The Linux Kernel/Human interfaces

human interfacestext interfacessecuritydebuggingmultimedia subsystemshuman interface devices, input devicesHI drivers Welcome to the first article of this book. The article is named after the USB human interface device class USB class and the Linux facility for Human interface device Human Interface Devices (HID). The HID subsystem in Linux supports keyboards, mice, and other Input device input devices. In addition to input handling, this article also explores topics related to the console, multimedia (or simply media), sound (audio), video, and graphics—key areas of user interaction. Security and debugging are also covered, as they are closely tied to human interaction and user-facing functionality. Text interfaces In the world of Linux, text terminal emulators and Linux console consoles are essential components of the operating system that allow users to interact with applications through the kernel. A text terminal is a device that provides a text-based interface for communicating with the kernel, while the console is the physical device that houses the terminal and displays the output of the kernel. The Linux kernel includes a built-in console driver that provides a basic interface for communicating with the console and controlling the terminal. The console driver also supports various input and output devices, such as keyboards and displays, to enable users to interact with the system through a terminal. The use of text Computer terminal terminals and system consoles in Linux can be traced back to the early days of computing, when Graphical terminal graphical user interfaces were not yet widely available. Despite the widespread adoption of graphical user interfaces, Text-based user interface text-based interfaces and consoles remain popular among Linux users and developers for their simplicity, efficiency, and flexibility. Overall, the text terminal and console play a crucial role in the Linux kernel, providing users with a powerful interface for managing and interacting with the operating system. Char devices cdev – "character device" is a type of device driver that provides an implementation for character device file in the /dev directory. The word "device" here means abstract interface, Proxy pattern proxy to a usually peripheral physical device. A character device is a type of device that can be accessed as a stream of bytes, rather than as a block of data like a block device. Cdev drivers are commonly used for devices that provide a sequential access stream of data, such as keyboards, mice, terminals, serial ports, and printers. They are also used for devices that provide access to memory-mapped I/O regions, such as frame buffers and network devices. A cdev driver typically consists of a set of functions that implement the low-level I/O operations for the device, such as open, read and write. These functions are called by the kernel when a user space program accesses the character device file. To create a cdev driver, a kernel developer must first initialize a cdev structure using cdev_init or cdev_alloc. The cdev structure contains information about the device, such as its major and minor numbers and the set of I/O functions that the driver implements. Once the cdev structure has been initialized, it can be registered with the kernel using the cdev_add function. This function creates the character device file in the /dev directory and associates it with the cdev driver. You can find a list of registered char devices on the beginning the listing of /proc/devices. Input devices keyboard and mouse are examples of char devices. Tip: Browse the cross-referencing site to explore nearby API and use cases 💾 Historical: It is one of the most simple, fundamental and oldest concepts derived from UNIX. ⚲ API linux/cdev.h dev_t - device id consists of MAJOR and MINOR numbers cdev - core char device struct cdev_init or cdev_alloc cdev_device_add - helper function, uses cdev_add - common key function to add a char device to the system. register_chrdev - obviously registers char device by major number, name and file operations unregister_chrdev alloc_chrdev_region / register_chrdev_region, unregister_chrdev_region uapi/linux/major.h - static definitions of many major numbers, including obsolete. ⚙️ Internals fs/char_dev.c – character device registration chrdevs 📖 References Char devices core-api/kernel-api.html#char-devices Character device drivers, linux-kernel-labs Character device files, on opensourceforu 📚 