1
2
3
4
5
6#include <linux/bpf.h>
7#include <linux/filter.h>
8#include <linux/bpf_lirc.h>
9#include "rc-core-priv.h"
10
11#define lirc_rcu_dereference(p) \
12 rcu_dereference_protected(p, lockdep_is_held(&ir_raw_handler_lock))
13
14
15
16
17const struct bpf_prog_ops lirc_mode2_prog_ops = {
18};
19
20BPF_CALL_1(bpf_rc_repeat, u32*, sample)
21{
22 struct ir_raw_event_ctrl *ctrl;
23
24 ctrl = container_of(sample, struct ir_raw_event_ctrl, bpf_sample);
25
26 rc_repeat(ctrl->dev);
27
28 return 0;
29}
30
31static const struct bpf_func_proto rc_repeat_proto = {
32 .func = bpf_rc_repeat,
33 .gpl_only = true,
34 .ret_type = RET_INTEGER,
35 .arg1_type = ARG_PTR_TO_CTX,
36};
37
38BPF_CALL_4(bpf_rc_keydown, u32*, sample, u32, protocol, u64, scancode,
39 u32, toggle)
40{
41 struct ir_raw_event_ctrl *ctrl;
42
43 ctrl = container_of(sample, struct ir_raw_event_ctrl, bpf_sample);
44
45 rc_keydown(ctrl->dev, protocol, scancode, toggle != 0);
46
47 return 0;
48}
49
50static const struct bpf_func_proto rc_keydown_proto = {
51 .func = bpf_rc_keydown,
52 .gpl_only = true,
53 .ret_type = RET_INTEGER,
54 .arg1_type = ARG_PTR_TO_CTX,
55 .arg2_type = ARG_ANYTHING,
56 .arg3_type = ARG_ANYTHING,
57 .arg4_type = ARG_ANYTHING,
58};
59
60BPF_CALL_3(bpf_rc_pointer_rel, u32*, sample, s32, rel_x, s32, rel_y)
61{
62 struct ir_raw_event_ctrl *ctrl;
63
64 ctrl = container_of(sample, struct ir_raw_event_ctrl, bpf_sample);
65
66 input_report_rel(ctrl->dev->input_dev, REL_X, rel_x);
67 input_report_rel(ctrl->dev->input_dev, REL_Y, rel_y);
68 input_sync(ctrl->dev->input_dev);
69
70 return 0;
71}
72
73static const struct bpf_func_proto rc_pointer_rel_proto = {
74 .func = bpf_rc_pointer_rel,
75 .gpl_only = true,
76 .ret_type = RET_INTEGER,
77 .arg1_type = ARG_PTR_TO_CTX,
78 .arg2_type = ARG_ANYTHING,
79 .arg3_type = ARG_ANYTHING,
80};
81
82static const struct bpf_func_proto *
83lirc_mode2_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
84{
85 switch (func_id) {
86 case BPF_FUNC_rc_repeat:
87 return &rc_repeat_proto;
88 case BPF_FUNC_rc_keydown:
89 return &rc_keydown_proto;
90 case BPF_FUNC_rc_pointer_rel:
91 return &rc_pointer_rel_proto;
92 case BPF_FUNC_map_lookup_elem:
93 return &bpf_map_lookup_elem_proto;
94 case BPF_FUNC_map_update_elem:
95 return &bpf_map_update_elem_proto;
96 case BPF_FUNC_map_delete_elem:
97 return &bpf_map_delete_elem_proto;
98 case BPF_FUNC_map_push_elem:
99 return &bpf_map_push_elem_proto;
100 case BPF_FUNC_map_pop_elem:
101 return &bpf_map_pop_elem_proto;
102 case BPF_FUNC_map_peek_elem:
103 return &bpf_map_peek_elem_proto;
104 case BPF_FUNC_ktime_get_ns:
105 return &bpf_ktime_get_ns_proto;
106 case BPF_FUNC_tail_call:
107 return &bpf_tail_call_proto;
108 case BPF_FUNC_get_prandom_u32:
109 return &bpf_get_prandom_u32_proto;
110 case BPF_FUNC_trace_printk:
111 if (capable(CAP_SYS_ADMIN))
112 return bpf_get_trace_printk_proto();
113
114 default:
115 return NULL;
116 }
117}
118
119static bool lirc_mode2_is_valid_access(int off, int size,
120 enum bpf_access_type type,
121 const struct bpf_prog *prog,
122 struct bpf_insn_access_aux *info)
123{
124
125 return type == BPF_READ && off == 0 && size == sizeof(u32);
126}
127
128const struct bpf_verifier_ops lirc_mode2_verifier_ops = {
129 .get_func_proto = lirc_mode2_func_proto,
130 .is_valid_access = lirc_mode2_is_valid_access
131};
132
133#define BPF_MAX_PROGS 64
134
135static int lirc_bpf_attach(struct rc_dev *rcdev, struct bpf_prog *prog)
136{
137 struct bpf_prog_array *old_array;
138 struct bpf_prog_array *new_array;
139 struct ir_raw_event_ctrl *raw;
140 int ret;
141
142 if (rcdev->driver_type != RC_DRIVER_IR_RAW)
143 return -EINVAL;
144
145 ret = mutex_lock_interruptible(&ir_raw_handler_lock);
146 if (ret)
147 return ret;
148
149 raw = rcdev->raw;
150 if (!raw) {
151 ret = -ENODEV;
152 goto unlock;
153 }
154
155 old_array = lirc_rcu_dereference(raw->progs);
