Merge tag 'hid-for-linus-2025073101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID updates from Jiri Kosina:

 - hardening of HID core parser against conversion to 0 bits in s32ton()
   by buggy/malicious devices (Alan Stern)

 - fix for potential NULL pointer dereference in hid-apple that could be
   caused by malicious device with APPLE_MAGIC_BACKLIGHT quirk present
   triggering overflow in data field (Qasim Ijaz)

 - support for Wake-on-touch in intel-thc (Even Xu)

 - support for "Input max input size control" and "Input interrupt
   delay" I2C features in order to improve compatibility of THC devices
   with legacy HIDI2C touch devices (Even Xu)

 - support for Touch Bars on x86 MacBook Pros (Kerem Karabay)

 - support for XP-PEN Artist 22R Pro (Joshua Goins)

 - third party trackpart support for MacBookPro15,1 (Aditya Garg)

 - Apple Magic Keyboard A311[89] USB-C support (Aditya Garg, Grigorii
   Sokoli)

 - support for operating modes in amd-sfh (Basavaraj Natikar)

 - avoid setting up battery timer for Apple and Magicmouse devices
   without battery (Aditya Garg)

 - fix for behavior of the hid-mcp2221 driver for !CONFIG_IIO cases
   (Heiko Schocher)

 - other assorted fixups and device ID additions

* tag 'hid-for-linus-2025073101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (54 commits)
  HID: core: Harden s32ton() against conversion to 0 bits
  HID: apple: validate feature-report field count to prevent NULL pointer dereference
  HID: core: Improve the kerneldoc for hid_report_len()
  selftests/hid: sync python tests to hid-tools 0.10
  selftests/hid: sync the python tests to hid-tools 0.8
  selftests/hid: run ruff format on the python part
  HID: magicmouse: use secs_to_jiffies() for battery timeout
  HID: apple: use secs_to_jiffies() for battery timeout
  HID: magicmouse: avoid setting up battery timer when not needed
  HID: apple: avoid setting up battery timer for devices without battery
  HID: amd_sfh: Enable operating mode
  HID: uclogic: Add support for XP-PEN Artist 22R Pro
  HID: rate-limit hid_warn to prevent log flooding
  HID: replace scnprintf() with sysfs_emit()
  HID: uclogic: make read-only array reconnect_event static const
  HID: mcp-2221: Replace manual comparison with min() macro
  HID: intel-thc-hid: Separate max input size control conditional list
  HID: mcp2221: set gpio pin mode
  HID: multitouch: add device ID for Apple Touch Bar
  HID: multitouch: specify that Apple Touch Bar is direct
  ...

Author: torvalds

Documentation/hid/intel-thc-hid.rst

@@ -188,6 +188,34 @@ Control register.
 Reset line is controlled by BIOS (or EFI) through ACPI _RST method, driver needs to call this
 device ACPI _RST method to reset touch IC during initialization.
 
+2.3 Max input size control
+--------------------------
+
+This is a new feature introduced in Panther Lake platform, THC hardware allows driver to set
+a max input size for RxDMA. After this max size gets set and enabled, for every input report
+packet reading, THC hardware sequencer will first read incoming input packet size, then compare
+input packet size with the given max size:
+
+- if input packet size <= max size, THC continues using input packet size to finish the reading
+- if input packet size > max size, there is potential input data crash risk during
+  transferring, THC will use max size instead of input packet size for reading
+
+This feature is used to avoid data corruption which will cause RxDMA buffer overrun issue for
+I2C bus, and enhance whole system stability.
+
+2.4 Interrupt delay
+-------------------
+
+Because of MCU performance limitation, some touch devices cannot de-assert interrupt pin
+immediately after input data is transferred, which cause an interrupt toggle delay. But THC
+always detects next interrupt immediately after last input interrupt is handled. In this
+case, the delayed interrupt de-assertion will be recognized as a new interrupt signal by THC,
+and causes THC to start an input report reading spuriously.
+
+In order to avoid this situation, THC introduced interrupt delay new feature in Panther Lake
+platform, where THC allows driver to set an interrupt delay. After this feature is enabled,
+THC will delay this given time for next interrupt detection.
+
 3. High level concept
 =====================
 