Further reading LKMPG: Character Device drivers 💾 Historical LDD3:Char Drivers LDD3:Advanced Char Driver Operations LDD1:#3 LDD1:#5 Text terminals and console 🗝️ Acronyms Tty (unix) tty - 💾 historically TeleTYpewriter, means just terminal Pseudoterminal pty - pseudoterminal pts - pseudoterminal slave ptmx - pseudoterminal master ⚲ API To find out current terminal: readlink /proc/self/fd/0 1 tty 1 who -m linux/tty.h register_console obviously registers console 👁 example virtio_console linux/console.h 2 ioctl_console ⚙️ Internals drivers/tty – TTY layer fs/devpts – devpts pseudo-filesystem for PTY slaves fs/proc/proc_tty.c – /proc/tty information drivers/tty/vt/vt.c – virtual terminal console 📖 References 4 tty – controlling terminal 4 ptmx and pts – pseudoterminal master and slave 7 pty – pseudoterminal interfaces console driver-api/console.html 💾 Historical LDD3:TTY Drivers Security The goal of security is to restrict access through interfaces. From access control and authentication mechanisms to secure boot and memory protection, the Linux kernel employs a variety of techniques to safeguard the system and its users. Basic Linux security is quite simple. It consists of three ownership classes and three access modes. One of the most frequently executed functions is may_open. It rejects access of unauthorized users to open a file. See article ../Security/ for advanced features. Authorization Authorization is the function of specifying Computer access control access rights/Privilege_(computing) privileges to system resources. The main goal of authorization is prevention of privilege escalation under any circumstances. 🔧 TODO. Keywords: permission, capabilities, ownership, mitigation. ⚲ API linux/stat.h uapi/linux/stat.h Basic classic UNIX authorization is based on ownership and tree access modes: reading, writing and execution. Ownership is encoded by owning user id uid_t and owning group id gid_t. umode_t - just typedef used for encoding access mode. S_IRUSR - minimal "read only by user/owner" access mode. S_IALLUGO - full access mode. Please read the source for details for other modes. Binary Access Control Matrix of access modes: +modesbitsReadWriteExecutebit offset210Others0-2orowoxGroup3-5grgwgxUser6-8uruwux 2 chown ↪ do_fchownat changes ownership for file or directory 2 chmod ↪ do_fchmodat changes access mode for file or directory 2 access, 2 faccessat ↪ do_faccessat checks access rights Common authorization errors EPERM – "Operation not permitted" EACCES – "Permission denied" 🚀 Advanced features 5 acl posix_acl 1 setpriv – run a program with different privilege settings ⚙️ Internals may_open rejects unauthorized file opening inode_permission checks for access rights to a given inode 📖 References File-system permissions Capabilities POSIX capabilities split the traditional root privilege into distinct units, so a process can hold only the capabilities it needs. ⚲ API: 7 capabilities uapi/linux/capability.h 2 capset, 2 capget – set/get capabilities of thread(s) 3 libcap ⚙️ Internals: kernel/capability.c 🔨 stress-ng --cap Credentials 🔧 TODO. Keywords: authentication, user IDs, group IDs, Process group ID, session ID. ⚲ API uapi/asm-generic/stat.h arch/x86/include/uapi/asm/stat.h – x86 stat structure definitions linux/cred.h struct cred - the security context of a task 1 id, 1 test - shell utilities 2 getuid ↪ current_uid 2 getgid 2 geteuid is used by utility 1 whoami Real, effective, and saved user/group IDs: 2 getresuid, getresgid 2 setreuid, setregid 2 setfsuid - set user identity used for filesystem checks 2 umask - sets file mode creation mask 1 stat, 2 stat ↪ vfs_fstat, vfs_fstatat 2 statx ↪ do_statx ⚙️ Internals kernel/cred.c – credentials management and transitions kstat make_kuid etc from_kuid_munged etc 📖 References Credentials in Linux security/credentials.html 7 credentials https://www.geeksforgeeks.org/real-effective-and-saved-userid-in-linux/ Cryptography 🔧 TODO 🗝️ Acronyms AES - Advanced Encryption Standard ⚲ API AF_ALG - User Space Interface crypto/userspace-if.html linux/crypto.h - Scatterlist Cryptographic API. 2 getrandom – obtain random bytes linux/random.h – kernel random number generation crypto ⚙️ Internals crypto – cryptographic API core drivers/crypto – hardware crypto accelerator drivers lib/crypto – crypto library helpers arch/x86/crypto – x86 optimized crypto implementations fs/crypto - per-file encryption fs/ecryptfs eCrypt FS - Encrypted filesystem that operates on the VFS layer. dm-crypt, drivers/md/dm-crypt.c 📖 