diff mbox series

[bpf-next,v3,05/17] HID: hook up with bpf

Message ID 20220318161528.1531164-6-benjamin.tissoires@redhat.com
State New
Headers show
Series Introduce eBPF support for HID devices | expand

Commit Message

Benjamin Tissoires March 18, 2022, 4:15 p.m. UTC
Now that BPF can be compatible with HID, add the capability into HID.
drivers/hid/hid-bpf.c takes care of the glue between bpf and HID, and
hid-core can then inject any incoming event from the device into a BPF
program to filter/analyze it.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

---

changes in v3:
- squashed "only call hid_bpf_raw_event() if a ctx is available"
  and "bpf: compute only the required buffer size for the device"
  into this one
- ensure the ctx.size is properly bounded by allocated size
- s/link_attach/pre_link_attach/
- s/array_detached/array_detach/
- fix default switch case when doing nothing
- reworked hid_bpf_pre_link_attach() to avoid the switch

changes in v2:
- split the series by bpf/libbpf/hid/selftests and samples
- addressed review comments from v1
---
 drivers/hid/Makefile   |   1 +
 drivers/hid/hid-bpf.c  | 174 +++++++++++++++++++++++++++++++++++++++++
 drivers/hid/hid-core.c |  24 +++++-
 include/linux/hid.h    |  11 +++
 4 files changed, 207 insertions(+), 3 deletions(-)
 create mode 100644 drivers/hid/hid-bpf.c

Comments

Song Liu March 18, 2022, 9:02 p.m. UTC | #1
On Fri, Mar 18, 2022 at 9:17 AM Benjamin Tissoires
<benjamin.tissoires@redhat.com> wrote:
>
> Now that BPF can be compatible with HID, add the capability into HID.
> drivers/hid/hid-bpf.c takes care of the glue between bpf and HID, and
> hid-core can then inject any incoming event from the device into a BPF
> program to filter/analyze it.

So we only need this part for DEVICE EVENT?

