[PATCH RFC v2 RESEND] HID: BPF: add keyboard behavioral anomaly detection

[PATCH RFC v2 RESEND] HID: BPF: add keyboard behavioral anomaly detection

[Krish Gulati]

This patch implements a HID-BPF struct_ops program that detects automated
HID injection attacks. It does this by measuring post-enumeration delay
and tracking inter-keystroke timing using Welford's online variance algorithm.
State is stored in a hash map keyed by the HID ID.

Detection results are currently surfaced via bpf_printk(). A
BPF_MAP_TYPE_RINGBUF interface with configurable userspace daemon
is planned; deferred pending validation of detection heuristics.

Signal design is grounded in: Neuner et al., "USBlock: Blocking
USB-based Keylogger Attacks", DBSec 2018.

Link: https://lore.kernel.org/linux-input/adSxXidgeWF0-Ewn@beelink/

Signed-off-by: Krish Gulati <krishgulati7@gmail.com>
Suggested-by: Sashiko-bot <sashiko-bot@kernel.org>
---
Changes since v1:
- Added bpf_spin_lock/unlock around the Welford compound update in
  kbd_hook() to close a data race on concurrent execution (was
  lockless read-modify-write).
- Switched dev_details from LRU_HASH to plain HASH so eviction
  under map pressure fails the insert instead of silently
  displacing an existing tracked device.
- Store report_id in dev_info and gate kbd_hook() on it, so
  composite devices no longer misattribute other report types'
  bytes as keystrokes.
- Zero dev_info with __builtin_memset before populating in probe()
  to satisfy the verifier's stack-init tracking (was relying on a
  partial designated initializer).
- Replaced active-byte-count heuristic with bytewise diff/mask
  (standard_boot_keypress/nkro_keypress) so consecutive keystrokes
  without an intervening empty report are still detected.
- Verified bucket-size rounding (8/16/32/64) does not drop events
  or read out-of-bounds, tested via hid-replay with synthetic
  report sizes (9, 14 bytes, etc.).

Known limitations, not addressed in this version:
- No cleanup on device disconnect: hid_bpf_ops has no disconnect
  hook, so dev_details entries persist until the map fills.
  Deferred pending maintainer guidance on the right approach.
- find_keyboard_field() returns on the first Keyboard-typed
  (GenericDesktop/Keyboard) Application Collection found; a device
  with multiple such collections within a single report descriptor
  (as opposed to multiple HID interfaces, which are already handled
  correctly and verified on real composite hardware) will only have
  the first one tracked. Untested; the only hardware available for
  testing exhibits the multiple-interface pattern rather than the
  single-descriptor multi-collection pattern, so this path has not
  been exercised.

Resending as a top-level thread (v2 was sent as a reply to v1 on July 9).
Original thread: https://lore.kernel.org/linux-input/20260709104958.38303-1-krishgulati7@gmail.com

 src/bpf/testing/0010-Generic__keyboard.bpf.c | 311 +++++++++++++------
 src/bpf/testing/meson.build                  |   1 +
 2 files changed, 217 insertions(+), 95 deletions(-)

diff --git a/src/bpf/testing/0010-Generic__keyboard.bpf.c b/src/bpf/testing/0010-Generic__keyboard.bpf.c
index 9114587..c3f2364 100644
--- a/src/bpf/testing/0010-Generic__keyboard.bpf.c
+++ b/src/bpf/testing/0010-Generic__keyboard.bpf.c
@@ -24,11 +24,11 @@
 #define HID_GUARD_PED_SUSPICIOUS_THRESH (50 * HID_GUARD_NSEC_PER_MSEC)
 #define HID_GUARD_PED_WARNING_THRESH (300 * HID_GUARD_NSEC_PER_MSEC)

-/*not derived from real typing data yet*/
+/*not derived from real typing raw_buffer yet*/
 #define HID_GUARD_MIN_SAMPLES 5

 /*
- * Variance is "too metronomic
+ * Variance is "too metronomic"
  * to be a human," expressed in ms^2 so we never need sqrt().
  */
 #define HID_GUARD_VARIANCE_THRESH_MS2 (40ULL * 40ULL)
@@ -57,9 +57,17 @@ enum hid_guard_ped_flag {
 };

 struct dev_info {
-	__u64 connection_time;
+	struct bpf_spin_lock lock;
+	__u8 report_id;
+	__u8 field_type;
+	__u8 prev_report[64];
+	__u16 bits_start;
+	__u16 bits_end;
+	__u16 usage_id;
 	__u32 report_size;
-	__u64 prev_report[32];
+	__u32 keyboard_offset;
+	__u64 connection_time;
+	__u64 raw_buffer_length;
 	/*welford's variables*/
 	__u64 prev_keydown_ts;
 	__u64 count;
@@ -71,22 +79,8 @@ struct dev_info {
 	 */
 };

-/*
- * BPF_MAP_TYPE_LRU_HASH:
- * Using an LRU map automatically prevents exhaustion by silently evicting
- * the oldest idle devices. It requires no syntax changes to the rest of the
- * code (lookup/update helpers work identically), but introduces behavioral
- * trade-offs:
- *
- * 1. Eviction wipes Welford variance history. An attacker
- *    could theoretically flood the map to flush their device and reset their
- *    score.
- * 2. PED Blindspot: Eviction deletes the 'connection_time' set during probe().
- *    If an evicted device wakes up, it will bypass post-enumeration delay
- *    checks.
- */
 struct {
-	__uint(type, BPF_MAP_TYPE_LRU_HASH);
+	__uint(type, BPF_MAP_TYPE_HASH);
 	__type(key, __u32);
 	__type(value, struct dev_info);
 	__uint(max_entries, 128);
@@ -138,11 +132,29 @@ static __always_inline void welford(struct dev_info *dev_state,
 	delta2 = x - dev_state->mean;

 	dev_state->M2 += (__u64)(delta * delta2);
+}

-	bpf_printk("W[Count:%llu] Int:%llu ms, scaled_x:%lld\n",
-		   dev_state->count, interval_ms, x);
-	bpf_printk("  -> delta1:%lld, mean:%lld\n", delta, dev_state->mean);
-	bpf_printk("  -> delta2:%lld, M2:%llu\n", delta2, dev_state->M2);
+static __always_inline bool standard_boot_keypress(__u8 *current_report,
+						   __u8 *prev_report)
+{
+	for (int i = 2; i < 8; i++) {
+		if (current_report[i] != prev_report[i])
+			return 1;
+	}
+	return 0;
+}
+
+static __always_inline bool
+nkro_keypress(__u8 *current_report, __u8 *prev_report, __u64 buffer_length)
+{
+	for (int i = 0; i < 64; i++) {
+		if (i >= buffer_length)
+			break;
+
+		if (current_report[i] & ~prev_report[i])
+			return 1;
+	}
+	return 0;
 }

 HID_BPF_CONFIG(HID_DEVICE(BUS_USB, HID_GROUP_ANY, HID_VID_ANY, HID_PID_ANY),
@@ -150,7 +162,7 @@ HID_BPF_CONFIG(HID_DEVICE(BUS_USB, HID_GROUP_ANY, HID_VID_ANY, HID_PID_ANY),
 			  HID_PID_ANY));

 SEC(HID_BPF_DEVICE_EVENT)
-int BPF_PROG(kdb_hook, struct hid_bpf_ctx *hctx)
+int BPF_PROG(kbd_hook, struct hid_bpf_ctx *hctx)
 {
 	__u32 hid_id = hctx->hid->id;

@@ -161,124 +173,233 @@ int BPF_PROG(kdb_hook, struct hid_bpf_ctx *hctx)
 	if (!info)
 		return 0;

