1 // SPDX-License-Identifier: GPL-2.0-only 2 3 /* 4 * HID-BPF support for Linux 5 * 6 * Copyright (c) 2022 Benjamin Tissoires 7 */ 8 9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 10 #include <linux/bitops.h> 11 #include <linux/btf.h> 12 #include <linux/btf_ids.h> 13 #include <linux/filter.h> 14 #include <linux/hid.h> 15 #include <linux/hid_bpf.h> 16 #include <linux/init.h> 17 #include <linux/kfifo.h> 18 #include <linux/minmax.h> 19 #include <linux/module.h> 20 #include <linux/workqueue.h> 21 #include "hid_bpf_dispatch.h" 22 #include "entrypoints/entrypoints.lskel.h" 23 24 struct hid_bpf_ops *hid_bpf_ops; 25 EXPORT_SYMBOL(hid_bpf_ops); 26 27 /** 28 * hid_bpf_device_event - Called whenever an event is coming in from the device 29 * 30 * @ctx: The HID-BPF context 31 * 32 * @return %0 on success and keep processing; a positive value to change the 33 * incoming size buffer; a negative error code to interrupt the processing 34 * of this event 35 * 36 * Declare an %fmod_ret tracing bpf program to this function and attach this 37 * program through hid_bpf_attach_prog() to have this helper called for 38 * any incoming event from the device itself. 39 * 40 * The function is called while on IRQ context, so we can not sleep. 41 */ 42 /* never used by the kernel but declared so we can load and attach a tracepoint */ 43 __weak noinline int hid_bpf_device_event(struct hid_bpf_ctx *ctx) 44 { 45 return 0; 46 } 47 48 u8 * 49 dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type, u8 *data, 50 u32 *size, int interrupt) 51 { 52 struct hid_bpf_ctx_kern ctx_kern = { 53 .ctx = { 54 .hid = hdev, 55 .report_type = type, 56 .allocated_size = hdev->bpf.allocated_data, 57 .size = *size, 58 }, 59 .data = hdev->bpf.device_data, 60 }; 61 int ret; 62 63 if (type >= HID_REPORT_TYPES) 64 return ERR_PTR(-EINVAL); 65 66 /* no program has been attached yet */ 67 if (!hdev->bpf.device_data) 68 return data; 69 70 memset(ctx_kern.data, 0, hdev->bpf.allocated_data); 71 memcpy(ctx_kern.data, data, *size); 72 73 ret = hid_bpf_prog_run(hdev, HID_BPF_PROG_TYPE_DEVICE_EVENT, &ctx_kern); 74 if (ret < 0) 75 return ERR_PTR(ret); 76 77 if (ret) { 78 if (ret > ctx_kern.ctx.allocated_size) 79 return ERR_PTR(-EINVAL); 80 81 *size = ret; 82 } 83 84 return ctx_kern.data; 85 } 86 EXPORT_SYMBOL_GPL(dispatch_hid_bpf_device_event); 87 88 /** 89 * hid_bpf_rdesc_fixup - Called when the probe function parses the report 90 * descriptor of the HID device 91 * 92 * @ctx: The HID-BPF context 93 * 94 * @return 0 on success and keep processing; a positive value to change the 95 * incoming size buffer; a negative error code to interrupt the processing 96 * of this event 97 * 98 * Declare an %fmod_ret tracing bpf program to this function and attach this 99 * program through hid_bpf_attach_prog() to have this helper called before any 100 * parsing of the report descriptor by HID. 101 */ 102 /* never used by the kernel but declared so we can load and attach a tracepoint */ 103 __weak noinline int hid_bpf_rdesc_fixup(struct hid_bpf_ctx *ctx) 104 { 105 return 0; 106 } 107 108 u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, u8 *rdesc, unsigned int *size) 109 { 110 int ret; 111 struct hid_bpf_ctx_kern ctx_kern = { 112 .ctx = { 113 .hid = hdev, 114 .size = *size, 115 .allocated_size = HID_MAX_DESCRIPTOR_SIZE, 116 }, 117 }; 118 119 ctx_kern.data = kzalloc(ctx_kern.ctx.allocated_size, GFP_KERNEL); 120 if (!ctx_kern.data) 121 goto ignore_bpf; 122 123 memcpy(ctx_kern.data, rdesc, min_t(unsigned int, *size, HID_MAX_DESCRIPTOR_SIZE)); 124 125 ret = hid_bpf_prog_run(hdev, HID_BPF_PROG_TYPE_RDESC_FIXUP, &ctx_kern); 126 if (ret < 0) 127 goto ignore_bpf; 128 129 if (ret) { 130 if (ret > ctx_kern.ctx.allocated_size) 131 goto ignore_bpf; 132 133 *size = ret; 134 } 135 136 rdesc = krealloc(ctx_kern.data, *size, GFP_KERNEL); 137 138 return rdesc; 139 140 ignore_bpf: 141 kfree(ctx_kern.data); 142 return kmemdup(rdesc, *size, GFP_KERNEL); 143 } 144 EXPORT_SYMBOL_GPL(call_hid_bpf_rdesc_fixup); 145 146 /** 147 * hid_bpf_get_data - Get the kernel memory pointer associated with the context @ctx 148 * 149 * @ctx: The HID-BPF context 150 * @offset: The offset within the memory 151 * @rdwr_buf_size: the const size of the buffer 152 * 153 * @returns %NULL on error, an %__u8 memory pointer on success 154 */ 155 noinline __u8 * 156 hid_bpf_get_data(struct hid_bpf_ctx *ctx, unsigned int offset, const size_t rdwr_buf_size) 157 { 158 struct hid_bpf_ctx_kern *ctx_kern; 159 160 if (!ctx) 161 return NULL; 162 163 ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx); 164 165 if (rdwr_buf_size + offset > ctx->allocated_size) 166 return NULL; 167 168 return ctx_kern->data + offset; 169 } 170 171 /* 172 * The following set contains all functions we agree BPF programs 173 * can use. 174 */ 175 BTF_SET8_START(hid_bpf_kfunc_ids) 176 BTF_ID_FLAGS(func, hid_bpf_get_data, KF_RET_NULL) 177 BTF_SET8_END(hid_bpf_kfunc_ids) 178 179 static const struct btf_kfunc_id_set hid_bpf_kfunc_set = { 180 .owner = THIS_MODULE, 181 .set = &hid_bpf_kfunc_ids, 182 }; 183 184 static int device_match_id(struct device *dev, const void *id) 185 { 186 struct hid_device *hdev = to_hid_device(dev); 187 188 return hdev->id == *(int *)id; 189 } 190 191 static int __hid_bpf_allocate_data(struct hid_device *hdev, u8 **data, u32 *size) 192 { 193 u8 *alloc_data; 194 unsigned int i, j, max_report_len = 0; 195 size_t alloc_size = 0; 196 197 /* compute the maximum report length for this device */ 198 for (i = 0; i < HID_REPORT_TYPES; i++) { 199 struct hid_report_enum *report_enum = hdev->report_enum + i; 200 201 for (j = 0; j < HID_MAX_IDS; j++) { 202 struct hid_report *report = report_enum->report_id_hash[j]; 203 204 if (report) 205 max_report_len = max(max_report_len, hid_report_len(report)); 206 } 207 } 208 209 /* 210 * Give us a little bit of extra space and some predictability in the 211 * buffer length we create. This way, we can tell users that they can 212 * work on chunks of 64 bytes of memory without having the bpf verifier 213 * scream at them. 214 */ 215 alloc_size = DIV_ROUND_UP(max_report_len, 64) * 64; 216 217 alloc_data = kzalloc(alloc_size, GFP_KERNEL); 218 if (!alloc_data) 219 return -ENOMEM; 220 221 *data = alloc_data; 222 *size = alloc_size; 223 224 return 0; 225 } 226 227 static int hid_bpf_allocate_event_data(struct hid_device *hdev) 228 { 229 /* hdev->bpf.device_data is already allocated, abort */ 230 if (hdev->bpf.device_data) 231 return 0; 232 233 return __hid_bpf_allocate_data(hdev, &hdev->bpf.device_data, &hdev->bpf.allocated_data); 234 } 235 236 int hid_bpf_reconnect(struct hid_device *hdev) 237 { 238 if (!test_and_set_bit(ffs(HID_STAT_REPROBED), &hdev->status)) 239 return device_reprobe(&hdev->dev); 240 241 return 0; 242 } 243 244 static int do_hid_bpf_attach_prog(struct hid_device *hdev, int prog_fd, struct bpf_prog *prog, 245 __u32 flags) 246 { 247 int fd, err, prog_type; 248 249 prog_type = hid_bpf_get_prog_attach_type(prog); 250 if (prog_type < 0) 251 return prog_type; 252 253 if (prog_type >= HID_BPF_PROG_TYPE_MAX) 254 return -EINVAL; 255 256 if (prog_type == HID_BPF_PROG_TYPE_DEVICE_EVENT) { 257 err = hid_bpf_allocate_event_data(hdev); 258 if (err) 259 return err; 260 } 261 262 fd = __hid_bpf_attach_prog(hdev, prog_type, prog_fd, prog, flags); 263 if (fd < 0) 264 return fd; 265 266 if (prog_type == HID_BPF_PROG_TYPE_RDESC_FIXUP) { 267 err = hid_bpf_reconnect(hdev); 268 if (err) { 269 close_fd(fd); 270 return err; 271 } 272 } 273 274 return fd; 275 } 276 277 /** 278 * hid_bpf_attach_prog - Attach the given @prog_fd to the given HID device 279 * 280 * @hid_id: the system unique identifier of the HID device 281 * @prog_fd: an fd in the user process representing the program to attach 282 * @flags: any logical OR combination of &enum hid_bpf_attach_flags 283 * 284 * @returns an fd of a bpf_link object on success (> %0), an error code otherwise. 285 * Closing this fd will detach the program from the HID device (unless the bpf_link 286 * is pinned to the BPF file system). 287 */ 288 /* called from syscall */ 289 noinline int 290 hid_bpf_attach_prog(unsigned int hid_id, int prog_fd, __u32 flags) 291 { 292 struct hid_device *hdev; 293 struct bpf_prog *prog; 294 struct device *dev; 295 int err, fd; 296 297 if (!hid_bpf_ops) 298 return -EINVAL; 299 300 if ((flags & ~HID_BPF_FLAG_MASK)) 301 return -EINVAL; 302 303 dev = bus_find_device(hid_bpf_ops->bus_type, NULL, &hid_id, device_match_id); 304 if (!dev) 305 return -EINVAL; 306 307 hdev = to_hid_device(dev); 308 309 /* 310 * take a ref on the prog itself, it will be released 311 * on errors or when it'll be detached 312 */ 313 prog = bpf_prog_get(prog_fd); 314 if (IS_ERR(prog)) { 315 err = PTR_ERR(prog); 316 goto out_dev_put; 317 } 318 319 fd = do_hid_bpf_attach_prog(hdev, prog_fd, prog, flags); 320 if (fd < 0) { 321 err = fd; 322 goto out_prog_put; 323 } 324 325 return fd; 326 327 out_prog_put: 328 bpf_prog_put(prog); 329 out_dev_put: 330 put_device(dev); 331 return err; 332 } 333 334 /** 335 * hid_bpf_allocate_context - Allocate a context to the given HID device 336 * 337 * @hid_id: the system unique identifier of the HID device 338 * 339 * @returns A pointer to &struct hid_bpf_ctx on success, %NULL on error. 