>
> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
>
> ---
>
> changes in v3:
> - squashed "only call hid_bpf_raw_event() if a ctx is available"
>   and "bpf: compute only the required buffer size for the device"
>   into this one
> - ensure the ctx.size is properly bounded by allocated size
> - s/link_attach/pre_link_attach/
> - s/array_detached/array_detach/
> - fix default switch case when doing nothing
> - reworked hid_bpf_pre_link_attach() to avoid the switch
>
> changes in v2:
> - split the series by bpf/libbpf/hid/selftests and samples
> - addressed review comments from v1
> ---
>  drivers/hid/Makefile   |   1 +
>  drivers/hid/hid-bpf.c  | 174 +++++++++++++++++++++++++++++++++++++++++
>  drivers/hid/hid-core.c |  24 +++++-
>  include/linux/hid.h    |  11 +++
>  4 files changed, 207 insertions(+), 3 deletions(-)
>  create mode 100644 drivers/hid/hid-bpf.c
>
> diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
> index 6d3e630e81af..08d2d7619937 100644
> --- a/drivers/hid/Makefile
> +++ b/drivers/hid/Makefile
> @@ -4,6 +4,7 @@
>  #
>  hid-y                  := hid-core.o hid-input.o hid-quirks.o
>  hid-$(CONFIG_DEBUG_FS)         += hid-debug.o
> +hid-$(CONFIG_BPF)              += hid-bpf.o
>
>  obj-$(CONFIG_HID)              += hid.o
>  obj-$(CONFIG_UHID)             += uhid.o
> diff --git a/drivers/hid/hid-bpf.c b/drivers/hid/hid-bpf.c
> new file mode 100644
> index 000000000000..5060ebcb9979
> --- /dev/null
> +++ b/drivers/hid/hid-bpf.c
> @@ -0,0 +1,174 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later
> +/*
> + *  BPF in HID support for Linux
> + *
> + *  Copyright (c) 2022 Benjamin Tissoires
> + */
> +
> +#include <linux/filter.h>
> +#include <linux/mutex.h>
> +#include <linux/slab.h>
> +
> +#include <uapi/linux/bpf_hid.h>
> +#include <linux/hid.h>
> +
> +static int __hid_bpf_match_sysfs(struct device *dev, const void *data)
> +{
> +       struct kernfs_node *kn = dev->kobj.sd;
> +       struct kernfs_node *uevent_kn;
> +
> +       uevent_kn = kernfs_find_and_get_ns(kn, "uevent", NULL);
> +
> +       return uevent_kn == data;
> +}
> +
> +static struct hid_device *hid_bpf_fd_to_hdev(int fd)
> +{
> +       struct device *dev;
> +       struct hid_device *hdev;
> +       struct fd f = fdget(fd);
> +       struct inode *inode;
> +       struct kernfs_node *node;
> +
> +       if (!f.file) {
> +               hdev = ERR_PTR(-EBADF);
> +               goto out;
> +       }
> +
> +       inode = file_inode(f.file);
> +       node = inode->i_private;
> +
> +       dev = bus_find_device(&hid_bus_type, NULL, node, __hid_bpf_match_sysfs);
> +
> +       if (dev)
> +               hdev = to_hid_device(dev);
> +       else
> +               hdev = ERR_PTR(-EINVAL);
> +
> + out:
> +       fdput(f);
> +       return hdev;
> +}
> +
> +static int hid_bpf_pre_link_attach(struct hid_device *hdev, enum bpf_hid_attach_type type)
> +{
> +       int err = 0;
> +       unsigned int i, j, max_report_len = 0;
> +       unsigned int alloc_size = 0;
> +
> +       if (type != BPF_HID_ATTACH_DEVICE_EVENT)
> +               return 0;
> +
> +       /* hdev->bpf.device_data is already allocated, abort */
> +       if (hdev->bpf.device_data)
> +               return 0;
> +
> +       /* compute the maximum report length for this device */
> +       for (i = 0; i < HID_REPORT_TYPES; i++) {
> +               struct hid_report_enum *report_enum = hdev->report_enum + i;
> +
> +               for (j = 0; j < HID_MAX_IDS; j++) {
> +                       struct hid_report *report = report_enum->report_id_hash[j];
> +
> +                       if (report)
> +                               max_report_len = max(max_report_len, hid_report_len(report));
> +               }
> +       }
> +
> +       /*
> +        * Give us a little bit of extra space and some predictability in the
> +        * buffer length we create. This way, we can tell users that they can
> +        * work on chunks of 64 bytes of memory without having the bpf verifier
> +        * scream at them.
> +        */
> +       alloc_size = DIV_ROUND_UP(max_report_len, 64) * 64;
> +
> +       hdev->bpf.device_data = kzalloc(alloc_size, GFP_KERNEL);
> +       if (!hdev->bpf.device_data)
> +               err = -ENOMEM;
> +       else
> +               hdev->bpf.allocated_data = alloc_size;
> +
> +       return err;
> +}
> +
> +static void hid_bpf_array_detach(struct hid_device *hdev, enum bpf_hid_attach_type type)
> +{
> +       switch (type) {
> +       case BPF_HID_ATTACH_DEVICE_EVENT:
> +               kfree(hdev->bpf.device_data);
> +               hdev->bpf.device_data = NULL;
> +               break;
> +       default:
> +               /* do nothing */
> +               break;
> +       }
> +}
> +
> +static int hid_bpf_run_progs(struct hid_device *hdev, struct hid_bpf_ctx_kern *ctx)
> +{
> +       enum bpf_hid_attach_type type;
> +
> +       if (!ctx)
> +               return -EINVAL;
> +
> +       switch (ctx->type) {
> +       case HID_BPF_DEVICE_EVENT:
> +               type = BPF_HID_ATTACH_DEVICE_EVENT;
> +               break;
> +       default:
> +               return -EINVAL;
> +       }
> +
> +       if (!hdev->bpf.run_array[type])
> +               return 0;
> +
> +       return BPF_PROG_RUN_ARRAY(hdev->bpf.run_array[type], ctx, bpf_prog_run);