-	__u32 size = info->report_size;
-	__u32 fetch_size;
-	__u8 *data;
+	__u8 *raw_buffer;

-	if (size <= 8)
-		fetch_size = 8;
-	else if (size <= 16)
-		fetch_size = 16;
-	else
-		fetch_size = 32;
+	__u8 *report_id_data = hid_bpf_get_data(hctx, 0, 1);

-	data = hid_bpf_get_data(hctx, 0, fetch_size);
+	if (!report_id_data)
+		return 0;

-	if (!data)
+	if (info->report_id != 0 && report_id_data[0] != info->report_id)
 		return 0;
-	int now_active_ks = 0, was_active_ks = 0;
-#pragma unroll
-	for (int i = 0; i < 32; i++) {
-		if (i >= fetch_size)
-			break;
-		now_active_ks += ((__u8)data[i] + 255) >> 8;
-		was_active_ks += ((__u8)info->prev_report[i] + 255) >> 8;

-		info->prev_report[i] = data[i];
+	__u32 offset = info->keyboard_offset + (info->report_id != 0 ? 1 : 0);
+
+	__u64 buffer_length = info->raw_buffer_length;
+
+	if (buffer_length <= 8)
+		raw_buffer = hid_bpf_get_data(hctx, offset, 8);
+	else if (buffer_length <= 16)
+		raw_buffer = hid_bpf_get_data(hctx, offset, 16);
+	else if (buffer_length <= 32)
+		raw_buffer = hid_bpf_get_data(hctx, offset, 32);
+	else
+		raw_buffer = hid_bpf_get_data(hctx, offset, 64);
+
+	if (!raw_buffer)
+		return 0;
+
+	bool new_key_pressed = false;
+
+	if (info->report_id == 0) {
+		new_key_pressed =
+			standard_boot_keypress(raw_buffer, info->prev_report);
+	} else {
+		new_key_pressed = nkro_keypress(raw_buffer, info->prev_report,
+						buffer_length);
 	}

-	__u64 current_ms = bpf_ktime_get_ns() / HID_GUARD_NSEC_PER_MSEC;
+	__u64 now = bpf_ktime_get_ns();

-	if (now_active_ks > was_active_ks) {
+	__u64 interval_ms = 0;
+	__u64 variance_m2 = 0;
+	bool is_idle_gap = false;
+	bool is_suspicious = false;
+	enum hid_guard_ped_flag ped_flag = HID_GUARD_PED_NO_ENTRY;
+	bool run_ped = false;
+
+	bpf_spin_lock(&info->lock);
+
+	if (new_key_pressed) {
 		if (info->prev_keydown_ts != 0) {
-			__u64 interval_ms = current_ms - info->prev_keydown_ts;
+			interval_ms = (now - info->prev_keydown_ts) /
+				      HID_GUARD_NSEC_PER_MSEC;

-			if (interval_ms < HID_GUARD_IDLE_GAP_THRESH_MS) {
+			if (interval_ms < HID_GUARD_IDLE_GAP_THRESH_MS)
 				welford(info, interval_ms);
-			} else {
-				bpf_printk(
-					"hid %d: idle gap %llu ms excluded from sample\n",
-					hid_id, interval_ms);
-			}
+			else
+				is_idle_gap = true;
 		}

+		/*
+		 * Variance check runs after welford() so the current
+		 * sample is already folded in before we decide.
+		 * Guard on MIN_SAMPLES: Welford's unbiased estimator
+		 * (M2 / (count - 1)) is undefined for count < 2, and
+		 * unreliable until a few samples have accumulated.
+		 */
 		if (info->count >= HID_GUARD_MIN_SAMPLES) {
-			__u64 variance_m2 =
+			variance_m2 =
 				info->M2 /
 				((__u64)HID_GUARD_WELFORD_SCALE *
 				 HID_GUARD_WELFORD_SCALE * (info->count - 1));
-			/*
-			 * the initial interval x was multiplied by HID_GUARD_WELFORD_SCALE, both
-			 * delta and delta2 are also scaled by that factor,
-			 * thus scale^2 in the denominator
-			 */
-			if (variance_m2 < HID_GUARD_VARIANCE_THRESH_MS2) {
-				bpf_printk(
-					"hid %d: Suspeciously regular typing, variance=%llu ms^2\n",
-					hid_id, variance_m2);
-			}
+			if (variance_m2 < HID_GUARD_VARIANCE_THRESH_MS2)
+				is_suspicious = true;
 		}

-		info->prev_keydown_ts = current_ms;
+		info->prev_keydown_ts = now;
 	}

-	if (info->connection_time != 0) {
-		enum hid_guard_ped_flag ped_flag =
-			post_enumeration_delay(info, bpf_ktime_get_ns());
-
-		bpf_printk("PED flag for hid %d: %d\n", hid_id, ped_flag);
+	for (int i = 0; i < 64; i++) {
+		if (i >= buffer_length)
+			break;
+		info->prev_report[i] = raw_buffer[i];
+	}

-		/*
-		 * Prevent re-evaluation on subsequent packets for this device
-		 */
+	/*
+	 * PED: fires exactly once per device lifetime. connection_time
+	 * is set at probe() time; we clear it here so subsequent events
+	 * skip this branch entirely.
+	 */
+	if (info->connection_time != 0) {
+		ped_flag = post_enumeration_delay(info, now);
 		info->connection_time = 0;
+		run_ped = true;
 	}
+
+	bpf_spin_unlock(&info->lock);
+
+	if (new_key_pressed) {
+		if (is_idle_gap)
+			bpf_printk(
+				"hid %d: idle gap %llu ms excluded from sample\n",
+				hid_id, interval_ms);
+		if (is_suspicious)
+			bpf_printk(
+				"hid %d: suspiciously regular typing, variance=%llu ms^2\n",
+				hid_id, variance_m2);
+	}
+
+	if (run_ped)
+		bpf_printk("hid %d: PED flag=%d\n", hid_id, ped_flag);
+
 	return 0;
 }

 HID_BPF_OPS(hook_keyboard) = {
-	.hid_device_event = (void *)kdb_hook,
+	.hid_device_event = (void *)kbd_hook,
 };

 struct hid_rdesc_descriptor HID_REPORT_DESCRIPTOR;

-SEC("syscall")
-int probe(struct hid_bpf_probe_args *ctx)
+static __always_inline bool find_keyboard_field(__u16 *bits_start,
+						__u16 *bits_end,
+						__u8 *report_id,
+						__u32 *size_in_bytes)
 {
 	struct hid_rdesc_report *input;
 	struct hid_rdesc_field *field;
 	struct hid_rdesc_collection *col;

