Red Hat Eyeing Innovative eBPF Uses For Linux's HID Subsystem

eBPF for sandboxed programs running in the kernel have shown to be very useful beyond the original BPF origins in the networking subsystem to also be very practical for other security, tracing, and other general use-cases for an in-kernel JIT virtual machine. Red Hat has sent out initial patches extending eBPF for making use of it within the HID subsystem for input devices.

Benjamin Tissoires of Red Hat's elite input Linux team has sent out a set of patches introducing eBPF support for HID devices. One of the very useful areas this eBPF support can be used within the HID area is for buggy/quirky devices. Currently there is lots of simple drivers and quirks for just correcting a key or byte in the report descriptor for input events. Unfortunately with the current approach with the input drivers being in the mainline kernel and the time it takes for upstreaming and getting down to vendor kernels is painful for users. The idea is that these "fixups" could be externalized in some external repository and ship these fixes as various eBPF programs that would be loaded at boot time to avoid needing a new kernel for quirky/buggy hardware.

Microsoft - Their Surface Dial and other unique input devices could see better support with this planned eBPF support.

Other eBPF uses being looked at for the HID subsystem are for the USI stylus support to have the kernel API controlled by the consumer and to avoid waking up user-space every-time there is an event, improving handling for input devices like the Microsoft Surface Dial, and preventing user-access to specific device features like firmware update entry points.

See the initial patches for adding BPF support to the HID subsystem and expanding on some of these possible eBPF + HID use-cases.