> +}
> +
> +u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *data, int *size)
> +{
> +       int ret;
> +       struct hid_bpf_ctx_kern ctx = {
> +               .type = HID_BPF_DEVICE_EVENT,
> +               .hdev = hdev,
> +               .size = *size,
> +               .data = hdev->bpf.device_data,
> +               .allocated_size = hdev->bpf.allocated_data,
> +       };
> +
> +       if (bpf_hid_link_empty(&hdev->bpf, BPF_HID_ATTACH_DEVICE_EVENT))
> +               return data;
> +
> +       memset(ctx.data, 0, hdev->bpf.allocated_data);
> +       memcpy(ctx.data, data, *size);
> +
> +       ret = hid_bpf_run_progs(hdev, &ctx);
> +       if (ret)
> +               return ERR_PTR(-EIO);
> +
> +       if (!ctx.size || ctx.size > ctx.allocated_size)
> +               return ERR_PTR(-EINVAL);
> +
> +       *size = ctx.size;
> +
> +       return ctx.data;
> +}
> +
> +int __init hid_bpf_module_init(void)
> +{
> +       struct bpf_hid_hooks hooks = {
> +               .hdev_from_fd = hid_bpf_fd_to_hdev,
> +               .pre_link_attach = hid_bpf_pre_link_attach,
> +               .array_detach = hid_bpf_array_detach,
> +       };
> +
> +       bpf_hid_set_hooks(&hooks);
> +
> +       return 0;
> +}
> +
> +void __exit hid_bpf_module_exit(void)
> +{
> +       bpf_hid_set_hooks(NULL);
> +}
> diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> index f1aed5bbd000..937fab7eb9c6 100644
> --- a/drivers/hid/hid-core.c
> +++ b/drivers/hid/hid-core.c
> @@ -1748,13 +1748,24 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
>         struct hid_driver *hdrv;
>         unsigned int a;
>         u32 rsize, csize = size;
> -       u8 *cdata = data;
> +       u8 *cdata;
>         int ret = 0;
>
> +       /* we pre-test if device_data is available here to cut the calls at the earliest */
> +       if (hid->bpf.device_data) {
> +               data = hid_bpf_raw_event(hid, data, &size);
> +               if (IS_ERR(data)) {
> +                       ret = PTR_ERR(data);
> +                       goto out;
> +               }
> +       }
> +
>         report = hid_get_report(report_enum, data);
>         if (!report)
>                 goto out;
>
> +       cdata = data;
> +
>         if (report_enum->numbered) {
>                 cdata++;
>                 csize--;
> @@ -2528,10 +2539,12 @@ int hid_add_device(struct hid_device *hdev)
>
>         hid_debug_register(hdev, dev_name(&hdev->dev));
>         ret = device_add(&hdev->dev);
> -       if (!ret)
> +       if (!ret) {
>                 hdev->status |= HID_STAT_ADDED;
> -       else
> +       } else {
>                 hid_debug_unregister(hdev);
> +               bpf_hid_exit(hdev);
> +       }
>
>         return ret;
>  }
> @@ -2567,6 +2580,7 @@ struct hid_device *hid_allocate_device(void)
>         spin_lock_init(&hdev->debug_list_lock);
>         sema_init(&hdev->driver_input_lock, 1);
>         mutex_init(&hdev->ll_open_lock);
> +       bpf_hid_init(hdev);
>
>         return hdev;
>  }
> @@ -2574,6 +2588,7 @@ EXPORT_SYMBOL_GPL(hid_allocate_device);
>
>  static void hid_remove_device(struct hid_device *hdev)
>  {
> +       bpf_hid_exit(hdev);
>         if (hdev->status & HID_STAT_ADDED) {
>                 device_del(&hdev->dev);
>                 hid_debug_unregister(hdev);
> @@ -2700,6 +2715,8 @@ static int __init hid_init(void)
>
>         hid_debug_init();
>
> +       hid_bpf_module_init();
> +
>         return 0;
>  err_bus:
>         bus_unregister(&hid_bus_type);
> @@ -2709,6 +2726,7 @@ static int __init hid_init(void)
>
>  static void __exit hid_exit(void)
>  {
> +       hid_bpf_module_exit();
>         hid_debug_exit();
>         hidraw_exit();
>         bus_unregister(&hid_bus_type);
> diff --git a/include/linux/hid.h b/include/linux/hid.h
> index 56f6f4ad45a7..8fd79011f461 100644
> --- a/include/linux/hid.h
> +++ b/include/linux/hid.h
> @@ -27,6 +27,7 @@
>  #include <linux/mutex.h>
>  #include <linux/power_supply.h>
>  #include <uapi/linux/hid.h>
> +#include <uapi/linux/bpf_hid.h>
>
>  /*
>   * We parse each description item into this structure. Short items data
> @@ -1210,4 +1211,14 @@ do {                                                                     \
>  #define hid_dbg_once(hid, fmt, ...)                    \
>         dev_dbg_once(&(hid)->dev, fmt, ##__VA_ARGS__)
>
> +#ifdef CONFIG_BPF
> +u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *rd, int *size);
> +int hid_bpf_module_init(void);
> +void hid_bpf_module_exit(void);
> +#else
> +static inline u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *rd, int *size) { return rd; }
> +static inline int hid_bpf_module_init(void) { return 0; }
> +static inline void hid_bpf_module_exit(void) {}
> +#endif
> +
>  #endif
> --
> 2.35.1
>
Song Liu March 18, 2022, 9:04 p.m. UTC | #2
On Fri, Mar 18, 2022 at 2:02 PM Song Liu <song@kernel.org> wrote:
>
> On Fri, Mar 18, 2022 at 9:17 AM Benjamin Tissoires
> <benjamin.tissoires@redhat.com> wrote:
> >
> > Now that BPF can be compatible with HID, add the capability into HID.
> > drivers/hid/hid-bpf.c takes care of the glue between bpf and HID, and
> > hid-core can then inject any incoming event from the device into a BPF
> > program to filter/analyze it.
>
> So we only need this part for DEVICE EVENT?