 	hid_bpf_for_each_input_report(&HID_REPORT_DESCRIPTOR, input) {
-		__u32 size_in_bytes = (input->size_in_bits + 7) / 8;
-
-		bpf_printk("Report size: %d\n", size_in_bytes);
-		if (input->report_id != 0)
-			size_in_bytes += 1;
-
-		bpf_printk("Report size after report_id: %d\n", size_in_bytes);
-
 		hid_bpf_for_each_field(input, field) {
 			hid_bpf_for_each_collection(field, col) {
 				if (col->usage_page ==
 					    HidUsagePage_GenericDesktop &&
 				    col->usage_id == HidUsage_GD_Keyboard) {
-					__u32 key = ctx->hid;
-					struct dev_info info = {
-						.connection_time =
-							bpf_ktime_get_ns(),
-						.count = 0,
-						.report_size = size_in_bytes
-					};
-					bpf_map_update_elem(&dev_details, &key,
-							    &info, BPF_ANY);
-					ctx->retval = 0;
-					return 0;
+					*size_in_bytes =
+						input->size_in_bits / 8;
+
+					if (input->report_id != 0)
+						*size_in_bytes += 1;
+
+					*bits_start = field->bits_start;
+					*bits_end = field->bits_end;
+					*report_id = input->report_id;
+					return true;
 				}
 			}
 		}
 	}
-	ctx->retval = -EINVAL;
+	return false;
+}
+
+SEC("syscall")
+int probe(struct hid_bpf_probe_args *ctx)
+{
+	__u8 report_id;
+	__u16 bits_start, bits_end;
+	__u32 size_in_bytes;
+	__u32 hid_id = ctx->hid;
+
+	struct dev_info *existing_info =
+		bpf_map_lookup_elem(&dev_details, &hid_id);
+
+	struct dev_info info;
+
+	__builtin_memset(&info, 0, sizeof(info));
+
+	if (!find_keyboard_field(&bits_start, &bits_end, &report_id,
+				 &size_in_bytes)) {
+		ctx->retval = -EINVAL;
+		return 0;
+	}
+
+	if (existing_info != NULL) {
+		__u64 now = bpf_ktime_get_ns();
+
+		bpf_spin_lock(&existing_info->lock);
+
+		existing_info->connection_time = now;
+
+		existing_info->bits_start = bits_start;
+		existing_info->bits_end = bits_end;
+		existing_info->keyboard_offset = bits_start / 8;
+		existing_info->report_size = size_in_bytes;
+
+		if (existing_info->keyboard_offset >
+		    existing_info->report_size) {
+			bpf_spin_unlock(&existing_info->lock);
+			ctx->retval = -EINVAL;
+			return 0;
+		}
+
+		existing_info->report_id = report_id;
+		existing_info->raw_buffer_length =
+			existing_info->report_size -
+			(existing_info->keyboard_offset -
+			 (report_id != 0 ? 1 : 0));
+
+		existing_info->count = 0;
+		existing_info->mean = 0;
+		existing_info->M2 = 0;
+		existing_info->prev_keydown_ts = 0;
+
+		__builtin_memset(existing_info->prev_report, 0,
+				 sizeof(existing_info->prev_report));
+
+		bpf_spin_unlock(&existing_info->lock);
+		ctx->retval = 0;
+		return 0;
+	}
+
+	info.connection_time = bpf_ktime_get_ns();
+	info.bits_start = bits_start;
+	info.bits_end = bits_end;
+	info.keyboard_offset = bits_start / 8;
+	info.report_size = size_in_bytes;
+
+	if (info.keyboard_offset > info.report_size) {
+		ctx->retval = -EINVAL;
+		return 0;
+	}
+
+	info.report_id = report_id;
+	info.raw_buffer_length = info.report_size - (info.keyboard_offset -
+						     (report_id != 0 ? 1 : 0));
+
+	bpf_map_update_elem(&dev_details, &hid_id, &info, BPF_NOEXIST);
+	ctx->retval = 0;
 	return 0;
 }

diff --git a/src/bpf/testing/meson.build b/src/bpf/testing/meson.build
index 9d1b5d3..2586aea 100644
--- a/src/bpf/testing/meson.build
+++ b/src/bpf/testing/meson.build
@@ -11,6 +11,7 @@ tracing_sources = [
 # 'sources' are BPF programs only compatible with
 # struct_ops (kernel v6.11+)
 sources = [
+    '0010-Generic__keyboard.bpf.c',
 ]

 foreach bpf: tracing_sources
--
2.55.0

Re: [PATCH RFC v2 RESEND] HID: BPF: add keyboard behavioral anomaly detection

[Benjamin Tissoires]

Hi,

On Jul 22 2026, Krish Gulati wrote:
> This patch implements a HID-BPF struct_ops program that detects automated
> HID injection attacks. It does this by measuring post-enumeration delay
> and tracking inter-keystroke timing using Welford's online variance algorithm.
> State is stored in a hash map keyed by the HID ID.
> 
> Detection results are currently surfaced via bpf_printk(). A
> BPF_MAP_TYPE_RINGBUF interface with configurable userspace daemon
> is planned; deferred pending validation of detection heuristics.
> 
> Signal design is grounded in: Neuner et al., "USBlock: Blocking
> USB-based Keylogger Attacks", DBSec 2018.
> 
> Link: https://lore.kernel.org/linux-input/adSxXidgeWF0-Ewn@beelink/
> 
> Signed-off-by: Krish Gulati <krishgulati7@gmail.com>
> Suggested-by: Sashiko-bot <sashiko-bot@kernel.org>
> ---
> Changes since v1:
> - Added bpf_spin_lock/unlock around the Welford compound update in
>   kbd_hook() to close a data race on concurrent execution (was
>   lockless read-modify-write).
> - Switched dev_details from LRU_HASH to plain HASH so eviction
>   under map pressure fails the insert instead of silently
>   displacing an existing tracked device.
> - Store report_id in dev_info and gate kbd_hook() on it, so
>   composite devices no longer misattribute other report types'
>   bytes as keystrokes.
> - Zero dev_info with __builtin_memset before populating in probe()
>   to satisfy the verifier's stack-init tracking (was relying on a
>   partial designated initializer).
> - Replaced active-byte-count heuristic with bytewise diff/mask
>   (standard_boot_keypress/nkro_keypress) so consecutive keystrokes
>   without an intervening empty report are still detected.
> - Verified bucket-size rounding (8/16/32/64) does not drop events
>   or read out-of-bounds, tested via hid-replay with synthetic
>   report sizes (9, 14 bytes, etc.).
> 
> Known limitations, not addressed in this version:
> - No cleanup on device disconnect: hid_bpf_ops has no disconnect
>   hook, so dev_details entries persist until the map fills.
>   Deferred pending maintainer guidance on the right approach.
> - find_keyboard_field() returns on the first Keyboard-typed
>   (GenericDesktop/Keyboard) Application Collection found; a device
>   with multiple such collections within a single report descriptor
>   (as opposed to multiple HID interfaces, which are already handled
>   correctly and verified on real composite hardware) will only have
>   the first one tracked. Untested; the only hardware available for
>   testing exhibits the multiple-interface pattern rather than the
>   single-descriptor multi-collection pattern, so this path has not
>   been exercised.
> 
> Resending as a top-level thread (v2 was sent as a reply to v1 on July 9).
> Original thread: https://lore.kernel.org/linux-input/20260709104958.38303-1-krishgulati7@gmail.com
> 
>  src/bpf/testing/0010-Generic__keyboard.bpf.c | 311 +++++++++++++------
>  src/bpf/testing/meson.build                  |   1 +

These files are part of udev-hid-bpf, not the kernel. They will
eventually make it to the kernel, but the development happens on
gitlab.freedesktop.org.

Also, that patch makes changes to
"src/bpf/testing/0010-Generic__keyboard.bpf.c" which is not known to any
upstream, so we can't do much.

