HID: bpf: add HID-BPF hooks for hid_hw_output_report

Same story than hid_hw_raw_requests:

This allows to intercept and prevent or change the behavior of
hid_hw_output_report() from a bpf program.

The intent is to solve a couple of use case:
  - firewalling a HID device: a firewall can monitor who opens the hidraw
    nodes and then prevent or allow access to write operations on that
    hidraw node.
  - change the behavior of a device and emulate a new HID feature request

The hook is allowed to be run as sleepable so it can itself call
hid_hw_output_report(), which allows to "convert" one feature request into
another or even call the feature request on a different HID device on the
same physical device.

Link: https://patch.msgid.link/20240626-hid_hw_req_bpf-v2-7-cfd60fb6c79f@kernel.org
Acked-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c
index 61c02538e5913072280d875991954b98daa27d2f..fb12b399fc25bba4adf2e816e4a0559ba0c15a5e 100644 (file)
--- a/drivers/hid/bpf/hid_bpf_dispatch.c
+++ b/drivers/hid/bpf/hid_bpf_dispatch.c
@@ -113,6 +113,40 @@ out:
 }
 EXPORT_SYMBOL_GPL(dispatch_hid_bpf_raw_requests);
 
+int dispatch_hid_bpf_output_report(struct hid_device *hdev,
+                                  __u8 *buf, u32 size, __u64 source,
+                                  bool from_bpf)
+{
+       struct hid_bpf_ctx_kern ctx_kern = {
+               .ctx = {
+                       .hid = hdev,
+                       .allocated_size = size,
+                       .size = size,
+               },
+               .data = buf,
+               .from_bpf = from_bpf,
+       };
+       struct hid_bpf_ops *e;
+       int ret, idx;
+
+       idx = srcu_read_lock(&hdev->bpf.srcu);
+       list_for_each_entry_srcu(e, &hdev->bpf.prog_list, list,
+                                srcu_read_lock_held(&hdev->bpf.srcu)) {
+               if (!e->hid_hw_output_report)
+                       continue;
+
+               ret = e->hid_hw_output_report(&ctx_kern.ctx, source);
+               if (ret)
+                       goto out;
+       }
+       ret = 0;
+
+out:
+       srcu_read_unlock(&hdev->bpf.srcu, idx);
+       return ret;
+}
+EXPORT_SYMBOL_GPL(dispatch_hid_bpf_output_report);
+
 u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, u8 *rdesc, unsigned int *size)
 {
        int ret;
@@ -443,10 +477,7 @@ hid_bpf_hw_output_report(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz)
        if (!dma_data)
                return -ENOMEM;
 
-       ret = hid_ops->hid_hw_output_report(hdev,
-                                               dma_data,
-                                               size,
-                                               (__u64)ctx);
+       ret = hid_ops->hid_hw_output_report(hdev, dma_data, size, (__u64)ctx, true);
 
        kfree(dma_data);
        return ret;

diff --git a/drivers/hid/bpf/hid_bpf_struct_ops.c b/drivers/hid/bpf/hid_bpf_struct_ops.c
index a540a44171740edbdf3a02d267ccdf0973c1bcdc..37d2f8e2413a91630aa8acdddb925b265e7a614a 100644 (file)
--- a/drivers/hid/bpf/hid_bpf_struct_ops.c
+++ b/drivers/hid/bpf/hid_bpf_struct_ops.c
@@ -45,6 +45,7 @@ static int hid_bpf_ops_check_member(const struct btf_type *t,
        switch (moff) {
        case offsetof(struct hid_bpf_ops, hid_rdesc_fixup):
        case offsetof(struct hid_bpf_ops, hid_hw_request):
+       case offsetof(struct hid_bpf_ops, hid_hw_output_report):
                break;
        default:
                if (prog->sleepable)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 2038ba08eaa16a241aa64fb91a09487295f6b9f6..bb6f334f05bd755601a218e63ace0f3bde233851 100644 (file)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2445,9 +2445,11 @@ int hid_hw_raw_request(struct hid_device *hdev,
 }
 EXPORT_SYMBOL_GPL(hid_hw_raw_request);
 
-int __hid_hw_output_report(struct hid_device *hdev, __u8 *buf, size_t len, __u64 source)
+int __hid_hw_output_report(struct hid_device *hdev, __u8 *buf, size_t len, __u64 source,
+                          bool from_bpf)
 {
        unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
+       int ret;
 
        if (hdev->ll_driver->max_buffer_size)
                max_buffer_size = hdev->ll_driver->max_buffer_size;
@@ -2455,6 +2457,10 @@ int __hid_hw_output_report(struct hid_device *hdev, __u8 *buf, size_t len, __u64
        if (len < 1 || len > max_buffer_size || !buf)
                return -EINVAL;
 
+       ret = dispatch_hid_bpf_output_report(hdev, buf, len, source, from_bpf);
+       if (ret)
+               return ret;
+
        if (hdev->ll_driver->output_report)
                return hdev->ll_driver->output_report(hdev, buf, len);
 
