Intro
Let’s explore and deobfuscate the input stack on Linux. Our aim is to understand its components and what each does. Input handling can be divided into two parts, separated by a common layer:
Kernel-level handling: It deals with what happens in the kernel and how events are exposed to user-space The actual hardware connected to the machine, along with the different buses and I/O/transport subsystems The input core subsystem, and the specific device drivers that register on it
Exposed layer (middle) The event abstraction subsystem (evdev) devtmpfs for device nodes sysfs for kernel objects and device attributes procfs for an introspection interface of the input core
User-space handling: The user-space device manager (udev) and hardware database (hwdb) for device management and setup The libinput library for general input, and other libraries such as XKB for keyboards, to interpret the events and make them manageable The Widgets, X Server, X11 window managers, and Wayland compositors, which rely on everything else
We’ll try to make sense of all this, one thing at a time, with a logical and coherent approach.
NB: This article compiles my understand, for any correction please contact me.
The Kernel’s Input Core
How are input devices and their events handled in the kernel? You might think it is useless to know, but understanding some of the kernel logic is what makes things click.
... continue reading