Cheers,
Benjamin

>  2 files changed, 217 insertions(+), 95 deletions(-)
> 
> diff --git a/src/bpf/testing/0010-Generic__keyboard.bpf.c b/src/bpf/testing/0010-Generic__keyboard.bpf.c
> index 9114587..c3f2364 100644
> --- a/src/bpf/testing/0010-Generic__keyboard.bpf.c
> +++ b/src/bpf/testing/0010-Generic__keyboard.bpf.c
> @@ -24,11 +24,11 @@
>  #define HID_GUARD_PED_SUSPICIOUS_THRESH (50 * HID_GUARD_NSEC_PER_MSEC)
>  #define HID_GUARD_PED_WARNING_THRESH (300 * HID_GUARD_NSEC_PER_MSEC)
> 
> -/*not derived from real typing data yet*/
> +/*not derived from real typing raw_buffer yet*/
>  #define HID_GUARD_MIN_SAMPLES 5
> 
>  /*
> - * Variance is "too metronomic
> + * Variance is "too metronomic"
>   * to be a human," expressed in ms^2 so we never need sqrt().
>   */
>  #define HID_GUARD_VARIANCE_THRESH_MS2 (40ULL * 40ULL)
> @@ -57,9 +57,17 @@ enum hid_guard_ped_flag {
>  };
> 
>  struct dev_info {
> -	__u64 connection_time;
> +	struct bpf_spin_lock lock;
> +	__u8 report_id;
> +	__u8 field_type;
> +	__u8 prev_report[64];
> +	__u16 bits_start;
> +	__u16 bits_end;
> +	__u16 usage_id;
>  	__u32 report_size;
> -	__u64 prev_report[32];
> +	__u32 keyboard_offset;
> +	__u64 connection_time;
> +	__u64 raw_buffer_length;
>  	/*welford's variables*/
>  	__u64 prev_keydown_ts;
>  	__u64 count;
> @@ -71,22 +79,8 @@ struct dev_info {
>  	 */
>  };
> 
> -/*
> - * BPF_MAP_TYPE_LRU_HASH:
> - * Using an LRU map automatically prevents exhaustion by silently evicting
> - * the oldest idle devices. It requires no syntax changes to the rest of the
> - * code (lookup/update helpers work identically), but introduces behavioral
> - * trade-offs:
> - *
> - * 1. Eviction wipes Welford variance history. An attacker
> - *    could theoretically flood the map to flush their device and reset their
> - *    score.
> - * 2. PED Blindspot: Eviction deletes the 'connection_time' set during probe().
> - *    If an evicted device wakes up, it will bypass post-enumeration delay
> - *    checks.
> - */
>  struct {
> -	__uint(type, BPF_MAP_TYPE_LRU_HASH);
> +	__uint(type, BPF_MAP_TYPE_HASH);
>  	__type(key, __u32);
>  	__type(value, struct dev_info);
>  	__uint(max_entries, 128);
> @@ -138,11 +132,29 @@ static __always_inline void welford(struct dev_info *dev_state,
>  	delta2 = x - dev_state->mean;
> 
>  	dev_state->M2 += (__u64)(delta * delta2);
> +}
> 
> -	bpf_printk("W[Count:%llu] Int:%llu ms, scaled_x:%lld\n",
> -		   dev_state->count, interval_ms, x);
> -	bpf_printk("  -> delta1:%lld, mean:%lld\n", delta, dev_state->mean);
> -	bpf_printk("  -> delta2:%lld, M2:%llu\n", delta2, dev_state->M2);
> +static __always_inline bool standard_boot_keypress(__u8 *current_report,
> +						   __u8 *prev_report)
> +{
> +	for (int i = 2; i < 8; i++) {
> +		if (current_report[i] != prev_report[i])
> +			return 1;
> +	}
> +	return 0;
> +}
> +
> +static __always_inline bool
> +nkro_keypress(__u8 *current_report, __u8 *prev_report, __u64 buffer_length)
> +{
> +	for (int i = 0; i < 64; i++) {
> +		if (i >= buffer_length)
> +			break;
> +
> +		if (current_report[i] & ~prev_report[i])
> +			return 1;
> +	}
> +	return 0;
>  }
> 
>  HID_BPF_CONFIG(HID_DEVICE(BUS_USB, HID_GROUP_ANY, HID_VID_ANY, HID_PID_ANY),
> @@ -150,7 +162,7 @@ HID_BPF_CONFIG(HID_DEVICE(BUS_USB, HID_GROUP_ANY, HID_VID_ANY, HID_PID_ANY),
>  			  HID_PID_ANY));
> 
>  SEC(HID_BPF_DEVICE_EVENT)
> -int BPF_PROG(kdb_hook, struct hid_bpf_ctx *hctx)
> +int BPF_PROG(kbd_hook, struct hid_bpf_ctx *hctx)
>  {
>  	__u32 hid_id = hctx->hid->id;
> 
> @@ -161,124 +173,233 @@ int BPF_PROG(kdb_hook, struct hid_bpf_ctx *hctx)
>  	if (!info)
>  		return 0;
> 
> -	__u32 size = info->report_size;
> -	__u32 fetch_size;
> -	__u8 *data;
> +	__u8 *raw_buffer;
> 
> -	if (size <= 8)
> -		fetch_size = 8;
> -	else if (size <= 16)
> -		fetch_size = 16;
> -	else
> -		fetch_size = 32;
> +	__u8 *report_id_data = hid_bpf_get_data(hctx, 0, 1);
> 
> -	data = hid_bpf_get_data(hctx, 0, fetch_size);
> +	if (!report_id_data)
> +		return 0;
> 
> -	if (!data)
> +	if (info->report_id != 0 && report_id_data[0] != info->report_id)
>  		return 0;
> -	int now_active_ks = 0, was_active_ks = 0;
> -#pragma unroll
> -	for (int i = 0; i < 32; i++) {
> -		if (i >= fetch_size)
> -			break;
> -		now_active_ks += ((__u8)data[i] + 255) >> 8;
> -		was_active_ks += ((__u8)info->prev_report[i] + 255) >> 8;
> 
> -		info->prev_report[i] = data[i];
> +	__u32 offset = info->keyboard_offset + (info->report_id != 0 ? 1 : 0);
> +
> +	__u64 buffer_length = info->raw_buffer_length;
> +
> +	if (buffer_length <= 8)
> +		raw_buffer = hid_bpf_get_data(hctx, offset, 8);
> +	else if (buffer_length <= 16)
> +		raw_buffer = hid_bpf_get_data(hctx, offset, 16);
> +	else if (buffer_length <= 32)
> +		raw_buffer = hid_bpf_get_data(hctx, offset, 32);
> +	else
> +		raw_buffer = hid_bpf_get_data(hctx, offset, 64);
> +
> +	if (!raw_buffer)
> +		return 0;
> +
> +	bool new_key_pressed = false;
> +
> +	if (info->report_id == 0) {
> +		new_key_pressed =
> +			standard_boot_keypress(raw_buffer, info->prev_report);
> +	} else {
> +		new_key_pressed = nkro_keypress(raw_buffer, info->prev_report,
> +						buffer_length);
>  	}
> 
> -	__u64 current_ms = bpf_ktime_get_ns() / HID_GUARD_NSEC_PER_MSEC;
> +	__u64 now = bpf_ktime_get_ns();
> 
> -	if (now_active_ks > was_active_ks) {
> +	__u64 interval_ms = 0;
> +	__u64 variance_m2 = 0;
> +	bool is_idle_gap = false;
> +	bool is_suspicious = false;
> +	enum hid_guard_ped_flag ped_flag = HID_GUARD_PED_NO_ENTRY;
> +	bool run_ped = false;
> +
> +	bpf_spin_lock(&info->lock);
> +
> +	if (new_key_pressed) {
>  		if (info->prev_keydown_ts != 0) {
> -			__u64 interval_ms = current_ms - info->prev_keydown_ts;
> +			interval_ms = (now - info->prev_keydown_ts) /
> +				      HID_GUARD_NSEC_PER_MSEC;
> 
> -			if (interval_ms < HID_GUARD_IDLE_GAP_THRESH_MS) {
> +			if (interval_ms < HID_GUARD_IDLE_GAP_THRESH_MS)
>  				welford(info, interval_ms);
> -			} else {
> -				bpf_printk(
> -					"hid %d: idle gap %llu ms excluded from sample\n",
> -					hid_id, interval_ms);
> -			}
> +			else
> +				is_idle_gap = true;
>  		}
> 
> +		/*
> +		 * Variance check runs after welford() so the current
> +		 * sample is already folded in before we decide.
> +		 * Guard on MIN_SAMPLES: Welford's unbiased estimator
> +		 * (M2 / (count - 1)) is undefined for count < 2, and