References Linux Kernel Crypto API crypto Crypto API (Linux) devicetree/bindings/crypto kernel crypto Audit The Linux audit framework records security-relevant events such as system calls, file access, and authentication attempts. The audit daemon (auditd) collects records from the kernel via a netlink socket. ⚲ API 8 auditctl – configure audit rules 8 auditd – audit daemon 7 audit.rules linux/audit.h ⚙️ Internals kernel/audit.h – audit internal definitions kernel/audit.c – audit gateway between kernel and user-space daemon kernel/auditsc.c – system-call auditing kernel/audit_tree.c – audit directory tree watches kernel/audit_watch.c – audit filesystem path watches kernel/audit_fsnotify.c – audit fsnotify integration kernel/auditfilter.c – audit rule filtering 📖 References https://wiki.archlinux.org/title/Audit_framework See also eBPF and BPF Security subsystems Seccomp Seccomp (Secure Computing) restricts which system calls a process can make. Seccomp-BPF attaches a Berkeley Packet Filter BPF program that inspects each syscall number and arguments, returning allow, kill, trap, or errno. Used by runc (Open Container Initiative OCI container runtime), browsers (Chrome, Firefox), and systemd to reduce the kernel attack surface of sandboxed processes. ⚲ API: 2 seccomp ↪ do_seccomp 2 prctl with PR_SET_SECCOMP linux/seccomp.h uapi/linux/seccomp.h – SECCOMP_MODE_FILTER, SECCOMP_RET_ALLOW, SECCOMP_RET_KILL ⚙️ Internals: kernel/seccomp.c seccomp_filter – container for seccomp BPF programs 📖 References: Seccomp BPF userspace-api/seccomp_filter.html 🔨 stress-ng --seccomp File sealing File sealing restricts operations on anonymous files created with 2 memfd_create. Once sealed, a file cannot be modified in ways forbidden by its seals, providing integrity guarantees for shared memory. Used by Wayland for safe buffer handoff, systemd for sealed service binaries, and kdbus for immutable message payloads. ⚲ API: 2 memfd_create – create anonymous sealable file 2 fcntl with F_ADD_SEALS, F_GET_SEALS F_SEAL_SEAL, F_SEAL_SHRINK, F_SEAL_GROW, F_SEAL_WRITE ⚙️ Internals: mm/memfd.c 2 fcntl(F_ADD_SEALS) ↪ do_fcntl ↪ memfd_fcntl 🔨 stress-ng --seal Keyrings The kernel keyring service manages cryptographic keys, authentication tokens, and other security data. Keyrings are hierarchical and per-process, used by filesystems (fscrypt), networking (Kerberos, TLS), and module signature verification. ⚲ API: 2 add_key, 2 keyctl ↪ sys_keyctl, 2 request_key keys ⚙️ Internals: security/keys security/keys/keyctl.c 📖 References: Kernel Keys security/keys 🔨 stress-ng --key LSM Linux Security Modules (LSM) is a framework providing hooks for access control implementations. SELinux, AppArmor, Landlock, Yama, and Lockdown are LSM modules. Keyrings (security/keys) and IMA/EVM (security/integrity) are separate subsystems that share the security/ tree but are not LSMs. ⚲ API: linux/security.h rust/kernel/security.rs – Rust bindings ⚙️ Internals: security security/security.c – LSM framework core, hook dispatch security/selinux – SELinux, https://selinuxproject.github.io/ security/apparmor – AppArmor security/landlock – Landlock unprivileged sandboxing (since 5.13) security/integrity – IMA integrity measurement and EVM extended verification security/lockdown – kernel lockdown, restricts access to kernel features security/yama – Yama, ptrace scope restrictions linux/verification.h certs – module signing certificates 📖 References: Security security LSM - Linux Security Modules security/lsm.html 🔨 stress-ng --apparmor ... Appendix for Security: 🔧 TODO 2 fcntl ↪ do_fcntl chroot, 2 chroot Address_space_layout_randomization#Linux Address space layout randomization 8 setarch / 2 personality 📖 References Security-related interfaces userspace-api/index.html#security-related-interfaces No New Privileges Flag userspace-api/no_new_privs.html Landlock: unprivileged access control userspace-api/landlock.html Linux Security Modules userspace-api/lsm.html Introduction of non-executable mfd userspace-api/mfd_noexec.html Speculation Control userspace-api/spec_ctrl.html TEE (Trusted Execution Environment) Userspace API userspace-api/tee.html Executability check userspace-api/check_exec.html Hardware vulnerabilities admin-guide/hw-vuln kernel security cve Debugging See Debugging the Linux kernel Multimedia subsystems ⚙️ Internals drivers/media – media subsystem (V4L2, DVB, etc.) Graphics Old graphics (not to be confused with v4l): ⚲ API video ⚙️ Internals drivers/video – framebuffer and video drivers Direct