156 if (old_array && bpf_prog_array_length(old_array) >= BPF_MAX_PROGS) {
157 ret = -E2BIG;
158 goto unlock;
159 }
160
161 ret = bpf_prog_array_copy(old_array, NULL, prog, &new_array);
162 if (ret < 0)
163 goto unlock;
164
165 rcu_assign_pointer(raw->progs, new_array);
166 bpf_prog_array_free(old_array);
167
168unlock:
169 mutex_unlock(&ir_raw_handler_lock);
170 return ret;
171}
172
173static int lirc_bpf_detach(struct rc_dev *rcdev, struct bpf_prog *prog)
174{
175 struct bpf_prog_array *old_array;
176 struct bpf_prog_array *new_array;
177 struct ir_raw_event_ctrl *raw;
178 int ret;
179
180 if (rcdev->driver_type != RC_DRIVER_IR_RAW)
181 return -EINVAL;
182
183 ret = mutex_lock_interruptible(&ir_raw_handler_lock);
184 if (ret)
185 return ret;
186
187 raw = rcdev->raw;
188 if (!raw) {
189 ret = -ENODEV;
190 goto unlock;
191 }
192
193 old_array = lirc_rcu_dereference(raw->progs);
194 ret = bpf_prog_array_copy(old_array, prog, NULL, &new_array);
195
196
197
198
199
200 if (ret)
201 goto unlock;
202
203 rcu_assign_pointer(raw->progs, new_array);
204 bpf_prog_array_free(old_array);
205 bpf_prog_put(prog);
206unlock:
207 mutex_unlock(&ir_raw_handler_lock);
208 return ret;
209}
210
211void lirc_bpf_run(struct rc_dev *rcdev, u32 sample)
212{
213 struct ir_raw_event_ctrl *raw = rcdev->raw;
214
215 raw->bpf_sample = sample;
216
217 if (raw->progs)
218 BPF_PROG_RUN_ARRAY(raw->progs, &raw->bpf_sample, BPF_PROG_RUN);
219}
220
221
222
223
224
225
226
227void lirc_bpf_free(struct rc_dev *rcdev)
228{
229 struct bpf_prog_array_item *item;
230 struct bpf_prog_array *array;
231
232 array = lirc_rcu_dereference(rcdev->raw->progs);
233 if (!array)
234 return;
235
236 for (item = array->items; item->prog; item++)
237 bpf_prog_put(item->prog);
238
239 bpf_prog_array_free(array);
240}
241
242int lirc_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
243{
244 struct rc_dev *rcdev;
245 int ret;
246
247 if (attr->attach_flags)
248 return -EINVAL;
249
250 rcdev = rc_dev_get_from_fd(attr->target_fd);
251 if (IS_ERR(rcdev))
252 return PTR_ERR(rcdev);
253
254 ret = lirc_bpf_attach(rcdev, prog);
255
256 put_device(&rcdev->dev);
257
258 return ret;
259}
260
261int lirc_prog_detach(const union bpf_attr *attr)
262{
263 struct bpf_prog *prog;
264 struct rc_dev *rcdev;
265 int ret;
266
267 if (attr->attach_flags)
268 return -EINVAL;
269
270 prog = bpf_prog_get_type(attr->attach_bpf_fd,
271 BPF_PROG_TYPE_LIRC_MODE2);
272 if (IS_ERR(prog))
273 return PTR_ERR(prog);
274
275 rcdev = rc_dev_get_from_fd(attr->target_fd);
276 if (IS_ERR(rcdev)) {
277 bpf_prog_put(prog);
278 return PTR_ERR(rcdev);
279 }
280
281 ret = lirc_bpf_detach(rcdev, prog);
282
283 bpf_prog_put(prog);
284 put_device(&rcdev->dev);
285
286 return ret;
287}
288
289int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)
290{
291 __u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids);
292 struct bpf_prog_array *progs;
293 struct rc_dev *rcdev;
294 u32 cnt, flags = 0;
295 int ret;
296
297 if (attr->query.query_flags)
298 return -EINVAL;
299
300 rcdev = rc_dev_get_from_fd(attr->query.target_fd);
301 if (IS_ERR(rcdev))
302 return PTR_ERR(rcdev);
303
304 if (rcdev->driver_type != RC_DRIVER_IR_RAW) {
305 ret = -EINVAL;
306 goto put;
307 }
308
309 ret = mutex_lock_interruptible(&ir_raw_handler_lock);
310 if (ret)
311 goto put;
312
313 progs = lirc_rcu_dereference(rcdev->raw->progs);
314 cnt = progs ? bpf_prog_array_length(progs) : 0;
315
316 if (copy_to_user(&uattr->query.prog_cnt, &cnt, sizeof(cnt))) {
317 ret = -EFAULT;
318 goto unlock;
319 }
320
321 if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags))) {
322 ret = -EFAULT;
323 goto unlock;
324 }
325
326 if (attr->query.prog_cnt != 0 && prog_ids && cnt)
327 ret = bpf_prog_array_copy_to_user(progs, prog_ids, cnt);
328
329unlock:
330 mutex_unlock(&ir_raw_handler_lock);
331put:
332 put_device(&rcdev->dev);
333
334 return ret;
335}
336
