The logic is the following (see also the last patch for some more documentation):
- hid-bpf first preloads a BPF program in the kernel that does a few things:
- find out which attach_btf_id are associated with our trace points
- adds a bpf_tail_call() BPF program that I can use to "call" any other BPF program stored into a jump table
- monitors the releases of struct bpf_prog, and when there are no other users than us, detach the bpf progs from the HID devices
- users then declare their tracepoints and then call hid_bpf_attach_prog() in a SEC("syscall") program
- hid-bpf then calls multiple time the bpf_tail_call() program with a different index in the jump table whenever there is an event coming from a matching HID device
So driver abstractions like UDI are now perfectly fine as long as they are written using a hip new VM?
This whole idea seems like a bad idea, against the Linux spirit and now actually useful - it is totally trivial to write a new HID driver alreay, and if it isn't in some cases we need to fix that.
So a big fat NAK to the idea of using eBPF for actual driver logic.