Rendering Manager (DRM) / Mode setting KMS 🗝️ Acronyms DRM – Direct Rendering Manager KMS – Mode setting Kernel Mode Setting, display output configuration (resolution, refresh rate, connectors, CRTCs) GEM – Direct Rendering Manager#Graphics Execution Manager Graphics Execution Manager (GPU memory management) CRTC – CRT Controller (legacy name for display scanout engine) TTM – Translation Table Manager (older GPU memory manager) DRM is responsible for interfacing with GPUs of modern video cards. DRM exposes an API that user-space programs can use to send commands and data to the GPU and perform operations such as configuring the mode setting of the display. User-space programs can use the DRM API to command the GPU to do hardware-accelerated 3D rendering and video decoding, as well as General-purpose computing on graphics processing units GPGPU computing. ⚲ API /dev/dri/card*, /dev/dri/renderD* – DRM device nodes /sys/class/drm/ uapi/drm uapi/drm/drm.h DRM_IOCTL_BASE drm_version uapi/drm/drm_mode.h – KMS mode setting ioctls rust/kernel/gpu.rs – Rust bindings ⚙️ Internals Key abstractions: drm_device – represents a GPU, drm/drm_device.h drm_driver – driver callbacks, drm/drm_drv.h drm_dev_register – register a DRM device drm_crtc – display controller (scanout engine) drm_connector – output port (HDMI, DP, etc.) drm_encoder – signal format converter drm_plane – image layer composited by CRTC drm_framebuffer – pixel buffer drm_gem_object – GPU memory object drm_display_mode – resolution and timing descriptor drm_bridge – chain between encoder and connector (panels, converters) drm_panel – display panel abstraction drm_edid – Extended Display Identification Data EDID monitor identification drm_atomic_commit – submit atomic mode set drm_sched_job – GPU job scheduler drivers/gpu/drm – DRM core and drivers drivers/gpu/drm/drm_drv.c – driver registration drivers/gpu/drm/drm_atomic.c – atomic mode setting drm/drm_gem.h, drivers/gpu/drm/drm_gem.c – GEM memory manager drivers/gpu/drm/drm_ioctl.c – ioctl dispatch GPU drivers: drivers/gpu/drm/i915 – Intel drivers/gpu/drm/xe – Intel Xe (newer) drivers/gpu/drm/amd – AMD (amdgpu, radeon) drivers/gpu/drm/nouveau – NVIDIA (reverse-engineered) drivers/gpu/drm/virtio – virtual GPU drivers/gpu/drm/vkms – virtual KMS for testing 📖 References GPU Driver Developer's Guide gpu DRM Internals gpu/drm-internals.html Kernel Mode Setting (KMS) gpu/drm-kms.html GEM – the Graphics Execution Manager gpu/drm-mm.html Advanced Linux Sound Architecture (ALSA) ALSA is a software framework and part of the Linux kernel that provides an API for sound card device drivers. Some of the goals of the ALSA project at its inception were automatic configuration of sound-card hardware and graceful handling of multiple sound devices in a system. The sound servers PulseAudio, JACK (low-latency professional-grade audio editing and mixing) and PipeWire, the higher-level abstraction APIs OpenAL, SDL audio, etc. work on top of ALSA and implemented sound card device drivers. On Linux systems, ALSA succeeded the older Open Sound System (OSS). ⚲ API /proc/asound/cards, /sys/class/sound/ snd_card - central struct snd_card_new snd_card_register snd_device_ops snd_device_new creates an ALSA device component uapi/sound/asound.h sound/core.h ⚙️ Internals sound – ALSA sound subsystem sound/core/device.c – ALSA device management See ASoC 📖 References ALSA (sound) sound Writing an ALSA Driver sound/kernel-api/writing-an-alsa-driver.html kernel sound Video4Linux (V4L2) V4L is a collection of device drivers and an API for supporting realtime video capture on Linux systems. It supports many USB webcams, TV tuners, and related devices, standardizing their output, so programmers can easily add video support to their applications. MythTV, tvtime and Tvheadend are typical applications that use the V4L framework. ⚲ API v4l2_device_register registers v4l2_device video_register_device registers video_device 👁 examples drivers/media/test-drivers 📖 References Video4Linux media driver-api/media V4L userspace-api/media/drivers/ Media subsystem kernel internal API HID Generic human interface devices. Don't confuse with hiddev. Input devices Input device files are kind of char devices with id INPUT_MAJOR. Classic input devices are keyboard and mouse. ⚲ API In shell: cat /proc/bus/input/devices linux/input.h devm_input_allocate_device, input_register_device, input_register_handler, input_dev input_report_key input_sync 👁 Examples drivers/input/mousedev.c – mouse device emulation drivers/input/keyboard/atkbd.c – AT/PS2 keyboard driver ⌨️ Hands on sudo hexdump /dev/input/mice # dump your mouse movements events from your kernel ⚙️ Internals drivers/input/input.c – input core input_event 📖 References Input input kernel input HID devices 🔧 TODO ⚲ API hid_device - device report descriptor. Operations: hid_allocate_device, hid_add_device . 