user/sven/linux.git/drivers/hid/bpf, branch next/master

bpf: Add fix for Trust Philips SPK6327 (145f:024b) modifier keys

2026-04-08T19:47:02Z

The Trust Philips SPK6327 keyboard (USB ID 145f:024b) has a broken HID descriptor on interface 1. Byte 101 is 0x00 (Input Array) but should be 0x02 (Input Variable), causing LCtrl, LAlt, Super, RAlt, RCtrl and RShift to all report as LShift on Linux. This BPF fix patches byte 101 at runtime fixing all affected modifier keys. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/234 Signed-off-by: muhammed Rishal Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: Add support for the Huion KeyDial K20 over bluetooth

2026-04-08T19:46:00Z

When connected over bluetooth this device is just different enough that forcing it into the same source file as the USB connection doesn't gain us much benefit. So let's duplicate this. Code and tests originally produced by Claude code. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/work_items/69 Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/201 Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: add a BPF to get the touchpad type

2026-04-08T19:46:00Z

Currently the kernel is scheduled to do this call by itself, but it requires a kernel v6.18 at least to have the INPUT_PROP set. For older kernels, we can try to query the property from a HID-BPF probe, and set a udev property based on that. This way we can provide the information to old kernels without modifying them. Signed-off-by: Benjamin Tissoires Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/220 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

hid: bpf: hid_bpf_helpers: add helper for having read/write udev properties

2026-04-08T19:46:00Z

We want udev-hid-bpf to be able to set udev properties by printing them out after the BPF object has been loaded. This allows to make a query to the device, and set a udev prop based on the answer. Because the way udev works, the properties are cleared on bind/unbind, and we need a way to store them. After several attempts to keep the property alive without re-running the udev-hid-bpf tool to communicate with the device, it came out that HID-BPF maps are pinned in the bpffs and we can then query them. So the following would export a UDEV property in the bpffs: EXPORT_UDEV_PROP(HID_FOO, 32); SEC("syscall") int probe(struct hid_bpf_probe_args *ctx) { const char *foo = "foo"; UDEV_PROP_SPRINTF(HID_FOO, "%s", foo); return 0; } Then, we can debug it with a simple cat: sudo cat /sys/fs/bpf/hid/.../UDEV_PROP_HID_FOO 0: {['f','o','o',],} This way, the property is always accessible without talking to the device Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/220 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: handle injected report descriptor in HID-BPF

2026-04-08T19:46:00Z

udev-hid-bpf is now capable of injecting the parsed report descriptor in the program. Provide the macros required for it. Sync up from udev-hid-bpf commits: bpf: inject the parsed report descriptor in HID_REPORT_DESCRIPTOR hid_bpf_helpers: provide iterator macros for walking the HID report descriptor hid_bpf_helpers: Add extract_bits function bpf: add hid_usages.h bpf: move the report descriptor structs into their own header Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/221 Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/228 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: add helper macros for LE/BE conversion

2026-04-08T19:46:00Z

BPF has bpf_htons and friends but those only work with data in Big Endian format. HID is little endian so we need our own macros. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/221 Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: hid_bpf_helpers: provide a cleanup functions

2026-04-08T19:46:00Z

Combination of 2 udev-hid-bpf commits: bpf: hid_bpf_helpers: provide a cleanup function for hid_bpf_release_context bpf: helpers: add guard(bpf_spin) macro Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/221 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: fix some signed vs unsigned compiler warnings

2026-04-08T19:46:00Z

On udev-hid-bpf, we are now getting warnings here, shut them off. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/227 Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

Merge tag 'hid-for-linus-2026031701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2026-03-17T20:55:51Z

Pull HID fixes from Jiri Kosina: - various fixes dealing with (intentionally) broken devices in HID core, logitech-hidpp and multitouch drivers (Lee Jones) - fix for OOB in wacom driver (Benoît Sevens) - fix for potentialy HID-bpf-induced buffer overflow in () (Benjamin Tissoires) - various other small fixes and device ID / quirk additions * tag 'hid-for-linus-2026031701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: multitouch: Check to ensure report responses match the request HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure HID: bpf: prevent buffer overflow in hid_hw_request selftests/hid: fix compilation when bpf_wq and hid_device are not exported HID: core: Mitigate potential OOB by removing bogus memset() HID: intel-thc-hid: Set HID_PHYS with PCI BDF HID: appletb-kbd: add .resume method in PM HID: logitech-hidpp: Enable MX Master 4 over bluetooth HID: input: Add HID_BATTERY_QUIRK_DYNAMIC for Elan touchscreens HID: input: Drop Asus UX550* touchscreen ignore battery quirks HID: asus: add xg mobile 2022 external hardware support HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

HID: bpf: prevent buffer overflow in hid_hw_request

2026-03-16T15:21:06Z

right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense. Fixes: 8bd0488b5ea5 ("HID: bpf: add HID-BPF hooks for hid_hw_raw_requests") Cc: stable@vger.kernel.org Acked-by: Jiri Kosina Signed-off-by: Benjamin Tissoires