340 */ 341 noinline struct hid_bpf_ctx * 342 hid_bpf_allocate_context(unsigned int hid_id) 343 { 344 struct hid_device *hdev; 345 struct hid_bpf_ctx_kern *ctx_kern = NULL; 346 struct device *dev; 347 348 if (!hid_bpf_ops) 349 return NULL; 350 351 dev = bus_find_device(hid_bpf_ops->bus_type, NULL, &hid_id, device_match_id); 352 if (!dev) 353 return NULL; 354 355 hdev = to_hid_device(dev); 356 357 ctx_kern = kzalloc(sizeof(*ctx_kern), GFP_KERNEL); 358 if (!ctx_kern) { 359 put_device(dev); 360 return NULL; 361 } 362 363 ctx_kern->ctx.hid = hdev; 364 365 return &ctx_kern->ctx; 366 } 367 368 /** 369 * hid_bpf_release_context - Release the previously allocated context @ctx 370 * 371 * @ctx: the HID-BPF context to release 372 * 373 */ 374 noinline void 375 hid_bpf_release_context(struct hid_bpf_ctx *ctx) 376 { 377 struct hid_bpf_ctx_kern *ctx_kern; 378 struct hid_device *hid; 379 380 ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx); 381 hid = (struct hid_device *)ctx_kern->ctx.hid; /* ignore const */ 382 383 kfree(ctx_kern); 384 385 /* get_device() is called by bus_find_device() */ 386 put_device(&hid->dev); 387 } 388 389 /** 390 * hid_bpf_hw_request - Communicate with a HID device 391 * 392 * @ctx: the HID-BPF context previously allocated in hid_bpf_allocate_context() 393 * @buf: a %PTR_TO_MEM buffer 394 * @buf__sz: the size of the data to transfer 395 * @rtype: the type of the report (%HID_INPUT_REPORT, %HID_FEATURE_REPORT, %HID_OUTPUT_REPORT) 396 * @reqtype: the type of the request (%HID_REQ_GET_REPORT, %HID_REQ_SET_REPORT, ...) 397 * 398 * @returns %0 on success, a negative error code otherwise. 399 */ 400 noinline int 401 hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz, 402 enum hid_report_type rtype, enum hid_class_request reqtype) 403 { 404 struct hid_device *hdev; 405 struct hid_report *report; 406 struct hid_report_enum *report_enum; 407 u8 *dma_data; 408 u32 report_len; 409 int ret; 410 411 /* check arguments */ 412 if (!ctx || !hid_bpf_ops || !buf) 413 return -EINVAL; 414 415 switch (rtype) { 416 case HID_INPUT_REPORT: 417 case HID_OUTPUT_REPORT: 418 case HID_FEATURE_REPORT: 419 break; 420 default: 421 return -EINVAL; 422 } 423 424 switch (reqtype) { 425 case HID_REQ_GET_REPORT: 426 case HID_REQ_GET_IDLE: 427 case HID_REQ_GET_PROTOCOL: 428 case HID_REQ_SET_REPORT: 429 case HID_REQ_SET_IDLE: 430 case HID_REQ_SET_PROTOCOL: 431 break; 432 default: 433 return -EINVAL; 434 } 435 436 if (buf__sz < 1) 437 return -EINVAL; 438 439 hdev = (struct hid_device *)ctx->hid; /* discard const */ 440 441 report_enum = hdev->report_enum + rtype; 442 report = hid_bpf_ops->hid_get_report(report_enum, buf); 443 if (!report) 444 return -EINVAL; 445 446 report_len = hid_report_len(report); 447 448 if (buf__sz > report_len) 449 buf__sz = report_len; 450 451 dma_data = kmemdup(buf, buf__sz, GFP_KERNEL); 452 if (!dma_data) 453 return -ENOMEM; 454 455 ret = hid_bpf_ops->hid_hw_raw_request(hdev, 456 dma_data[0], 457 dma_data, 458 buf__sz, 459 rtype, 460 reqtype); 461 462 if (ret > 0) 463 memcpy(buf, dma_data, ret); 464 465 kfree(dma_data); 466 return ret; 467 } 468 469 /* our HID-BPF entrypoints */ 470 BTF_SET8_START(hid_bpf_fmodret_ids) 471 BTF_ID_FLAGS(func, hid_bpf_device_event) 472 BTF_ID_FLAGS(func, hid_bpf_rdesc_fixup) 473 BTF_ID_FLAGS(func, __hid_bpf_tail_call) 474 BTF_SET8_END(hid_bpf_fmodret_ids) 475 476 static const struct btf_kfunc_id_set hid_bpf_fmodret_set = { 477 .owner = THIS_MODULE, 478 .set = &hid_bpf_fmodret_ids, 479 }; 480 481 /* for syscall HID-BPF */ 482 BTF_SET8_START(hid_bpf_syscall_kfunc_ids) 483 BTF_ID_FLAGS(func, hid_bpf_attach_prog) 