Signed-off-by: Benjamin Tissoires <redacted>

---

changes in v3:
- squashed "only call hid_bpf_raw_event() if a ctx is available"
  and "bpf: compute only the required buffer size for the device"
  into this one
- ensure the ctx.size is properly bounded by allocated size
- s/link_attach/pre_link_attach/
- s/array_detached/array_detach/
- fix default switch case when doing nothing
- reworked hid_bpf_pre_link_attach() to avoid the switch

changes in v2:
- split the series by bpf/libbpf/hid/selftests and samples
- addressed review comments from v1
---
 drivers/hid/Makefile   |   1 +
 drivers/hid/hid-bpf.c  | 174 +++++++++++++++++++++++++++++++++++++++++
 drivers/hid/hid-core.c |  24 +++++-
 include/linux/hid.h    |  11 +++
 4 files changed, 207 insertions(+), 3 deletions(-)
 create mode 100644 drivers/hid/hid-bpf.c

diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index 6d3e630e81af..08d2d7619937 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile

@@ -4,6 +4,7 @@
 #
 hid-y                  := hid-core.o hid-input.o hid-quirks.o
 hid-$(CONFIG_DEBUG_FS)         += hid-debug.o
+hid-$(CONFIG_BPF)              += hid-bpf.o

 obj-$(CONFIG_HID)              += hid.o
 obj-$(CONFIG_UHID)             += uhid.o

diff --git a/drivers/hid/hid-bpf.c b/drivers/hid/hid-bpf.c
new file mode 100644
index 000000000000..5060ebcb9979
--- /dev/null
+++ b/drivers/hid/hid-bpf.c

@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  BPF in HID support for Linux
+ *
+ *  Copyright (c) 2022 Benjamin Tissoires
+ */
+
+#include <linux/filter.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+
+#include <uapi/linux/bpf_hid.h>
+#include <linux/hid.h>
+
+static int __hid_bpf_match_sysfs(struct device *dev, const void *data)
+{
+       struct kernfs_node *kn = dev->kobj.sd;
+       struct kernfs_node *uevent_kn;
+
+       uevent_kn = kernfs_find_and_get_ns(kn, "uevent", NULL);
+
+       return uevent_kn == data;
+}
+
+static struct hid_device *hid_bpf_fd_to_hdev(int fd)
+{
+       struct device *dev;
+       struct hid_device *hdev;
+       struct fd f = fdget(fd);
+       struct inode *inode;
+       struct kernfs_node *node;
+
+       if (!f.file) {
+               hdev = ERR_PTR(-EBADF);
+               goto out;
+       }
+
+       inode = file_inode(f.file);
+       node = inode->i_private;
+
+       dev = bus_find_device(&hid_bus_type, NULL, node, __hid_bpf_match_sysfs);
+
+       if (dev)
+               hdev = to_hid_device(dev);
+       else
+               hdev = ERR_PTR(-EINVAL);
+
+ out:
+       fdput(f);
+       return hdev;
+}
+
+static int hid_bpf_pre_link_attach(struct hid_device *hdev, enum bpf_hid_attach_type type)
+{
+       int err = 0;
+       unsigned int i, j, max_report_len = 0;
+       unsigned int alloc_size = 0;
+
+       if (type != BPF_HID_ATTACH_DEVICE_EVENT)
+               return 0;
+
+       /* hdev->bpf.device_data is already allocated, abort */
+       if (hdev->bpf.device_data)
+               return 0;
+
+       /* compute the maximum report length for this device */
+       for (i = 0; i < HID_REPORT_TYPES; i++) {
+               struct hid_report_enum *report_enum = hdev->report_enum + i;
+
+               for (j = 0; j < HID_MAX_IDS; j++) {
+                       struct hid_report *report = report_enum->report_id_hash[j];
+
+                       if (report)
+                               max_report_len = max(max_report_len, hid_report_len(report));
+               }
+       }
+
+       /*
+        * Give us a little bit of extra space and some predictability in the
+        * buffer length we create. This way, we can tell users that they can
+        * work on chunks of 64 bytes of memory without having the bpf verifier
+        * scream at them.
+        */
+       alloc_size = DIV_ROUND_UP(max_report_len, 64) * 64;
+
+       hdev->bpf.device_data = kzalloc(alloc_size, GFP_KERNEL);
+       if (!hdev->bpf.device_data)
+               err = -ENOMEM;
+       else
+               hdev->bpf.allocated_data = alloc_size;
+
+       return err;
+}
+
+static void hid_bpf_array_detach(struct hid_device *hdev, enum bpf_hid_attach_type type)
+{
+       switch (type) {
+       case BPF_HID_ATTACH_DEVICE_EVENT:
+               kfree(hdev->bpf.device_data);
+               hdev->bpf.device_data = NULL;
+               break;
+       default:
+               /* do nothing */
+               break;
+       }
+}
+
+static int hid_bpf_run_progs(struct hid_device *hdev, struct hid_bpf_ctx_kern *ctx)
+{
+       enum bpf_hid_attach_type type;
+
+       if (!ctx)
+               return -EINVAL;
+
+       switch (ctx->type) {
+       case HID_BPF_DEVICE_EVENT:
+               type = BPF_HID_ATTACH_DEVICE_EVENT;
+               break;
+       default:
+               return -EINVAL;
+       }
+
+       if (!hdev->bpf.run_array[type])
+               return 0;
+
+       return BPF_PROG_RUN_ARRAY(hdev->bpf.run_array[type], ctx, bpf_prog_run);
+}
+
+u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *data, int *size)
+{
+       int ret;
+       struct hid_bpf_ctx_kern ctx = {
+               .type = HID_BPF_DEVICE_EVENT,
+               .hdev = hdev,
+               .size = *size,
+               .data = hdev->bpf.device_data,
+               .allocated_size = hdev->bpf.allocated_data,
+       };
+
+       if (bpf_hid_link_empty(&hdev->bpf, BPF_HID_ATTACH_DEVICE_EVENT))
+               return data;
+
+       memset(ctx.data, 0, hdev->bpf.allocated_data);
+       memcpy(ctx.data, data, *size);
+
+       ret = hid_bpf_run_progs(hdev, &ctx);
+       if (ret)
+               return ERR_PTR(-EIO);
+
+       if (!ctx.size || ctx.size > ctx.allocated_size)
+               return ERR_PTR(-EINVAL);
+
+       *size = ctx.size;
+
+       return ctx.data;
+}
+
+int __init hid_bpf_module_init(void)
+{
+       struct bpf_hid_hooks hooks = {
+               .hdev_from_fd = hid_bpf_fd_to_hdev,
+               .pre_link_attach = hid_bpf_pre_link_attach,
+               .array_detach = hid_bpf_array_detach,
+       };
+
+       bpf_hid_set_hooks(&hooks);
+
+       return 0;
+}
+
+void __exit hid_bpf_module_exit(void)
+{
+       bpf_hid_set_hooks(NULL);
+}

