Add HID-BPF tutorial and implementation for virtual mouse input modification

- Introduced a comprehensive tutorial in README.md explaining how to fix broken HID devices using eBPF without kernel patches.
- Implemented a userspace program (hid-input-modifier.c) that creates a virtual HID mouse using the uhid interface and sends synthetic mouse events.
- Developed a BPF program (hid-input-modifier.bpf.c) that intercepts HID events and modifies mouse movement data, effectively doubling the X and Y movement.
- Created necessary header files (hid_bpf.h, hid_bpf_defs.h, hid_bpf_helpers.h) to define structures and helper functions for the BPF program.
- Added functionality to find and manage the virtual HID device, ensuring seamless integration with the BPF program.
This commit is contained in:
yunwei37
2025-10-05 22:40:58 -07:00
parent 5319e02c7c
commit 277ecbaf9d
35 changed files with 1101 additions and 5 deletions

View File

@@ -4,6 +4,8 @@ Ever tried building a linked list in eBPF and got stuck using awkward integer in
This is what **BPF Arena** solves. Created by Alexei Starovoitov in 2024, arena provides a sparse shared memory region where BPF programs can use real pointers to build complex data structures like linked lists, trees, and graphs, while userspace gets zero-copy direct access to the same memory. In this tutorial, we'll build a linked list in arena memory and show you how both kernel and userspace can manipulate it using standard pointer operations.
> The complete source code: <https://github.com/eunomia-bpf/bpf-developer-tutorial/tree/main/src/features/bpf_arena>
## Introduction to BPF Arena: Breaking Free from Map Limitations
### The Problem: When BPF Maps Aren't Enough

View File

@@ -4,6 +4,8 @@ Ever tried monitoring hundreds of processes and ended up parsing thousands of `/
This is what **BPF Iterators** solve. Introduced in Linux kernel 5.8, iterators let you traverse kernel data structures directly from BPF programs, apply filters in-kernel, and output exactly the data you need in any format you want. In this tutorial, we'll build a dual-mode iterator that shows kernel stack traces and open file descriptors for processes, with in-kernel filtering by process name - dramatically faster than parsing `/proc`.
> The complete source code: <https://github.com/eunomia-bpf/bpf-developer-tutorial/tree/main/src/features/bpf_iters>
## Introduction to BPF Iterators: The /proc Replacement
### The Problem: /proc is Slow and Rigid

View File

@@ -4,6 +4,8 @@ Ever needed your eBPF program to sleep, allocate memory, or wait for device I/O?
This is what **BPF Workqueues** enable. Created by Benjamin Tissoires at Red Hat in 2024 for HID-BPF device handling, workqueues let you schedule asynchronous work that runs in process context where sleeping and blocking operations are allowed. In this tutorial, we'll explore why workqueues were created, how they differ from timers, and build a complete example demonstrating async callback execution.
> The complete source code: <https://github.com/eunomia-bpf/bpf-developer-tutorial/tree/main/src/features/bpf_wq>
## Introduction to BPF Workqueues: Solving the Sleep Problem
### The Problem: When eBPF Can't Sleep