484 BTF_ID_FLAGS(func, hid_bpf_allocate_context, KF_ACQUIRE | KF_RET_NULL) 485 BTF_ID_FLAGS(func, hid_bpf_release_context, KF_RELEASE) 486 BTF_ID_FLAGS(func, hid_bpf_hw_request) 487 BTF_SET8_END(hid_bpf_syscall_kfunc_ids) 488 489 static const struct btf_kfunc_id_set hid_bpf_syscall_kfunc_set = { 490 .owner = THIS_MODULE, 491 .set = &hid_bpf_syscall_kfunc_ids, 492 }; 493 494 int hid_bpf_connect_device(struct hid_device *hdev) 495 { 496 struct hid_bpf_prog_list *prog_list; 497 498 rcu_read_lock(); 499 prog_list = rcu_dereference(hdev->bpf.progs[HID_BPF_PROG_TYPE_DEVICE_EVENT]); 500 rcu_read_unlock(); 501 502 /* only allocate BPF data if there are programs attached */ 503 if (!prog_list) 504 return 0; 505 506 return hid_bpf_allocate_event_data(hdev); 507 } 508 EXPORT_SYMBOL_GPL(hid_bpf_connect_device); 509 510 void hid_bpf_disconnect_device(struct hid_device *hdev) 511 { 512 kfree(hdev->bpf.device_data); 513 hdev->bpf.device_data = NULL; 514 hdev->bpf.allocated_data = 0; 515 } 516 EXPORT_SYMBOL_GPL(hid_bpf_disconnect_device); 517 518 void hid_bpf_destroy_device(struct hid_device *hdev) 519 { 520 if (!hdev) 521 return; 522 523 /* mark the device as destroyed in bpf so we don't reattach it */ 524 hdev->bpf.destroyed = true; 525 526 __hid_bpf_destroy_device(hdev); 527 } 528 EXPORT_SYMBOL_GPL(hid_bpf_destroy_device); 529 530 void hid_bpf_device_init(struct hid_device *hdev) 531 { 532 spin_lock_init(&hdev->bpf.progs_lock); 533 } 534 EXPORT_SYMBOL_GPL(hid_bpf_device_init); 535 536 static int __init hid_bpf_init(void) 537 { 538 int err; 539 540 /* Note: if we exit with an error any time here, we would entirely break HID, which 541 * is probably not something we want. So we log an error and return success. 542 * 543 * This is not a big deal: the syscall allowing to attach a BPF program to a HID device 544 * will not be available, so nobody will be able to use the functionality. 545 */ 546 547 err = register_btf_fmodret_id_set(&hid_bpf_fmodret_set); 548 if (err) { 549 pr_warn("error while registering fmodret entrypoints: %d", err); 550 return 0; 551 } 552 553 err = hid_bpf_preload_skel(); 554 if (err) { 555 pr_warn("error while preloading HID BPF dispatcher: %d", err); 556 return 0; 557 } 558 559 /* register tracing kfuncs after we are sure we can load our preloaded bpf program */ 560 err = register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING, &hid_bpf_kfunc_set); 561 if (err) { 562 pr_warn("error while setting HID BPF tracing kfuncs: %d", err); 563 return 0; 564 } 565 566 /* register syscalls after we are sure we can load our preloaded bpf program */ 567 err = register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &hid_bpf_syscall_kfunc_set); 568 if (err) { 569 pr_warn("error while setting HID BPF syscall kfuncs: %d", err); 570 return 0; 571 } 572 573 return 0; 574 } 575 576 static void __exit hid_bpf_exit(void) 577 { 578 /* HID depends on us, so if we hit that code, we are guaranteed that hid 579 * has been removed and thus we do not need to clear the HID devices 580 */ 581 hid_bpf_free_links_and_skel(); 582 } 583 584 late_initcall(hid_bpf_init); 585 module_exit(hid_bpf_exit); 586 MODULE_AUTHOR("Benjamin Tissoires"); 587 MODULE_LICENSE("GPL"); 588