hc
2024-05-13 9d77db3c730780c8ef5ccd4b66403ff5675cfe4e
kernel/drivers/media/rc/bpf-lirc.c
....@@ -8,6 +8,9 @@
88 #include <linux/bpf_lirc.h>
99 #include "rc-core-priv.h"
1010
11
+#define lirc_rcu_dereference(p) \
12
+ rcu_dereference_protected(p, lockdep_is_held(&ir_raw_handler_lock))
13
+
1114 /*
1215 * BPF interface for raw IR
1316 */
....@@ -32,11 +35,6 @@
3235 .arg1_type = ARG_PTR_TO_CTX,
3336 };
3437
35
-/*
36
- * Currently rc-core does not support 64-bit scancodes, but there are many
37
- * known protocols with more than 32 bits. So, define the interface as u64
38
- * as a future-proof.
39
- */
4038 BPF_CALL_4(bpf_rc_keydown, u32*, sample, u32, protocol, u64, scancode,
4139 u32, toggle)
4240 {
....@@ -59,6 +57,28 @@
5957 .arg4_type = ARG_ANYTHING,
6058 };
6159
60
+BPF_CALL_3(bpf_rc_pointer_rel, u32*, sample, s32, rel_x, s32, rel_y)
61
+{
62
+ struct ir_raw_event_ctrl *ctrl;
63
+
64
+ ctrl = container_of(sample, struct ir_raw_event_ctrl, bpf_sample);
65
+
66
+ input_report_rel(ctrl->dev->input_dev, REL_X, rel_x);
67
+ input_report_rel(ctrl->dev->input_dev, REL_Y, rel_y);
68
+ input_sync(ctrl->dev->input_dev);
69
+
70
+ return 0;
71
+}
72
+
73
+static const struct bpf_func_proto rc_pointer_rel_proto = {
74
+ .func = bpf_rc_pointer_rel,
75
+ .gpl_only = true,
76
+ .ret_type = RET_INTEGER,
77
+ .arg1_type = ARG_PTR_TO_CTX,
78
+ .arg2_type = ARG_ANYTHING,
79
+ .arg3_type = ARG_ANYTHING,
80
+};
81
+
6282 static const struct bpf_func_proto *
6383 lirc_mode2_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
6484 {
....@@ -67,12 +87,20 @@
6787 return &rc_repeat_proto;
6888 case BPF_FUNC_rc_keydown:
6989 return &rc_keydown_proto;
90
+ case BPF_FUNC_rc_pointer_rel:
91
+ return &rc_pointer_rel_proto;
7092 case BPF_FUNC_map_lookup_elem:
7193 return &bpf_map_lookup_elem_proto;
7294 case BPF_FUNC_map_update_elem:
7395 return &bpf_map_update_elem_proto;
7496 case BPF_FUNC_map_delete_elem:
7597 return &bpf_map_delete_elem_proto;
98
+ case BPF_FUNC_map_push_elem:
99
+ return &bpf_map_push_elem_proto;
100
+ case BPF_FUNC_map_pop_elem:
101
+ return &bpf_map_pop_elem_proto;
102
+ case BPF_FUNC_map_peek_elem:
103
+ return &bpf_map_peek_elem_proto;
76104 case BPF_FUNC_ktime_get_ns:
77105 return &bpf_ktime_get_ns_proto;
78106 case BPF_FUNC_ktime_get_boot_ns:
....@@ -82,9 +110,9 @@
82110 case BPF_FUNC_get_prandom_u32:
83111 return &bpf_get_prandom_u32_proto;
84112 case BPF_FUNC_trace_printk:
85
- if (capable(CAP_SYS_ADMIN))
113
+ if (perfmon_capable())
86114 return bpf_get_trace_printk_proto();
87
- /* fall through */
115
+ fallthrough;
88116 default:
89117 return NULL;
90118 }
....@@ -108,7 +136,7 @@
108136
109137 static int lirc_bpf_attach(struct rc_dev *rcdev, struct bpf_prog *prog)
110138 {
111
- struct bpf_prog_array __rcu *old_array;
139
+ struct bpf_prog_array *old_array;
112140 struct bpf_prog_array *new_array;
113141 struct ir_raw_event_ctrl *raw;
114142 int ret;
....@@ -126,12 +154,12 @@
126154 goto unlock;
127155 }
128156
129
- if (raw->progs && bpf_prog_array_length(raw->progs) >= BPF_MAX_PROGS) {
157
+ old_array = lirc_rcu_dereference(raw->progs);
158
+ if (old_array && bpf_prog_array_length(old_array) >= BPF_MAX_PROGS) {
130159 ret = -E2BIG;
131160 goto unlock;
132161 }
133162
134
- old_array = raw->progs;
135163 ret = bpf_prog_array_copy(old_array, NULL, prog, &new_array);
136164 if (ret < 0)
137165 goto unlock;
....@@ -146,7 +174,7 @@
146174
147175 static int lirc_bpf_detach(struct rc_dev *rcdev, struct bpf_prog *prog)
148176 {
149
- struct bpf_prog_array __rcu *old_array;
177
+ struct bpf_prog_array *old_array;
150178 struct bpf_prog_array *new_array;
151179 struct ir_raw_event_ctrl *raw;
152180 int ret;
....@@ -164,7 +192,7 @@
164192 goto unlock;
165193 }
166194
167
- old_array = raw->progs;
195
+ old_array = lirc_rcu_dereference(raw->progs);
168196 ret = bpf_prog_array_copy(old_array, prog, NULL, &new_array);
169197 /*
170198 * Do not use bpf_prog_array_delete_safe() as we would end up
....@@ -195,21 +223,22 @@
195223 /*
196224 * This should be called once the rc thread has been stopped, so there can be
197225 * no concurrent bpf execution.
226
+ *
227
+ * Should be called with the ir_raw_handler_lock held.
198228 */
199229 void lirc_bpf_free(struct rc_dev *rcdev)
200230 {
201231 struct bpf_prog_array_item *item;
232
+ struct bpf_prog_array *array;
202233
203
- if (!rcdev->raw->progs)
234
+ array = lirc_rcu_dereference(rcdev->raw->progs);
235
+ if (!array)
204236 return;
205237
206
- item = rcu_dereference(rcdev->raw->progs)->items;
207
- while (item->prog) {
238
+ for (item = array->items; item->prog; item++)
208239 bpf_prog_put(item->prog);
209
- item++;
210
- }
211240
212
- bpf_prog_array_free(rcdev->raw->progs);
241
+ bpf_prog_array_free(array);
213242 }
214243
215244 int lirc_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
....@@ -262,7 +291,7 @@
262291 int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)
263292 {
264293 __u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids);
265
- struct bpf_prog_array __rcu *progs;
294
+ struct bpf_prog_array *progs;
266295 struct rc_dev *rcdev;
267296 u32 cnt, flags = 0;
268297 int ret;
....@@ -283,7 +312,7 @@
283312 if (ret)
284313 goto put;
285314
286
- progs = rcdev->raw->progs;
315
+ progs = lirc_rcu_dereference(rcdev->raw->progs);
287316 cnt = progs ? bpf_prog_array_length(progs) : 0;
288317
289318 if (copy_to_user(&uattr->query.prog_cnt, &cnt, sizeof(cnt))) {