> +		 * unreliable until a few samples have accumulated.
> +		 */
>  		if (info->count >= HID_GUARD_MIN_SAMPLES) {
> -			__u64 variance_m2 =
> +			variance_m2 =
>  				info->M2 /
>  				((__u64)HID_GUARD_WELFORD_SCALE *
>  				 HID_GUARD_WELFORD_SCALE * (info->count - 1));
> -			/*
> -			 * the initial interval x was multiplied by HID_GUARD_WELFORD_SCALE, both
> -			 * delta and delta2 are also scaled by that factor,
> -			 * thus scale^2 in the denominator
> -			 */
> -			if (variance_m2 < HID_GUARD_VARIANCE_THRESH_MS2) {
> -				bpf_printk(
> -					"hid %d: Suspeciously regular typing, variance=%llu ms^2\n",
> -					hid_id, variance_m2);
> -			}
> +			if (variance_m2 < HID_GUARD_VARIANCE_THRESH_MS2)
> +				is_suspicious = true;
>  		}
> 
> -		info->prev_keydown_ts = current_ms;
> +		info->prev_keydown_ts = now;
>  	}
> 
> -	if (info->connection_time != 0) {
> -		enum hid_guard_ped_flag ped_flag =
> -			post_enumeration_delay(info, bpf_ktime_get_ns());
> -
> -		bpf_printk("PED flag for hid %d: %d\n", hid_id, ped_flag);
> +	for (int i = 0; i < 64; i++) {
> +		if (i >= buffer_length)
> +			break;
> +		info->prev_report[i] = raw_buffer[i];
> +	}
> 
> -		/*
> -		 * Prevent re-evaluation on subsequent packets for this device
> -		 */
> +	/*
> +	 * PED: fires exactly once per device lifetime. connection_time
> +	 * is set at probe() time; we clear it here so subsequent events
> +	 * skip this branch entirely.
> +	 */
> +	if (info->connection_time != 0) {
> +		ped_flag = post_enumeration_delay(info, now);
>  		info->connection_time = 0;
> +		run_ped = true;
>  	}
> +
> +	bpf_spin_unlock(&info->lock);
> +
> +	if (new_key_pressed) {
> +		if (is_idle_gap)
> +			bpf_printk(
> +				"hid %d: idle gap %llu ms excluded from sample\n",
> +				hid_id, interval_ms);
> +		if (is_suspicious)
> +			bpf_printk(
> +				"hid %d: suspiciously regular typing, variance=%llu ms^2\n",
> +				hid_id, variance_m2);
> +	}
> +
> +	if (run_ped)
> +		bpf_printk("hid %d: PED flag=%d\n", hid_id, ped_flag);
> +
>  	return 0;
>  }
> 
>  HID_BPF_OPS(hook_keyboard) = {
> -	.hid_device_event = (void *)kdb_hook,
> +	.hid_device_event = (void *)kbd_hook,
>  };
> 
>  struct hid_rdesc_descriptor HID_REPORT_DESCRIPTOR;
> 
> -SEC("syscall")
> -int probe(struct hid_bpf_probe_args *ctx)
> +static __always_inline bool find_keyboard_field(__u16 *bits_start,
> +						__u16 *bits_end,
> +						__u8 *report_id,
> +						__u32 *size_in_bytes)
>  {
>  	struct hid_rdesc_report *input;
>  	struct hid_rdesc_field *field;
>  	struct hid_rdesc_collection *col;
> 
>  	hid_bpf_for_each_input_report(&HID_REPORT_DESCRIPTOR, input) {
> -		__u32 size_in_bytes = (input->size_in_bits + 7) / 8;
> -
> -		bpf_printk("Report size: %d\n", size_in_bytes);
> -		if (input->report_id != 0)
> -			size_in_bytes += 1;
> -
> -		bpf_printk("Report size after report_id: %d\n", size_in_bytes);
> -
>  		hid_bpf_for_each_field(input, field) {
>  			hid_bpf_for_each_collection(field, col) {
>  				if (col->usage_page ==
>  					    HidUsagePage_GenericDesktop &&
>  				    col->usage_id == HidUsage_GD_Keyboard) {
> -					__u32 key = ctx->hid;
> -					struct dev_info info = {
> -						.connection_time =
> -							bpf_ktime_get_ns(),
> -						.count = 0,
> -						.report_size = size_in_bytes
> -					};
> -					bpf_map_update_elem(&dev_details, &key,
> -							    &info, BPF_ANY);
> -					ctx->retval = 0;
> -					return 0;
> +					*size_in_bytes =
> +						input->size_in_bits / 8;
> +
> +					if (input->report_id != 0)
> +						*size_in_bytes += 1;
> +
> +					*bits_start = field->bits_start;
> +					*bits_end = field->bits_end;
> +					*report_id = input->report_id;
> +					return true;
>  				}
>  			}
>  		}
>  	}
> -	ctx->retval = -EINVAL;
> +	return false;
> +}
> +
> +SEC("syscall")
> +int probe(struct hid_bpf_probe_args *ctx)
> +{
> +	__u8 report_id;
> +	__u16 bits_start, bits_end;
> +	__u32 size_in_bytes;
> +	__u32 hid_id = ctx->hid;
> +
> +	struct dev_info *existing_info =
> +		bpf_map_lookup_elem(&dev_details, &hid_id);
> +
> +	struct dev_info info;
> +
> +	__builtin_memset(&info, 0, sizeof(info));
> +
> +	if (!find_keyboard_field(&bits_start, &bits_end, &report_id,
> +				 &size_in_bytes)) {
> +		ctx->retval = -EINVAL;
> +		return 0;
> +	}
> +
> +	if (existing_info != NULL) {
> +		__u64 now = bpf_ktime_get_ns();
> +
> +		bpf_spin_lock(&existing_info->lock);
> +
> +		existing_info->connection_time = now;
> +
> +		existing_info->bits_start = bits_start;
> +		existing_info->bits_end = bits_end;
> +		existing_info->keyboard_offset = bits_start / 8;
> +		existing_info->report_size = size_in_bytes;
> +
> +		if (existing_info->keyboard_offset >
> +		    existing_info->report_size) {
> +			bpf_spin_unlock(&existing_info->lock);
> +			ctx->retval = -EINVAL;
> +			return 0;
> +		}
> +
> +		existing_info->report_id = report_id;
> +		existing_info->raw_buffer_length =
> +			existing_info->report_size -
> +			(existing_info->keyboard_offset -
> +			 (report_id != 0 ? 1 : 0));
> +
> +		existing_info->count = 0;
> +		existing_info->mean = 0;
> +		existing_info->M2 = 0;
> +		existing_info->prev_keydown_ts = 0;
> +
> +		__builtin_memset(existing_info->prev_report, 0,
> +				 sizeof(existing_info->prev_report));
> +
> +		bpf_spin_unlock(&existing_info->lock);
> +		ctx->retval = 0;
> +		return 0;
> +	}
> +
> +	info.connection_time = bpf_ktime_get_ns();
> +	info.bits_start = bits_start;
> +	info.bits_end = bits_end;
> +	info.keyboard_offset = bits_start / 8;
> +	info.report_size = size_in_bytes;
> +
> +	if (info.keyboard_offset > info.report_size) {
> +		ctx->retval = -EINVAL;
> +		return 0;
> +	}
> +
> +	info.report_id = report_id;
> +	info.raw_buffer_length = info.report_size - (info.keyboard_offset -
> +						     (report_id != 0 ? 1 : 0));
> +
> +	bpf_map_update_elem(&dev_details, &hid_id, &info, BPF_NOEXIST);
> +	ctx->retval = 0;
>  	return 0;
>  }
> 
> diff --git a/src/bpf/testing/meson.build b/src/bpf/testing/meson.build
> index 9d1b5d3..2586aea 100644
> --- a/src/bpf/testing/meson.build
> +++ b/src/bpf/testing/meson.build
> @@ -11,6 +11,7 @@ tracing_sources = [
>  # 'sources' are BPF programs only compatible with
>  # struct_ops (kernel v6.11+)
>  sources = [
> +    '0010-Generic__keyboard.bpf.c',
>  ]
> 
>  foreach bpf: tracing_sources
> --
> 2.55.0
> 
> 

