kernel/linux.git/include/linux/hid.h, branch v7.3-rc1

Merge branch 'for-7.3/core' into for-linus

2026-08-19T07:27:26+00:00

- fix long-standing force-feedback initialization race across the subsystem (Dmitry Torokhov) - switch to system_dfl_wq (Marco Crivellari)

HID: move generic FF initialization into hidinput_connect()

2026-08-14T12:46:21+00:00

Generic force-feedback initialization (pidff) currently happens in hid_connect() after hidinput_connect() has already registered the input devices. This is racy as the device is live and visible to userspace before FF support is fully set up. Move the call to hdev->ff_init() into hidinput_connect(), ensuring it runs before input_register_device() is called. This closes the race window for standard PID-capable devices. The initialization now also checks (connect_mask & HID_CONNECT_FF) and !hid_has_ff_input() to avoid conflicts with custom FF implementations and respect driver opt-outs. Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina

HID: input: read battery capacity from its actual report offset

2026-08-03T18:38:09+00:00

hidinput_query_battery_capacity() assumes the state-of-charge value is the first byte following the report ID (buf[1]) and ignores where the battery field actually sits within the report. An Apple Magic Trackpad 2 precedes the AbsoluteStateOfCharge byte with a byte of status flags in its battery reports, so this query returns the flags byte instead of the charge level. The device happens to make that easy to observe, because it exposes the same cell twice: its report descriptor declares AbsoluteStateOfCharge in two reports (0x90 and 0x9b), so hidinput_setup_battery() registers two power supplies. Only the first one is refreshed by hid-magicmouse -- it uses hid_get_battery(), which returns the first battery of the list -- and that refresh goes through the report event path, which parses the field correctly. Nothing ever reports the second one, so every read of its capacity takes the query path above. On a USB-C Magic Trackpad over USB, on an unpatched 7.1.5: hid--battery-144 = 100% (Charging) <- report event path hid--battery-155 = 3% (Discharging) <- query path Both are the same physical battery. A raw HIDIOCGINPUT of the two reports at that same moment: report 0x90 -> [90 03 64] report 0x9b -> [9b 03 64 64 00 00 10 00 00 00 00 00 00 00] ^flags ^SoC = 0x64 = 100% The device answers correctly in both cases; only the offset the kernel reads the capacity from is wrong. 0x03 is the flags byte (present, charging), reported as "3%". Bluetooth takes the same query path for its capacity, where the trackpad reported a bogus near-constant ~4% -- 0b100, the FullyCharged flag -- regardless of the real charge. Store the battery field's offset within the report at setup time and use it when querying, so the capacity is read from its real position. The report event path already parses the field correctly through the HID core; only the explicit GET_REPORT query was wrong. Devices whose capacity field is the first field in the report have a report_offset of 0 and are unaffected (buf[1 + 0] == buf[1]). Fixes: 581c4484769e ("HID: input: map digitizer battery usage") Cc: stable@vger.kernel.org Signed-off-by: Jose Villaseñor Montfort Reviewed-by: Alec Hall Signed-off-by: Jiri Kosina

Replace by more specific (headers)

2026-07-03T05:38:16+00:00

is included in a many files: $ git grep '' ef0c9f75a195 | wc -l 1598 ; some of them are widely used headers. To stop mixing up different and unrelated driver( type)s let the subsystem headers only use the subset of the recently split that are relevant for them. The fallout (I hope) is addressed in the previous commits that handle sources relying on e.g. pulling in the full legacy header and thus providing pci_device_id. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Link: https://patch.msgid.link/199fe46b624ba07fb9bd3e0cd6ff13757932cb5f.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub)

HID: remove duplicate hid_warn_ratelimited definition

2026-05-21T14:14:33+00:00

The hid_warn_ratelimited macro is defined twice in include/linux/hid.h: - first one added by commit 4051ead99888 ("HID: rate-limit hid_warn to prevent log flooding") - second one added by commit 1d64624243af ("HID: core: Add printk_ratelimited variants to hid_warn() etc")). The second definition is correctly grouped with other ratelimited macros. Remove the duplicate definition. Fixes: 1d64624243af ("HID: core: Add printk_ratelimited variants to hid_warn() etc") Signed-off-by: Liu Kai [bentiss: edited commit message] Signed-off-by: Benjamin Tissoires

HID: core: introduce hid_safe_input_report()

2026-05-12T16:03:58+00:00

hid_input_report() is used in too many places to have a commit that doesn't cross subsystem borders. Instead of changing the API, introduce a new one when things matters in the transport layers: - usbhid - i2chid This effectively revert to the old behavior for those two transport layers. Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: pass the buffer size to hid_report_raw_event

2026-05-12T16:03:37+00:00

commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") enforced the provided data to be at least the size of the declared buffer in the report descriptor to prevent a buffer overflow. However, we can try to be smarter by providing both the buffer size and the data size, meaning that hid_report_raw_event() can make better decision whether we should plaining reject the buffer (buffer overflow attempt) or if we can safely memset it to 0 and pass it to the rest of the stack. Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Acked-by: Johan Hovold Reviewed-by: Greg Kroah-Hartman Signed-off-by: Jiri Kosina

Merge branch 'for-7.1/lenovo-v2' into for-linus

2026-04-16T19:07:13+00:00

- new driver for Lenovo Legion Go / S devices (Derek J. Clark)

HID: input: Add support for multiple batteries per device

2026-03-19T14:52:45+00:00

Add support for HID devices that report multiple batteries, each identified by its report ID. The hid_device->battery pointer is replaced with a batteries list. Batteries are named using the pattern hid-{uniq}-battery-{report_id}. The hid_get_battery() helper returns the first battery in the list for backwards compatibility with single-battery drivers. Signed-off-by: Lucas Zampieri Signed-off-by: Benjamin Tissoires

HID: input: Introduce struct hid_battery and refactor battery code

2026-03-19T14:52:45+00:00

Introduce struct hid_battery to encapsulate individual battery state, preparing for future multi-battery support. The new structure contains all battery-related fields previously stored directly in hid_device (capacity, min, max, report_type, report_id, charge_status, etc.). The hid_device->battery pointer type changes from struct power_supply* to struct hid_battery*, and all battery functions are refactored accordingly. A hid_get_battery() helper is added for external drivers, with hid-apple.c and hid-magicmouse.c updated to use the new API. The hid-input-test.c KUnit tests are also updated for the new structure. No functional changes for single-battery devices. Signed-off-by: Lucas Zampieri Signed-off-by: Benjamin Tissoires