NVM, I found other types in the following patches.

>
> >
> > Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> >
> > ---
> >
> > changes in v3:
> > - squashed "only call hid_bpf_raw_event() if a ctx is available"
> >   and "bpf: compute only the required buffer size for the device"
> >   into this one
> > - ensure the ctx.size is properly bounded by allocated size
> > - s/link_attach/pre_link_attach/
> > - s/array_detached/array_detach/
> > - fix default switch case when doing nothing
> > - reworked hid_bpf_pre_link_attach() to avoid the switch
> >
> > changes in v2:
> > - split the series by bpf/libbpf/hid/selftests and samples
> > - addressed review comments from v1
> > ---
> >  drivers/hid/Makefile   |   1 +
> >  drivers/hid/hid-bpf.c  | 174 +++++++++++++++++++++++++++++++++++++++++
> >  drivers/hid/hid-core.c |  24 +++++-
> >  include/linux/hid.h    |  11 +++
> >  4 files changed, 207 insertions(+), 3 deletions(-)
> >  create mode 100644 drivers/hid/hid-bpf.c
> >
> > diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
> > index 6d3e630e81af..08d2d7619937 100644
> > --- a/drivers/hid/Makefile
> > +++ b/drivers/hid/Makefile
> > @@ -4,6 +4,7 @@
> >  #
> >  hid-y                  := hid-core.o hid-input.o hid-quirks.o
> >  hid-$(CONFIG_DEBUG_FS)         += hid-debug.o
> > +hid-$(CONFIG_BPF)              += hid-bpf.o
> >
> >  obj-$(CONFIG_HID)              += hid.o
> >  obj-$(CONFIG_UHID)             += uhid.o
> > diff --git a/drivers/hid/hid-bpf.c b/drivers/hid/hid-bpf.c
> > new file mode 100644
> > index 000000000000..5060ebcb9979
> > --- /dev/null
> > +++ b/drivers/hid/hid-bpf.c
> > @@ -0,0 +1,174 @@
> > +// SPDX-License-Identifier: GPL-2.0-or-later
> > +/*
> > + *  BPF in HID support for Linux
> > + *
> > + *  Copyright (c) 2022 Benjamin Tissoires
> > + */
> > +
> > +#include <linux/filter.h>
> > +#include <linux/mutex.h>
> > +#include <linux/slab.h>
> > +
> > +#include <uapi/linux/bpf_hid.h>
> > +#include <linux/hid.h>
> > +
> > +static int __hid_bpf_match_sysfs(struct device *dev, const void *data)
> > +{
> > +       struct kernfs_node *kn = dev->kobj.sd;
> > +       struct kernfs_node *uevent_kn;
> > +
> > +       uevent_kn = kernfs_find_and_get_ns(kn, "uevent", NULL);
> > +
> > +       return uevent_kn == data;
> > +}
> > +
> > +static struct hid_device *hid_bpf_fd_to_hdev(int fd)
> > +{
> > +       struct device *dev;
> > +       struct hid_device *hdev;
> > +       struct fd f = fdget(fd);
> > +       struct inode *inode;
> > +       struct kernfs_node *node;
> > +
> > +       if (!f.file) {
> > +               hdev = ERR_PTR(-EBADF);
> > +               goto out;
> > +       }
> > +
> > +       inode = file_inode(f.file);
> > +       node = inode->i_private;
> > +
> > +       dev = bus_find_device(&hid_bus_type, NULL, node, __hid_bpf_match_sysfs);
> > +
> > +       if (dev)
> > +               hdev = to_hid_device(dev);
> > +       else
> > +               hdev = ERR_PTR(-EINVAL);
> > +
> > + out:
> > +       fdput(f);
> > +       return hdev;
> > +}
> > +
> > +static int hid_bpf_pre_link_attach(struct hid_device *hdev, enum bpf_hid_attach_type type)
> > +{
> > +       int err = 0;
> > +       unsigned int i, j, max_report_len = 0;
> > +       unsigned int alloc_size = 0;
> > +
> > +       if (type != BPF_HID_ATTACH_DEVICE_EVENT)
> > +               return 0;
> > +
> > +       /* hdev->bpf.device_data is already allocated, abort */
> > +       if (hdev->bpf.device_data)
> > +               return 0;
> > +
> > +       /* compute the maximum report length for this device */
> > +       for (i = 0; i < HID_REPORT_TYPES; i++) {
