 167 168 switch (moff) { 169 case offsetof(struct hid_bpf_ops, hid_id): 170 /* For hid_id and flags fields, this function has to copy it 171 * and return 1 to indicate that the data has been handled by 172 * the struct_ops type, or the verifier will reject the map if 173 * the value of those fields is not zero. 174 */ 175 khid_bpf_ops->hid_id = uhid_bpf_ops->hid_id; 176 return 1; 177 case offsetof(struct hid_bpf_ops, flags): 178 if (uhid_bpf_ops->flags & ~BPF_F_BEFORE) 179 return -EINVAL; 180 khid_bpf_ops->flags = uhid_bpf_ops->flags; 181 return 1; 182 } 183 return 0; 184 } 185 186 static int hid_bpf_reg(void *kdata, struct bpf_link *link) 187 { 188 struct hid_bpf_ops *ops = kdata; 189 struct hid_device *hdev; 190 int count, err = 0; 191 192 /* prevent multiple attach of the same struct_ops */ 193 if (ops->hdev) 194 return -EINVAL; 195 196 hdev = hid_get_device(ops->hid_id); 197 if (IS_ERR(hdev)) 198 return PTR_ERR(hdev); 199 200 ops->hdev = hdev; 201 202 mutex_lock(&hdev->bpf.prog_list_lock); 203 204 count = list_count_nodes(&hdev->bpf.prog_list); 205 if (count >= HID_BPF_MAX_PROGS_PER_DEV) { 206 err = -E2BIG; 207 goto out_unlock; 208 } 209 210 if (ops->hid_rdesc_fixup) { 211 if (hdev->bpf.rdesc_ops) { 212 err = -EINVAL; 213 goto out_unlock; 214 } 215 216 hdev->bpf.rdesc_ops = ops; 217 } 218 219 if (ops->hid_device_event) { 220 err = hid_bpf_allocate_event_data(hdev); 221 if (err) 222 goto out_unlock; 223 } 224 225 if (ops->flags & BPF_F_BEFORE) 226 list_add_rcu(&ops->list, &hdev->bpf.prog_list); 227 else 228 list_add_tail_rcu(&ops->list, &hdev->bpf.prog_list); 229 synchronize_srcu(&hdev->bpf.srcu); 230 231 out_unlock: 232 mutex_unlock(&hdev->bpf.prog_list_lock); 233 234 if (err) { 235 if (hdev->bpf.rdesc_ops == ops) 236 hdev->bpf.rdesc_ops = NULL; 237 hid_put_device(hdev); 238 } else if (ops->hid_rdesc_fixup) { 239 hid_bpf_reconnect(hdev); 240 } 241 242 return err; 243 } 244 245 static void hid_bpf_unreg(void *kdata, struct bpf_link *link) 246 { 247 struct hid_bpf_ops *ops = kdata; 248 struct hid_device *hdev; 249 bool reconnect = false; 250 251 hdev = ops->hdev; 252 253 /* check if __hid_bpf_ops_destroy_device() has been called */ 254 if (!hdev) 255 return; 256 257 mutex_lock(&hdev->bpf.prog_list_lock); 258 259 if (!ops->hdev) { 260 mutex_unlock(&hdev->bpf.prog_list_lock); 261 return; 262 } 263 264 list_del_rcu(&ops->list); 265 synchronize_srcu(&hdev->bpf.srcu); 266 ops->hdev = NULL; 267 268 reconnect = hdev->bpf.rdesc_ops == ops; 269 if (reconnect) 270 hdev->bpf.rdesc_ops = NULL; 271 272 mutex_unlock(&hdev->bpf.prog_list_lock); 273 274 if (reconnect) 275 hid_bpf_reconnect(hdev); 276 277 hid_put_device(hdev); 278 } 279 280 static int __hid_bpf_device_event(struct hid_bpf_ctx *ctx, enum hid_report_type type, u64 source) 281 { 282 return 0; 283 } 284 285 static int __hid_bpf_rdesc_fixup(struct hid_bpf_ctx *ctx) 286 { 287 return 0; 288 } 289 290 static int __hid_bpf_hw_request(struct hid_bpf_ctx *ctx, unsigned char reportnum, 291 enum hid_report_type rtype, enum hid_class_request reqtype, 292 u64 source) 293 { 294 return 0; 295 } 296 297 static int __hid_bpf_hw_output_report(struct hid_bpf_ctx *ctx, u64 source) 298 { 299 return 0; 300 } 301 302 static struct hid_bpf_ops __bpf_hid_bpf_ops = { 303 .hid_device_event = __hid_bpf_device_event, 304 .hid_rdesc_fixup = __hid_bpf_rdesc_fixup, 305 .hid_hw_request = __hid_bpf_hw_request, 306 .hid_hw_output_report = __hid_bpf_hw_output_report, 307 }; 308 309 static struct bpf_struct_ops bpf_hid_bpf_ops = { 310 .verifier_ops = &hid_bpf_verifier_ops, 311 .init = hid_bpf_ops_init, 312 .check_member = hid_bpf_ops_check_member, 313 .init_member = hid_bpf_ops_init_member, 314 .reg = hid_bpf_reg, 315 .unreg = hid_bpf_unreg, 316 .name = "hid_bpf_ops", 317 .cfi_stubs = &__bpf_hid_bpf_ops, 318 .owner = THIS_MODULE, 319 }; 320 321 void __hid_bpf_ops_destroy_device(struct hid_device *hdev) 322 { 323 struct hid_bpf_ops *e; 324 int count = 0; 325 326 mutex_lock(&hdev->bpf.prog_list_lock); 327 list_for_each_entry(e, &hdev->bpf.prog_list, list) { 328 e->hdev = NULL; 329 count++; 330 } 331 mutex_unlock(&hdev->bpf.prog_list_lock); 332 333 while (count--) 334 hid_put_device(hdev); 335 } 336 337 static int __init hid_bpf_struct_ops_init(void) 338 { 339 return register_bpf_struct_ops(&bpf_hid_bpf_ops, hid_bpf_ops); 340 } 341 late_initcall(hid_bpf_struct_ops_init); 342