Re: [PATCH RFC v2 RESEND] HID: BPF: add keyboard behavioral anomaly detection

[Krish Gulati]

Hi Benjamin,

> These files are part of udev-hid-bpf, not the kernel. They will
> eventually make it to the kernel, but the development happens on
> gitlab.freedesktop.org.
>
> Also, that patch makes changes to
> "src/bpf/testing/0010-Generic__keyboard.bpf.c" which is not known to any
> upstream, so we can't do much.

Thanks for the pointer -- I'll move this over to gitlab.freedesktop.org
and open a merge request against udev-hid-bpf directly.

Regards,
Krish

On Thu, Jul 30, 2026 at 1:42 PM Benjamin Tissoires <bentiss@kernel.org> wrote:
>
> Hi,
>
> On Jul 22 2026, Krish Gulati wrote:
> > This patch implements a HID-BPF struct_ops program that detects automated
> > HID injection attacks. It does this by measuring post-enumeration delay
> > and tracking inter-keystroke timing using Welford's online variance algorithm.
> > State is stored in a hash map keyed by the HID ID.
> >
> > Detection results are currently surfaced via bpf_printk(). A
> > BPF_MAP_TYPE_RINGBUF interface with configurable userspace daemon
> > is planned; deferred pending validation of detection heuristics.
> >
> > Signal design is grounded in: Neuner et al., "USBlock: Blocking
> > USB-based Keylogger Attacks", DBSec 2018.
> >
> > Link: https://lore.kernel.org/linux-input/adSxXidgeWF0-Ewn@beelink/
> >
> > Signed-off-by: Krish Gulati <krishgulati7@gmail.com>
> > Suggested-by: Sashiko-bot <sashiko-bot@kernel.org>
> > ---
> > Changes since v1:
> > - Added bpf_spin_lock/unlock around the Welford compound update in
> >   kbd_hook() to close a data race on concurrent execution (was
> >   lockless read-modify-write).
> > - Switched dev_details from LRU_HASH to plain HASH so eviction
> >   under map pressure fails the insert instead of silently
> >   displacing an existing tracked device.
> > - Store report_id in dev_info and gate kbd_hook() on it, so
> >   composite devices no longer misattribute other report types'
> >   bytes as keystrokes.
> > - Zero dev_info with __builtin_memset before populating in probe()
> >   to satisfy the verifier's stack-init tracking (was relying on a
> >   partial designated initializer).
> > - Replaced active-byte-count heuristic with bytewise diff/mask
> >   (standard_boot_keypress/nkro_keypress) so consecutive keystrokes
> >   without an intervening empty report are still detected.
> > - Verified bucket-size rounding (8/16/32/64) does not drop events
> >   or read out-of-bounds, tested via hid-replay with synthetic
> >   report sizes (9, 14 bytes, etc.).
> >
> > Known limitations, not addressed in this version:
> > - No cleanup on device disconnect: hid_bpf_ops has no disconnect
> >   hook, so dev_details entries persist until the map fills.
> >   Deferred pending maintainer guidance on the right approach.
> > - find_keyboard_field() returns on the first Keyboard-typed
> >   (GenericDesktop/Keyboard) Application Collection found; a device
> >   with multiple such collections within a single report descriptor
> >   (as opposed to multiple HID interfaces, which are already handled
> >   correctly and verified on real composite hardware) will only have
> >   the first one tracked. Untested; the only hardware available for
> >   testing exhibits the multiple-interface pattern rather than the
> >   single-descriptor multi-collection pattern, so this path has not
> >   been exercised.
> >
> > Resending as a top-level thread (v2 was sent as a reply to v1 on July 9).
> > Original thread: https://lore.kernel.org/linux-input/20260709104958.38303-1-krishgulati7@gmail.com
> >
> >  src/bpf/testing/0010-Generic__keyboard.bpf.c | 311 +++++++++++++------
> >  src/bpf/testing/meson.build                  |   1 +
>
> These files are part of udev-hid-bpf, not the kernel. They will
> eventually make it to the kernel, but the development happens on
> gitlab.freedesktop.org.
>
> Also, that patch makes changes to
> "src/bpf/testing/0010-Generic__keyboard.bpf.c" which is not known to any
> upstream, so we can't do much.
>
> Cheers,
> Benjamin
>
> >  2 files changed, 217 insertions(+), 95 deletions(-)
> >
> > diff --git a/src/bpf/testing/0010-Generic__keyboard.bpf.c b/src/bpf/testing/0010-Generic__keyboard.bpf.c
> > index 9114587..c3f2364 100644
> > --- a/src/bpf/testing/0010-Generic__keyboard.bpf.c
> > +++ b/src/bpf/testing/0010-Generic__keyboard.bpf.c
> > @@ -24,11 +24,11 @@
> >  #define HID_GUARD_PED_SUSPICIOUS_THRESH (50 * HID_GUARD_NSEC_PER_MSEC)
> >  #define HID_GUARD_PED_WARNING_THRESH (300 * HID_GUARD_NSEC_PER_MSEC)
> >
> > -/*not derived from real typing data yet*/
> > +/*not derived from real typing raw_buffer yet*/
> >  #define HID_GUARD_MIN_SAMPLES 5
> >
> >  /*
> > - * Variance is "too metronomic
> > + * Variance is "too metronomic"
> >   * to be a human," expressed in ms^2 so we never need sqrt().
> >   */
> >  #define HID_GUARD_VARIANCE_THRESH_MS2 (40ULL * 40ULL)
> > @@ -57,9 +57,17 @@ enum hid_guard_ped_flag {
> >  };
> >
> >  struct dev_info {
> > -     __u64 connection_time;
> > +     struct bpf_spin_lock lock;
> > +     __u8 report_id;
> > +     __u8 field_type;
> > +     __u8 prev_report[64];
> > +     __u16 bits_start;
> > +     __u16 bits_end;
> > +     __u16 usage_id;
> >       __u32 report_size;
> > -     __u64 prev_report[32];
> > +     __u32 keyboard_offset;
> > +     __u64 connection_time;
> > +     __u64 raw_buffer_length;
> >       /*welford's variables*/
> >       __u64 prev_keydown_ts;
> >       __u64 count;
> > @@ -71,22 +79,8 @@ struct dev_info {
> >        */
> >  };
> >
> > -/*
> > - * BPF_MAP_TYPE_LRU_HASH:
> > - * Using an LRU map automatically prevents exhaustion by silently evicting
> > - * the oldest idle devices. It requires no syntax changes to the rest of the
> > - * code (lookup/update helpers work identically), but introduces behavioral
> > - * trade-offs:
> > - *
> > - * 1. Eviction wipes Welford variance history. An attacker
> > - *    could theoretically flood the map to flush their device and reset their
> > - *    score.
> > - * 2. PED Blindspot: Eviction deletes the 'connection_time' set during probe().
> > - *    If an evicted device wakes up, it will bypass post-enumeration delay
> > - *    checks.
> > - */
> >  struct {
> > -     __uint(type, BPF_MAP_TYPE_LRU_HASH);
> > +     __uint(type, BPF_MAP_TYPE_HASH);
> >       __type(key, __u32);
> >       __type(value, struct dev_info);
> >       __uint(max_entries, 128);
> > @@ -138,11 +132,29 @@ static __always_inline void welford(struct dev_info *dev_state,
> >       delta2 = x - dev_state->mean;
> >
> >       dev_state->M2 += (__u64)(delta * delta2);
> > +}
> >
> > -     bpf_printk("W[Count:%llu] Int:%llu ms, scaled_x:%lld\n",
> > -                dev_state->count, interval_ms, x);
> > -     bpf_printk("  -> delta1:%lld, mean:%lld\n", delta, dev_state->mean);
> > -     bpf_printk("  -> delta2:%lld, M2:%llu\n", delta2, dev_state->M2);
> > +static __always_inline bool standard_boot_keypress(__u8 *current_report,