> > +               struct hid_report_enum *report_enum = hdev->report_enum + i;
> > +
> > +               for (j = 0; j < HID_MAX_IDS; j++) {
> > +                       struct hid_report *report = report_enum->report_id_hash[j];
> > +
> > +                       if (report)
> > +                               max_report_len = max(max_report_len, hid_report_len(report));
> > +               }
> > +       }
> > +
> > +       /*
> > +        * Give us a little bit of extra space and some predictability in the
> > +        * buffer length we create. This way, we can tell users that they can
> > +        * work on chunks of 64 bytes of memory without having the bpf verifier
> > +        * scream at them.
> > +        */
> > +       alloc_size = DIV_ROUND_UP(max_report_len, 64) * 64;
> > +
> > +       hdev->bpf.device_data = kzalloc(alloc_size, GFP_KERNEL);
> > +       if (!hdev->bpf.device_data)
> > +               err = -ENOMEM;
> > +       else
> > +               hdev->bpf.allocated_data = alloc_size;
> > +
> > +       return err;
> > +}
> > +
> > +static void hid_bpf_array_detach(struct hid_device *hdev, enum bpf_hid_attach_type type)
> > +{
> > +       switch (type) {
> > +       case BPF_HID_ATTACH_DEVICE_EVENT:
> > +               kfree(hdev->bpf.device_data);
> > +               hdev->bpf.device_data = NULL;
> > +               break;
> > +       default:
> > +               /* do nothing */
> > +               break;
> > +       }
> > +}
> > +
> > +static int hid_bpf_run_progs(struct hid_device *hdev, struct hid_bpf_ctx_kern *ctx)
> > +{
> > +       enum bpf_hid_attach_type type;
> > +
> > +       if (!ctx)
> > +               return -EINVAL;
> > +
> > +       switch (ctx->type) {
> > +       case HID_BPF_DEVICE_EVENT:
> > +               type = BPF_HID_ATTACH_DEVICE_EVENT;
> > +               break;
> > +       default:
> > +               return -EINVAL;
> > +       }
> > +
> > +       if (!hdev->bpf.run_array[type])
> > +               return 0;
> > +
> > +       return BPF_PROG_RUN_ARRAY(hdev->bpf.run_array[type], ctx, bpf_prog_run);
> > +}
> > +
> > +u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *data, int *size)
> > +{
> > +       int ret;
> > +       struct hid_bpf_ctx_kern ctx = {
> > +               .type = HID_BPF_DEVICE_EVENT,
> > +               .hdev = hdev,
> > +               .size = *size,
> > +               .data = hdev->bpf.device_data,
> > +               .allocated_size = hdev->bpf.allocated_data,
> > +       };
> > +
> > +       if (bpf_hid_link_empty(&hdev->bpf, BPF_HID_ATTACH_DEVICE_EVENT))
> > +               return data;
> > +
> > +       memset(ctx.data, 0, hdev->bpf.allocated_data);
> > +       memcpy(ctx.data, data, *size);
> > +
> > +       ret = hid_bpf_run_progs(hdev, &ctx);
> > +       if (ret)
> > +               return ERR_PTR(-EIO);
> > +
> > +       if (!ctx.size || ctx.size > ctx.allocated_size)
> > +               return ERR_PTR(-EINVAL);
> > +
> > +       *size = ctx.size;
> > +
> > +       return ctx.data;
> > +}
> > +
> > +int __init hid_bpf_module_init(void)
> > +{
> > +       struct bpf_hid_hooks hooks = {
> > +               .hdev_from_fd = hid_bpf_fd_to_hdev,
> > +               .pre_link_attach = hid_bpf_pre_link_attach,
> > +               .array_detach = hid_bpf_array_detach,
> > +       };
> > +
> > +       bpf_hid_set_hooks(&hooks);
> > +
> > +       return 0;
> > +}
> > +
> > +void __exit hid_bpf_module_exit(void)
> > +{
> > +       bpf_hid_set_hooks(NULL);
> > +}
> > diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> > index f1aed5bbd000..937fab7eb9c6 100644