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f1aed5bbd000..937fab7eb9c6 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c

@@ -1748,13 +1748,24 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
        struct hid_driver *hdrv;
        unsigned int a;
        u32 rsize, csize = size;
-       u8 *cdata = data;
+       u8 *cdata;
        int ret = 0;

+       /* we pre-test if device_data is available here to cut the calls at the earliest */
+       if (hid->bpf.device_data) {
+               data = hid_bpf_raw_event(hid, data, &size);
+               if (IS_ERR(data)) {
+                       ret = PTR_ERR(data);
+                       goto out;
+               }
+       }
+
        report = hid_get_report(report_enum, data);
        if (!report)
                goto out;

+       cdata = data;
+
        if (report_enum->numbered) {
                cdata++;
                csize--;

@@ -2528,10 +2539,12 @@ int hid_add_device(struct hid_device *hdev)

        hid_debug_register(hdev, dev_name(&hdev->dev));
        ret = device_add(&hdev->dev);
-       if (!ret)
+       if (!ret) {
                hdev->status |= HID_STAT_ADDED;
-       else
+       } else {
                hid_debug_unregister(hdev);
+               bpf_hid_exit(hdev);
+       }

        return ret;
 }

@@ -2567,6 +2580,7 @@ struct hid_device *hid_allocate_device(void)
        spin_lock_init(&hdev->debug_list_lock);
        sema_init(&hdev->driver_input_lock, 1);
        mutex_init(&hdev->ll_open_lock);
+       bpf_hid_init(hdev);

        return hdev;
 }

@@ -2574,6 +2588,7 @@ EXPORT_SYMBOL_GPL(hid_allocate_device);

 static void hid_remove_device(struct hid_device *hdev)
 {
+       bpf_hid_exit(hdev);
        if (hdev->status & HID_STAT_ADDED) {
                device_del(&hdev->dev);
                hid_debug_unregister(hdev);

@@ -2700,6 +2715,8 @@ static int __init hid_init(void)

        hid_debug_init();

+       hid_bpf_module_init();
+
        return 0;
 err_bus:
        bus_unregister(&hid_bus_type);

@@ -2709,6 +2726,7 @@ static int __init hid_init(void)

 static void __exit hid_exit(void)
 {
+       hid_bpf_module_exit();
        hid_debug_exit();
        hidraw_exit();
        bus_unregister(&hid_bus_type);

diff --git a/include/linux/hid.h b/include/linux/hid.h
index 56f6f4ad45a7..8fd79011f461 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h

@@ -27,6 +27,7 @@
 #include <linux/mutex.h>
 #include <linux/power_supply.h>
 #include <uapi/linux/hid.h>
+#include <uapi/linux/bpf_hid.h>

 /*
  * We parse each description item into this structure. Short items data

@@ -1210,4 +1211,14 @@ do {                                                                     \
 #define hid_dbg_once(hid, fmt, ...)                    \
        dev_dbg_once(&(hid)->dev, fmt, ##__VA_ARGS__)

+#ifdef CONFIG_BPF
+u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *rd, int *size);
+int hid_bpf_module_init(void);
+void hid_bpf_module_exit(void);
+#else
+static inline u8 *hid_bpf_raw_event(struct hid_device *hdev, u8 *rd, int *size) { return rd; }
+static inline int hid_bpf_module_init(void) { return 0; }
+static inline void hid_bpf_module_exit(void) {}
+#endif
+
 #endif
--

2.35.1