drivers/hid/Kconfig

@@ -771,6 +771,7 @@ config HID_MULTITOUCH
 	  Say Y here if you have one of the following devices:
 	  - 3M PCT touch screens
 	  - ActionStar dual touch panels
+	  - Apple Touch Bar on x86 MacBook Pros
 	  - Atmel panels
 	  - Cando dual touch panels
 	  - Chunghwa panels

drivers/hid/amd-sfh-hid/amd_sfh_client.c

@@ -146,6 +146,8 @@ static const char *get_sensor_name(int idx)
 		return "gyroscope";
 	case mag_idx:
 		return "magnetometer";
+	case op_idx:
+		return "operating-mode";
 	case als_idx:
 	case ACS_IDX: /* ambient color sensor */
 		return "ALS";
@@ -243,6 +245,20 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata)
 			rc = -ENOMEM;
 			goto cleanup;
 		}
+
+		if (cl_data->sensor_idx[i] == op_idx) {
+			info.period = AMD_SFH_IDLE_LOOP;
+			info.sensor_idx = cl_data->sensor_idx[i];
+			info.dma_address = cl_data->sensor_dma_addr[i];
+			mp2_ops->start(privdata, info);
+			cl_data->sensor_sts[i] = amd_sfh_wait_for_response(privdata,
+									   cl_data->sensor_idx[i],
+									   SENSOR_ENABLED);
+			if (cl_data->sensor_sts[i] == SENSOR_ENABLED)
+				cl_data->is_any_sensor_enabled = true;
+			continue;
+		}
+
 		cl_data->sensor_sts[i] = SENSOR_DISABLED;
 		cl_data->sensor_requested_cnt[i] = 0;
 		cl_data->cur_hid_dev = i;
@@ -303,6 +319,13 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata)
 
 	for (i = 0; i < cl_data->num_hid_devices; i++) {
 		cl_data->cur_hid_dev = i;
+		if (cl_data->sensor_idx[i] == op_idx) {
+			dev_dbg(dev, "sid 0x%x (%s) status 0x%x\n",
+				cl_data->sensor_idx[i], get_sensor_name(cl_data->sensor_idx[i]),
+				cl_data->sensor_sts[i]);
+			continue;
+		}
+
 		if (cl_data->sensor_sts[i] == SENSOR_ENABLED) {
 			rc = amdtp_hid_probe(i, cl_data);
 			if (rc)

drivers/hid/amd-sfh-hid/amd_sfh_hid.h

@@ -11,7 +11,7 @@
 #ifndef AMDSFH_HID_H
 #define AMDSFH_HID_H
 
-#define MAX_HID_DEVICES		6
+#define MAX_HID_DEVICES		7
 #define AMD_SFH_HID_VENDOR	0x1022
 #define AMD_SFH_HID_PRODUCT	0x0001
 

drivers/hid/amd-sfh-hid/amd_sfh_pcie.c

@@ -29,6 +29,7 @@
 #define ACEL_EN		BIT(0)
 #define GYRO_EN		BIT(1)
 #define MAGNO_EN	BIT(2)
+#define OP_EN		BIT(15)
 #define HPD_EN		BIT(16)
 #define ALS_EN		BIT(19)
 #define ACS_EN		BIT(22)
@@ -232,6 +233,9 @@ int amd_mp2_get_sensor_num(struct amd_mp2_dev *privdata, u8 *sensor_id)
 	if (MAGNO_EN & activestatus)
 		sensor_id[num_of_sensors++] = mag_idx;
 
+	if (OP_EN & activestatus)
+		sensor_id[num_of_sensors++] = op_idx;
+
 	if (ALS_EN & activestatus)
 		sensor_id[num_of_sensors++] = als_idx;
 

drivers/hid/amd-sfh-hid/amd_sfh_pcie.h

@@ -79,6 +79,7 @@ enum sensor_idx {
 	accel_idx = 0,
 	gyro_idx = 1,
 	mag_idx = 2,
+	op_idx = 15,
 	als_idx = 19
 };