> > --- a/drivers/hid/hid-core.c
> > +++ b/drivers/hid/hid-core.c
> > @@ -1748,13 +1748,24 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
> >         struct hid_driver *hdrv;
> >         unsigned int a;
> >         u32 rsize, csize = size;
> > -       u8 *cdata = data;
> > +       u8 *cdata;
> >         int ret = 0;
> >
> > +       /* we pre-test if device_data is available here to cut the calls at the earliest */
> > +       if (hid->bpf.device_data) {
> > +               data = hid_bpf_raw_event(hid, data, &size);
> > +               if (IS_ERR(data)) {
> > +                       ret = PTR_ERR(data);
> > +                       goto out;
> > +               }
> > +       }
> > +
> >         report = hid_get_report(report_enum, data);
> >         if (!report)
> >                 goto out;
> >
> > +       cdata = data;
> > +
> >         if (report_enum->numbered) {
> >                 cdata++;
> >                 csize--;
> > @@ -2528,10 +2539,12 @@ int hid_add_device(struct hid_device *hdev)
> >
> >         hid_debug_register(hdev, dev_name(&hdev->dev));
> >         ret = device_add(&hdev->dev);
> > -       if (!ret)
> > +       if (!ret) {
> >                 hdev->status |= HID_STAT_ADDED;
> > -       else
> > +       } else {
> >                 hid_debug_unregister(hdev);
> > +               bpf_hid_exit(hdev);
> > +       }
> >
> >         return ret;
> >  }
> > @@ -2567,6 +2580,7 @@ struct hid_device *hid_allocate_device(void)
> >         spin_lock_init(&hdev->debug_list_lock);
> >         sema_init(&hdev->driver_input_lock, 1);
> >         mutex_init(&hdev->ll_open_lock);
> > +       bpf_hid_init(hdev);
> >
> >         return hdev;
> >  }
> > @@ -2574,6 +2588,7 @@ EXPORT_SYMBOL_GPL(hid_allocate_device);
> >
> >  static void hid_remove_device(struct hid_device *hdev)
> >  {
> > +       bpf_hid_exit(hdev);
> >         if (hdev->status & HID_STAT_ADDED) {
> >                 device_del(&hdev->dev);
> >                 hid_debug_unregister(hdev);
> > @@ -2700,6 +2715,8 @@ static int __init hid_init(void)
> >
> >         hid_debug_init();
> >
> > +       hid_bpf_module_init();
> > +
> >         return 0;
> >  err_bus:
> >         bus_unregister(&hid_bus_type);
> > @@ -2709,6 +2726,7 @@ static int __init hid_init(void)
> >
> >  static void __exit hid_exit(void)
> >  {
> > +       hid_bpf_module_exit();
> >         hid_debug_exit();
> >         hidraw_exit();
> >         bus_unregister(&hid_bus_type);
> > diff --git a/include/linux/hid.h b/include/linux/hid.h
> > index 56f6f4ad45a7..8fd79011f461 100644
> > --- a/include/linux/hid.h
> > +++ b/include/linux/hid.h
> > @@ -27,6 +27,7 @@
> >  #include <linux/mutex.h>
> >  #include <linux/power_supply.h>
> >  #include <uapi/linux/hid.h>
> > +#include <uapi/linux/bpf_hid.h>
> >
> >  /*
> >   * We parse each description item into this structure. Short items data
> > @@ -1210,4 +1211,14 @@ do {                                                                     \
> >  #define hid_dbg_once(hid, fmt, ...)                    \
> >         dev_dbg_once(&(hid)->dev, fmt, ##__VA_ARGS__)
> >
> > +#ifdef CONFIG_BPF
> > +u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *rd, int *size);
> > +int hid_bpf_module_init(void);
> > +void hid_bpf_module_exit(void);
> > +#else
> > +static inline u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *rd, int *size) { return rd; }
> > +static inline int hid_bpf_module_init(void) { return 0; }
> > +static inline void hid_bpf_module_exit(void) {}
> > +#endif
> > +
> >  #endif
> > --
> > 2.35.1
> >
diff mbox series