> > +                                                __u8 *prev_report)
> > +{
> > +     for (int i = 2; i < 8; i++) {
> > +             if (current_report[i] != prev_report[i])
> > +                     return 1;
> > +     }
> > +     return 0;
> > +}
> > +
> > +static __always_inline bool
> > +nkro_keypress(__u8 *current_report, __u8 *prev_report, __u64 buffer_length)
> > +{
> > +     for (int i = 0; i < 64; i++) {
> > +             if (i >= buffer_length)
> > +                     break;
> > +
> > +             if (current_report[i] & ~prev_report[i])
> > +                     return 1;
> > +     }
> > +     return 0;
> >  }
> >
> >  HID_BPF_CONFIG(HID_DEVICE(BUS_USB, HID_GROUP_ANY, HID_VID_ANY, HID_PID_ANY),
> > @@ -150,7 +162,7 @@ HID_BPF_CONFIG(HID_DEVICE(BUS_USB, HID_GROUP_ANY, HID_VID_ANY, HID_PID_ANY),
> >                         HID_PID_ANY));
> >
> >  SEC(HID_BPF_DEVICE_EVENT)
> > -int BPF_PROG(kdb_hook, struct hid_bpf_ctx *hctx)
> > +int BPF_PROG(kbd_hook, struct hid_bpf_ctx *hctx)
> >  {
> >       __u32 hid_id = hctx->hid->id;
> >
> > @@ -161,124 +173,233 @@ int BPF_PROG(kdb_hook, struct hid_bpf_ctx *hctx)
> >       if (!info)
> >               return 0;
> >
> > -     __u32 size = info->report_size;
> > -     __u32 fetch_size;
> > -     __u8 *data;
> > +     __u8 *raw_buffer;
> >
> > -     if (size <= 8)
> > -             fetch_size = 8;
> > -     else if (size <= 16)
> > -             fetch_size = 16;
> > -     else
> > -             fetch_size = 32;
> > +     __u8 *report_id_data = hid_bpf_get_data(hctx, 0, 1);
> >
> > -     data = hid_bpf_get_data(hctx, 0, fetch_size);
> > +     if (!report_id_data)
> > +             return 0;
> >
> > -     if (!data)
> > +     if (info->report_id != 0 && report_id_data[0] != info->report_id)
> >               return 0;
> > -     int now_active_ks = 0, was_active_ks = 0;
> > -#pragma unroll
> > -     for (int i = 0; i < 32; i++) {
> > -             if (i >= fetch_size)
> > -                     break;
> > -             now_active_ks += ((__u8)data[i] + 255) >> 8;
> > -             was_active_ks += ((__u8)info->prev_report[i] + 255) >> 8;
> >
> > -             info->prev_report[i] = data[i];
> > +     __u32 offset = info->keyboard_offset + (info->report_id != 0 ? 1 : 0);
> > +
> > +     __u64 buffer_length = info->raw_buffer_length;
> > +
> > +     if (buffer_length <= 8)
> > +             raw_buffer = hid_bpf_get_data(hctx, offset, 8);
> > +     else if (buffer_length <= 16)
> > +             raw_buffer = hid_bpf_get_data(hctx, offset, 16);
> > +     else if (buffer_length <= 32)
> > +             raw_buffer = hid_bpf_get_data(hctx, offset, 32);
> > +     else
> > +             raw_buffer = hid_bpf_get_data(hctx, offset, 64);
> > +
> > +     if (!raw_buffer)
> > +             return 0;
> > +
> > +     bool new_key_pressed = false;
> > +
> > +     if (info->report_id == 0) {
> > +             new_key_pressed =
> > +                     standard_boot_keypress(raw_buffer, info->prev_report);
> > +     } else {
> > +             new_key_pressed = nkro_keypress(raw_buffer, info->prev_report,
> > +                                             buffer_length);
> >       }
> >
> > -     __u64 current_ms = bpf_ktime_get_ns() / HID_GUARD_NSEC_PER_MSEC;
> > +     __u64 now = bpf_ktime_get_ns();
> >
> > -     if (now_active_ks > was_active_ks) {
> > +     __u64 interval_ms = 0;
> > +     __u64 variance_m2 = 0;
> > +     bool is_idle_gap = false;
> > +     bool is_suspicious = false;
> > +     enum hid_guard_ped_flag ped_flag = HID_GUARD_PED_NO_ENTRY;
> > +     bool run_ped = false;
> > +
> > +     bpf_spin_lock(&info->lock);
> > +
> > +     if (new_key_pressed) {
> >               if (info->prev_keydown_ts != 0) {
> > -                     __u64 interval_ms = current_ms - info->prev_keydown_ts;
> > +                     interval_ms = (now - info->prev_keydown_ts) /
> > +                                   HID_GUARD_NSEC_PER_MSEC;
> >
> > -                     if (interval_ms < HID_GUARD_IDLE_GAP_THRESH_MS) {
> > +                     if (interval_ms < HID_GUARD_IDLE_GAP_THRESH_MS)
> >                               welford(info, interval_ms);
> > -                     } else {
> > -                             bpf_printk(
> > -                                     "hid %d: idle gap %llu ms excluded from sample\n",
> > -                                     hid_id, interval_ms);
> > -                     }
> > +                     else
> > +                             is_idle_gap = true;
> >               }
> >
> > +             /*
> > +              * Variance check runs after welford() so the current
> > +              * sample is already folded in before we decide.
> > +              * Guard on MIN_SAMPLES: Welford's unbiased estimator
> > +              * (M2 / (count - 1)) is undefined for count < 2, and
> > +              * unreliable until a few samples have accumulated.
> > +              */
> >               if (info->count >= HID_GUARD_MIN_SAMPLES) {
> > -                     __u64 variance_m2 =
> > +                     variance_m2 =
> >                               info->M2 /
> >                               ((__u64)HID_GUARD_WELFORD_SCALE *
> >                                HID_GUARD_WELFORD_SCALE * (info->count - 1));
> > -                     /*
> > -                      * the initial interval x was multiplied by HID_GUARD_WELFORD_SCALE, both
> > -                      * delta and delta2 are also scaled by that factor,
> > -                      * thus scale^2 in the denominator
> > -                      */
> > -                     if (variance_m2 < HID_GUARD_VARIANCE_THRESH_MS2) {
> > -                             bpf_printk(
> > -                                     "hid %d: Suspeciously regular typing, variance=%llu ms^2\n",
> > -                                     hid_id, variance_m2);
> > -                     }
> > +                     if (variance_m2 < HID_GUARD_VARIANCE_THRESH_MS2)
> > +                             is_suspicious = true;
> >               }
> >
> > -             info->prev_keydown_ts = current_ms;
> > +             info->prev_keydown_ts = now;
> >       }
> >
> > -     if (info->connection_time != 0) {
> > -             enum hid_guard_ped_flag ped_flag =
> > -                     post_enumeration_delay(info, bpf_ktime_get_ns());
> > -
> > -             bpf_printk("PED flag for hid %d: %d\n", hid_id, ped_flag);
> > +     for (int i = 0; i < 64; i++) {
> > +             if (i >= buffer_length)
> > +                     break;
> > +             info->prev_report[i] = raw_buffer[i];
> > +     }
> >
> > -             /*
> > -              * Prevent re-evaluation on subsequent packets for this device
> > -              */
> > +     /*
> > +      * PED: fires exactly once per device lifetime. connection_time
> > +      * is set at probe() time; we clear it here so subsequent events
> > +      * skip this branch entirely.
> > +      */
> > +     if (info->connection_time != 0) {