@@ -2472,7 +2478,7 @@ int __hid_hw_output_report(struct hid_device *hdev, __u8 *buf, size_t len, __u64
  */
 int hid_hw_output_report(struct hid_device *hdev, __u8 *buf, size_t len)
 {
-       return __hid_hw_output_report(hdev, buf, len, 0);
+       return __hid_hw_output_report(hdev, buf, len, 0, false);
 }
 EXPORT_SYMBOL_GPL(hid_hw_output_report);
 

diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 4ba3131de61498a49fb41f4133e766f5d358f0c8..c2396916cdaa7ee3fc59818b87b53ea7e21e015b 100644 (file)
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -140,7 +140,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
 
        if ((report_type == HID_OUTPUT_REPORT) &&
            !(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) {
-               ret = __hid_hw_output_report(dev, buf, count, (__u64)file);
+               ret = __hid_hw_output_report(dev, buf, count, (__u64)file, false);
                /*
                 * compatibility with old implementation of USB-HID and I2C-HID:
                 * if the device does not support receiving output reports,

diff --git a/include/linux/hid.h b/include/linux/hid.h
index 24d0d7c0bd33964ed0a71be2ffcc35f557fdb26a..1533c9dcd3a67fa3523ef97d8d60880c70f338bf 100644 (file)
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1130,7 +1130,8 @@ int __hid_hw_raw_request(struct hid_device *hdev,
                         size_t len, enum hid_report_type rtype,
                         enum hid_class_request reqtype,
                         __u64 source, bool from_bpf);
-int __hid_hw_output_report(struct hid_device *hdev, __u8 *buf, size_t len, __u64 source);
+int __hid_hw_output_report(struct hid_device *hdev, __u8 *buf, size_t len, __u64 source,
+                          bool from_bpf);
 int hid_hw_raw_request(struct hid_device *hdev,
                       unsigned char reportnum, __u8 *buf,
                       size_t len, enum hid_report_type rtype,

diff --git a/include/linux/hid_bpf.h b/include/linux/hid_bpf.h
index 088c94b6d8ec8919db1d802b0818768c26684e9b..f35508a73067e0f5f8a192f86872cb467e5db17c 100644 (file)
--- a/include/linux/hid_bpf.h
+++ b/include/linux/hid_bpf.h
@@ -70,7 +70,7 @@ struct hid_ops {
                                  enum hid_class_request reqtype,
                                  __u64 source, bool from_bpf);
        int (*hid_hw_output_report)(struct hid_device *hdev, __u8 *buf, size_t len,
-                                   __u64 source);
+                                   __u64 source, bool from_bpf);
        int (*hid_input_report)(struct hid_device *hid, enum hid_report_type type,
                                u8 *data, u32 size, int interrupt, u64 source);
        struct module *owner;
@@ -154,6 +154,24 @@ struct hid_bpf_ops {
                               enum hid_report_type rtype, enum hid_class_request reqtype,
                               __u64 source);
 
+       /**
+        * @hid_hw_output_report: called whenever a hid_hw_output_report() call is emitted
+        * on the HID device
+        *
+        * It has the following arguments:
+        *
+        * ``ctx``: The HID-BPF context as &struct hid_bpf_ctx
+        * ``source``: a u64 referring to a uniq but identifiable source. If %0, the
+        *             kernel itself emitted that call. For hidraw, ``source`` is set
+        *             to the associated ``struct file *``.
+        *
+        * Return: %0 to keep processing the request by hid-core; any other value
+        * stops hid-core from processing that event. A positive value should be
+        * returned with the number of bytes written to the device; a negative error
+        * code interrupts the processing of this call.
+        */
+       int (*hid_hw_output_report)(struct hid_bpf_ctx *ctx, __u64 source);
+
 
        /* private: do not show up in the docs */
        struct hid_device *hdev;
@@ -182,6 +200,8 @@ int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
                                  u32 size, enum hid_report_type rtype,
                                  enum hid_class_request reqtype,
                                  __u64 source, bool from_bpf);
+int dispatch_hid_bpf_output_report(struct hid_device *hdev, __u8 *buf, u32 size,
+                                  __u64 source, bool from_bpf);
 int hid_bpf_connect_device(struct hid_device *hdev);
 void hid_bpf_disconnect_device(struct hid_device *hdev);
 void hid_bpf_destroy_device(struct hid_device *hid);
@@ -196,6 +216,8 @@ static inline int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
                                                u32 size, enum hid_report_type rtype,
                                                enum hid_class_request reqtype,
                                                u64 source, bool from_bpf) { return 0; }
+static inline int dispatch_hid_bpf_output_report(struct hid_device *hdev, __u8 *buf, u32 size,
+                                                __u64 source, bool from_bpf) { return 0; }
 static inline int hid_bpf_connect_device(struct hid_device *hdev) { return 0; }
 static inline void hid_bpf_disconnect_device(struct hid_device *hdev) {}
 static inline void hid_bpf_destroy_device(struct hid_device *hid) {}