Patch

diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index 6d3e630e81af..08d2d7619937 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -4,6 +4,7 @@ 
 #
 hid-y			:= hid-core.o hid-input.o hid-quirks.o
 hid-$(CONFIG_DEBUG_FS)		+= hid-debug.o
+hid-$(CONFIG_BPF)		+= hid-bpf.o
 
 obj-$(CONFIG_HID)		+= hid.o
 obj-$(CONFIG_UHID)		+= uhid.o
diff --git a/drivers/hid/hid-bpf.c b/drivers/hid/hid-bpf.c
new file mode 100644
index 000000000000..5060ebcb9979
--- /dev/null
+++ b/drivers/hid/hid-bpf.c
@@ -0,0 +1,174 @@ 
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  BPF in HID support for Linux
+ *
+ *  Copyright (c) 2022 Benjamin Tissoires
+ */
+
+#include <linux/filter.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+
+#include <uapi/linux/bpf_hid.h>
+#include <linux/hid.h>
+
+static int __hid_bpf_match_sysfs(struct device *dev, const void *data)
+{
+	struct kernfs_node *kn = dev->kobj.sd;
+	struct kernfs_node *uevent_kn;
+
+	uevent_kn = kernfs_find_and_get_ns(kn, "uevent", NULL);
+
+	return uevent_kn == data;
+}
+
+static struct hid_device *hid_bpf_fd_to_hdev(int fd)
+{
+	struct device *dev;
+	struct hid_device *hdev;
+	struct fd f = fdget(fd);
+	struct inode *inode;
+	struct kernfs_node *node;
+
+	if (!f.file) {
+		hdev = ERR_PTR(-EBADF);
+		goto out;
+	}
+
+	inode = file_inode(f.file);
+	node = inode->i_private;
+
+	dev = bus_find_device(&hid_bus_type, NULL, node, __hid_bpf_match_sysfs);
+
+	if (dev)
+		hdev = to_hid_device(dev);
+	else
+		hdev = ERR_PTR(-EINVAL);
+
+ out:
+	fdput(f);
+	return hdev;
+}
+
+static int hid_bpf_pre_link_attach(struct hid_device *hdev, enum bpf_hid_attach_type type)
+{
+	int err = 0;
+	unsigned int i, j, max_report_len = 0;
+	unsigned int alloc_size = 0;
+
+	if (type != BPF_HID_ATTACH_DEVICE_EVENT)
+		return 0;
+
+	/* hdev->bpf.device_data is already allocated, abort */
+	if (hdev->bpf.device_data)
+		return 0;
+
+	/* compute the maximum report length for this device */
+	for (i = 0; i < HID_REPORT_TYPES; i++) {
+		struct hid_report_enum *report_enum = hdev->report_enum + i;
+
+		for (j = 0; j < HID_MAX_IDS; j++) {
+			struct hid_report *report = report_enum->report_id_hash[j];
+
+			if (report)
+				max_report_len = max(max_report_len, hid_report_len(report));
+		}
+	}
+
+	/*
+	 * Give us a little bit of extra space and some predictability in the
+	 * buffer length we create. This way, we can tell users that they can
+	 * work on chunks of 64 bytes of memory without having the bpf verifier
+	 * scream at them.
+	 */
+	alloc_size = DIV_ROUND_UP(max_report_len, 64) * 64;
+
+	hdev->bpf.device_data = kzalloc(alloc_size, GFP_KERNEL);
+	if (!hdev->bpf.device_data)
+		err = -ENOMEM;
+	else
+		hdev->bpf.allocated_data = alloc_size;
+
+	return err;
+}
+
+static void hid_bpf_array_detach(struct hid_device *hdev, enum bpf_hid_attach_type type)
+{
+	switch (type) {
+	case BPF_HID_ATTACH_DEVICE_EVENT:
+		kfree(hdev->bpf.device_data);
+		hdev->bpf.device_data = NULL;
+		break;
+	default:
+		/* do nothing */
+		break;
+	}
+}
+
+static int hid_bpf_run_progs(struct hid_device *hdev, struct hid_bpf_ctx_kern *ctx)
+{
+	enum bpf_hid_attach_type type;
+
+	if (!ctx)
+		return -EINVAL;
+
+	switch (ctx->type) {
+	case HID_BPF_DEVICE_EVENT:
+		type = BPF_HID_ATTACH_DEVICE_EVENT;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (!hdev->bpf.run_array[type])
+		return 0;
+
+	return BPF_PROG_RUN_ARRAY(hdev->bpf.run_array[type], ctx, bpf_prog_run);
+}
+
+u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *data, int *size)
+{
+	int ret;
+	struct hid_bpf_ctx_kern ctx = {
+		.type = HID_BPF_DEVICE_EVENT,
+		.hdev = hdev,
+		.size = *size,
+		.data = hdev->bpf.device_data,
+		.allocated_size = hdev->bpf.allocated_data,
+	};
+
+	if (bpf_hid_link_empty(&hdev->bpf, BPF_HID_ATTACH_DEVICE_EVENT))
+		return data;
+
+	memset(ctx.data, 0, hdev->bpf.allocated_data);
+	memcpy(ctx.data, data, *size);
+
+	ret = hid_bpf_run_progs(hdev, &ctx);
+	if (ret)
+		return ERR_PTR(-EIO);
+
+	if (!ctx.size || ctx.size > ctx.allocated_size)
+		return ERR_PTR(-EINVAL);
+
+	*size = ctx.size;
+
+	return ctx.data;
+}
+
+int __init hid_bpf_module_init(void)
+{
+	struct bpf_hid_hooks hooks = {
+		.hdev_from_fd = hid_bpf_fd_to_hdev,
+		.pre_link_attach = hid_bpf_pre_link_attach,
+		.array_detach = hid_bpf_array_detach,
+	};
+
+	bpf_hid_set_hooks(&hooks);
+
+	return 0;
+}
+
+void __exit hid_bpf_module_exit(void)
+{
+	bpf_hid_set_hooks(NULL);
+}
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f1aed5bbd000..937fab7eb9c6 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1748,13 +1748,24 @@  int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
 	struct hid_driver *hdrv;
 	unsigned int a;
 	u32 rsize, csize = size;
-	u8 *cdata = data;
+	u8 *cdata;
 	int ret = 0;
 