👁 Example usbhid_probe uapi/linux/hid.h linux/hid.h Camera 🔧 TODO ⚲ API uapi/linux/uvcvideo.h 📖 References UVC userspace-api/media/drivers/uvcvideo.html drivers/media/usb/uvc – USB Video Class driver HI device drivers This section is about low level drivers to human interface peripheral devices. ⚲ HID API linux/hidraw.h module_hid_driver registers hid_driver hid_hw_start ⚙️ Internals hid_bus_type drivers/hid – HID transport drivers drivers/hid/hid-core.c – HID core parsing and event handling drivers/accessibility – accessibility drivers (speakup) drivers/leds – LED class drivers samples/uhid/uhid-example.c - 👁 example of user mode HID driver drivers/input : keyboard & mouse, misc, serio, tablet, touchscreen, gameport, joystick ⌨️ Hands on echo "module atkbd +pfl" | sudo tee /sys/kernel/debug/dynamic_debug/control USB HID ⚲ HID API USB_INTERFACE_CLASS_HID == USB_CLASS_HID ⚙️ Internals drivers/hid/usbhid – USB HID transport drivers/hid/usbhid/usbkbd.c: usb_kbd_driver drivers/hid/usbhid/usbmouse.c: usb_mouse_driver 📖 References USB HID class hid Display drivers 🔧 TODO 🗝️ Acronyms FB - Linux framebuffer Framebuffer GPU - Graphics processing unit TFT (LCD) - Thin-film-transistor liquid-crystal display used for 🤖 embedded devices MIPI - 📱 Mobile Industry Processor Interface DBI - Display Bus Interface DSI - Display Serial Interface DCS - The Display Command Set ⚲ API cat /proc/fb ls -l /sys/class/graphics video/mipi_display.h linux/fb.h devm_register_framebuffer register_framebuffer FBTFT_REGISTER_DRIVER fbtft_display ⚙️ Internals drivers/video – framebuffer and video drivers drivers/gpu – GPU and DRM drivers 👁 Examples vivid_fb_init fbtft_register_framebuffer 📖 References GPU Driver Developer’s Guide gpu The Frame Buffer Device fb Frame Buffer Library driver-api/frame-buffer.html LWN: Graphics Sound SoC - ASoC ALSA System on Chip (ASoC) layer for 🤖 embedded systems. ASoC is designed to handle complex audio processing and routing on low-power and resource-constrained systems, making it an ideal solution for embedded devices such as smartphones, tablets, and other IoT devices. ASoC provides a comprehensive framework for audio drivers, enabling the creation of modular audio drivers that can be easily integrated with the rest of the kernel. It also supports a wide range of audio interfaces, including I2S, PCM, AC97, and SPDIF, making it highly versatile and capable of handling a variety of audio formats. One of the key features of ASoC is its ability to handle audio routing and processing using Digital Signal Processing (DSP) techniques. This enables ASoC to support advanced audio features such as noise reduction, echo cancellation, and dynamic range compression, among others. Overall, ASoC is a powerful and flexible subsystem that enables Linux to support a wide range of audio hardware in embedded devices. It has become an essential component of many embedded Linux distributions and is widely used in the development of modern audio-enabled devices. ⚲ API sound/soc.h snd_soc_card is registered by devm_snd_soc_register_card ⇾ snd_soc_register_card sound/soc-component.h snd_soc_component snd_soc_component_driver snd_soc_card snd_card snd_soc_register_component snd_soc_component_get_drvdata snd_soc_component_read snd_soc_component_update_bits snd_soc_component_write sound/soc-dai.h - DAI - Digital Audio Interface sound/soc/dai.html: AC97, I2S, PCM snd_soc_dai snd_soc_dai_driver snd_soc_dai_get_drvdata sound/soc-dpcm.h - DPCM - Dynamic PCM sound/soc/dpcm.html sound/soc-dapm.h - DAPM - Dynamic Audio Power Management sound/soc/dapm.html snd_soc_dapm_route, snd_soc_dapm_to_component, snd_soc_dapm_widget 👁 Examples sound/soc/generic/simple-card.c sound/soc/generic/audio-graph-card.c uses sound/graph_card.h ⚙️ Internals sound/soc – ASoC framework snd_soc_card snd_soc_dai_link 📖 References ASoC - ALSA SoC Layer sound/soc ASoC Core API sound/kernel-api/alsa-driver-api.html?#asoc https://www.alsa-project.org/wiki/ASoC https://www.alsa-project.org/wiki/DAPM 🗝️ Acronyms SAI could be STM Serial Audio Interface: sound/soc/stm/stm32_sai.h Freescale (FSL) Synchronous Audio Interface: sound/soc/fsl/fsl_sai.h 25%