> > +             ped_flag = post_enumeration_delay(info, now);
> >               info->connection_time = 0;
> > +             run_ped = true;
> >       }
> > +
> > +     bpf_spin_unlock(&info->lock);
> > +
> > +     if (new_key_pressed) {
> > +             if (is_idle_gap)
> > +                     bpf_printk(
> > +                             "hid %d: idle gap %llu ms excluded from sample\n",
> > +                             hid_id, interval_ms);
> > +             if (is_suspicious)
> > +                     bpf_printk(
> > +                             "hid %d: suspiciously regular typing, variance=%llu ms^2\n",
> > +                             hid_id, variance_m2);
> > +     }
> > +
> > +     if (run_ped)
> > +             bpf_printk("hid %d: PED flag=%d\n", hid_id, ped_flag);
> > +
> >       return 0;
> >  }
> >
> >  HID_BPF_OPS(hook_keyboard) = {
> > -     .hid_device_event = (void *)kdb_hook,
> > +     .hid_device_event = (void *)kbd_hook,
> >  };
> >
> >  struct hid_rdesc_descriptor HID_REPORT_DESCRIPTOR;
> >
> > -SEC("syscall")
> > -int probe(struct hid_bpf_probe_args *ctx)
> > +static __always_inline bool find_keyboard_field(__u16 *bits_start,
> > +                                             __u16 *bits_end,
> > +                                             __u8 *report_id,
> > +                                             __u32 *size_in_bytes)
> >  {
> >       struct hid_rdesc_report *input;
> >       struct hid_rdesc_field *field;
> >       struct hid_rdesc_collection *col;
> >
> >       hid_bpf_for_each_input_report(&HID_REPORT_DESCRIPTOR, input) {
> > -             __u32 size_in_bytes = (input->size_in_bits + 7) / 8;
> > -
> > -             bpf_printk("Report size: %d\n", size_in_bytes);
> > -             if (input->report_id != 0)
> > -                     size_in_bytes += 1;
> > -
> > -             bpf_printk("Report size after report_id: %d\n", size_in_bytes);
> > -
> >               hid_bpf_for_each_field(input, field) {
> >                       hid_bpf_for_each_collection(field, col) {
> >                               if (col->usage_page ==
> >                                           HidUsagePage_GenericDesktop &&
> >                                   col->usage_id == HidUsage_GD_Keyboard) {
> > -                                     __u32 key = ctx->hid;
> > -                                     struct dev_info info = {
> > -                                             .connection_time =
> > -                                                     bpf_ktime_get_ns(),
> > -                                             .count = 0,
> > -                                             .report_size = size_in_bytes
> > -                                     };
> > -                                     bpf_map_update_elem(&dev_details, &key,
> > -                                                         &info, BPF_ANY);
> > -                                     ctx->retval = 0;
> > -                                     return 0;
> > +                                     *size_in_bytes =
> > +                                             input->size_in_bits / 8;
> > +
> > +                                     if (input->report_id != 0)
> > +                                             *size_in_bytes += 1;
> > +
> > +                                     *bits_start = field->bits_start;
> > +                                     *bits_end = field->bits_end;
> > +                                     *report_id = input->report_id;
> > +                                     return true;
> >                               }
> >                       }
> >               }
> >       }
> > -     ctx->retval = -EINVAL;
> > +     return false;
> > +}
> > +
> > +SEC("syscall")
> > +int probe(struct hid_bpf_probe_args *ctx)
> > +{
> > +     __u8 report_id;
> > +     __u16 bits_start, bits_end;
> > +     __u32 size_in_bytes;
> > +     __u32 hid_id = ctx->hid;
> > +
> > +     struct dev_info *existing_info =
> > +             bpf_map_lookup_elem(&dev_details, &hid_id);
> > +
> > +     struct dev_info info;
> > +
> > +     __builtin_memset(&info, 0, sizeof(info));
> > +
> > +     if (!find_keyboard_field(&bits_start, &bits_end, &report_id,
> > +                              &size_in_bytes)) {
> > +             ctx->retval = -EINVAL;
> > +             return 0;
> > +     }
> > +
> > +     if (existing_info != NULL) {
> > +             __u64 now = bpf_ktime_get_ns();
> > +
> > +             bpf_spin_lock(&existing_info->lock);
> > +
> > +             existing_info->connection_time = now;
> > +
> > +             existing_info->bits_start = bits_start;
> > +             existing_info->bits_end = bits_end;
> > +             existing_info->keyboard_offset = bits_start / 8;
> > +             existing_info->report_size = size_in_bytes;
> > +
> > +             if (existing_info->keyboard_offset >
> > +                 existing_info->report_size) {
> > +                     bpf_spin_unlock(&existing_info->lock);
> > +                     ctx->retval = -EINVAL;
> > +                     return 0;
> > +             }
> > +
> > +             existing_info->report_id = report_id;
> > +             existing_info->raw_buffer_length =
> > +                     existing_info->report_size -
> > +                     (existing_info->keyboard_offset -
> > +                      (report_id != 0 ? 1 : 0));
> > +
> > +             existing_info->count = 0;
> > +             existing_info->mean = 0;
> > +             existing_info->M2 = 0;
> > +             existing_info->prev_keydown_ts = 0;
> > +
> > +             __builtin_memset(existing_info->prev_report, 0,
> > +                              sizeof(existing_info->prev_report));
> > +
> > +             bpf_spin_unlock(&existing_info->lock);
> > +             ctx->retval = 0;
> > +             return 0;
> > +     }
> > +
> > +     info.connection_time = bpf_ktime_get_ns();
> > +     info.bits_start = bits_start;
> > +     info.bits_end = bits_end;
> > +     info.keyboard_offset = bits_start / 8;
> > +     info.report_size = size_in_bytes;
> > +
> > +     if (info.keyboard_offset > info.report_size) {
> > +             ctx->retval = -EINVAL;
> > +             return 0;
> > +     }
> > +
> > +     info.report_id = report_id;
> > +     info.raw_buffer_length = info.report_size - (info.keyboard_offset -
> > +                                                  (report_id != 0 ? 1 : 0));
> > +
> > +     bpf_map_update_elem(&dev_details, &hid_id, &info, BPF_NOEXIST);
> > +     ctx->retval = 0;
> >       return 0;
> >  }
> >
> > diff --git a/src/bpf/testing/meson.build b/src/bpf/testing/meson.build
> > index 9d1b5d3..2586aea 100644
> > --- a/src/bpf/testing/meson.build
> > +++ b/src/bpf/testing/meson.build
> > @@ -11,6 +11,7 @@ tracing_sources = [
> >  # 'sources' are BPF programs only compatible with
> >  # struct_ops (kernel v6.11+)
> >  sources = [
> > +    '0010-Generic__keyboard.bpf.c',
> >  ]
> >
> >  foreach bpf: tracing_sources
> > --
> > 2.55.0
> >
> >