+	/* we pre-test if device_data is available here to cut the calls at the earliest */
+	if (hid->bpf.device_data) {
+		data = hid_bpf_raw_event(hid, data, &size);
+		if (IS_ERR(data)) {
+			ret = PTR_ERR(data);
+			goto out;
+		}
+	}
+
 	report = hid_get_report(report_enum, data);
 	if (!report)
 		goto out;
 
+	cdata = data;
+
 	if (report_enum->numbered) {
 		cdata++;
 		csize--;
@@ -2528,10 +2539,12 @@  int hid_add_device(struct hid_device *hdev)
 
 	hid_debug_register(hdev, dev_name(&hdev->dev));
 	ret = device_add(&hdev->dev);
-	if (!ret)
+	if (!ret) {
 		hdev->status |= HID_STAT_ADDED;
-	else
+	} else {
 		hid_debug_unregister(hdev);
+		bpf_hid_exit(hdev);
+	}
 
 	return ret;
 }
@@ -2567,6 +2580,7 @@  struct hid_device *hid_allocate_device(void)
 	spin_lock_init(&hdev->debug_list_lock);
 	sema_init(&hdev->driver_input_lock, 1);
 	mutex_init(&hdev->ll_open_lock);
+	bpf_hid_init(hdev);
 
 	return hdev;
 }
@@ -2574,6 +2588,7 @@  EXPORT_SYMBOL_GPL(hid_allocate_device);
 
 static void hid_remove_device(struct hid_device *hdev)
 {
+	bpf_hid_exit(hdev);
 	if (hdev->status & HID_STAT_ADDED) {
 		device_del(&hdev->dev);
 		hid_debug_unregister(hdev);
@@ -2700,6 +2715,8 @@  static int __init hid_init(void)
 
 	hid_debug_init();
 
+	hid_bpf_module_init();
+
 	return 0;
 err_bus:
 	bus_unregister(&hid_bus_type);
@@ -2709,6 +2726,7 @@  static int __init hid_init(void)
 
 static void __exit hid_exit(void)
 {
+	hid_bpf_module_exit();
 	hid_debug_exit();
 	hidraw_exit();
 	bus_unregister(&hid_bus_type);
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 56f6f4ad45a7..8fd79011f461 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -27,6 +27,7 @@ 
 #include <linux/mutex.h>
 #include <linux/power_supply.h>
 #include <uapi/linux/hid.h>
+#include <uapi/linux/bpf_hid.h>
 
 /*
  * We parse each description item into this structure. Short items data
@@ -1210,4 +1211,14 @@  do {									\
 #define hid_dbg_once(hid, fmt, ...)			\
 	dev_dbg_once(&(hid)->dev, fmt, ##__VA_ARGS__)
 
+#ifdef CONFIG_BPF
+u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *rd, int *size);
+int hid_bpf_module_init(void);
+void hid_bpf_module_exit(void);
+#else
+static inline u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *rd, int *size) { return rd; }
+static inline int hid_bpf_module_init(void) { return 0; }
+static inline void hid_bpf_module_exit(void) {}
+#endif
+
 #endif