Add HID-BPF tutorial and implementation for virtual mouse input modification

- Introduced a comprehensive tutorial in README.md explaining how to fix broken HID devices using eBPF without kernel patches.
- Implemented a userspace program (hid-input-modifier.c) that creates a virtual HID mouse using the uhid interface and sends synthetic mouse events.
- Developed a BPF program (hid-input-modifier.bpf.c) that intercepts HID events and modifies mouse movement data, effectively doubling the X and Y movement.
- Created necessary header files (hid_bpf.h, hid_bpf_defs.h, hid_bpf_helpers.h) to define structures and helper functions for the BPF program.
- Added functionality to find and manage the virtual HID device, ensuring seamless integration with the BPF program.
This commit is contained in:
yunwei37
2025-10-05 22:40:58 -07:00
parent 5319e02c7c
commit 277ecbaf9d
35 changed files with 1101 additions and 5 deletions

View File

@@ -4,6 +4,8 @@ Ever tried monitoring hundreds of processes and ended up parsing thousands of `/
This is what **BPF Iterators** solve. Introduced in Linux kernel 5.8, iterators let you traverse kernel data structures directly from BPF programs, apply filters in-kernel, and output exactly the data you need in any format you want. In this tutorial, we'll build a dual-mode iterator that shows kernel stack traces and open file descriptors for processes, with in-kernel filtering by process name - dramatically faster than parsing `/proc`.
> The complete source code: <https://github.com/eunomia-bpf/bpf-developer-tutorial/tree/main/src/features/bpf_iters>
## Introduction to BPF Iterators: The /proc Replacement
### The Problem: /proc is Slow and Rigid