Commit b80a75cf authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hid-for-linus-2025073101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 

Pull HID updates from Jiri Kosina:

 - hardening of HID core parser against conversion to 0 bits in s32ton()
   by buggy/malicious devices (Alan Stern)

 - fix for potential NULL pointer dereference in hid-apple that could be
   caused by malicious device with APPLE_MAGIC_BACKLIGHT quirk present
   triggering overflow in data field (Qasim Ijaz)

 - support for Wake-on-touch in intel-thc (Even Xu)

 - support for "Input max input size control" and "Input interrupt
   delay" I2C features in order to improve compatibility of THC devices
   with legacy HIDI2C touch devices (Even Xu)

 - support for Touch Bars on x86 MacBook Pros (Kerem Karabay)

 - support for XP-PEN Artist 22R Pro (Joshua Goins)

 - third party trackpart support for MacBookPro15,1 (Aditya Garg)

 - Apple Magic Keyboard A311[89] USB-C support (Aditya Garg, Grigorii
   Sokoli)

 - support for operating modes in amd-sfh (Basavaraj Natikar)

 - avoid setting up battery timer for Apple and Magicmouse devices
   without battery (Aditya Garg)

 - fix for behavior of the hid-mcp2221 driver for !CONFIG_IIO cases
   (Heiko Schocher)

 - other assorted fixups and device ID additions

* tag 'hid-for-linus-2025073101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (54 commits)
  HID: core: Harden s32ton() against conversion to 0 bits
  HID: apple: validate feature-report field count to prevent NULL pointer dereference
  HID: core: Improve the kerneldoc for hid_report_len()
  selftests/hid: sync python tests to hid-tools 0.10
  selftests/hid: sync the python tests to hid-tools 0.8
  selftests/hid: run ruff format on the python part
  HID: magicmouse: use secs_to_jiffies() for battery timeout
  HID: apple: use secs_to_jiffies() for battery timeout
  HID: magicmouse: avoid setting up battery timer when not needed
  HID: apple: avoid setting up battery timer for devices without battery
  HID: amd_sfh: Enable operating mode
  HID: uclogic: Add support for XP-PEN Artist 22R Pro
  HID: rate-limit hid_warn to prevent log flooding
  HID: replace scnprintf() with sysfs_emit()
  HID: uclogic: make read-only array reconnect_event static const
  HID: mcp-2221: Replace manual comparison with min() macro
  HID: intel-thc-hid: Separate max input size control conditional list
  HID: mcp2221: set gpio pin mode
  HID: multitouch: add device ID for Apple Touch Bar
  HID: multitouch: specify that Apple Touch Bar is direct
  ...
parents db68e4c8 c62f87e2

Documentation/hid/intel-thc-hid.rst

+28 −0
Original line number Diff line number Diff line
@@ -188,6 +188,34 @@ Control register. 
Reset line is controlled by BIOS (or EFI) through ACPI _RST method, driver needs to call this

device ACPI _RST method to reset touch IC during initialization.



2.3 Max input size control

--------------------------



This is a new feature introduced in Panther Lake platform, THC hardware allows driver to set

a max input size for RxDMA. After this max size gets set and enabled, for every input report

packet reading, THC hardware sequencer will first read incoming input packet size, then compare

input packet size with the given max size:



- if input packet size <= max size, THC continues using input packet size to finish the reading

- if input packet size > max size, there is potential input data crash risk during

  transferring, THC will use max size instead of input packet size for reading



This feature is used to avoid data corruption which will cause RxDMA buffer overrun issue for

I2C bus, and enhance whole system stability.



2.4 Interrupt delay

-------------------



Because of MCU performance limitation, some touch devices cannot de-assert interrupt pin

immediately after input data is transferred, which cause an interrupt toggle delay. But THC

always detects next interrupt immediately after last input interrupt is handled. In this

case, the delayed interrupt de-assertion will be recognized as a new interrupt signal by THC,

and causes THC to start an input report reading spuriously.



In order to avoid this situation, THC introduced interrupt delay new feature in Panther Lake

platform, where THC allows driver to set an interrupt delay. After this feature is enabled,

THC will delay this given time for next interrupt detection.



3. High level concept

=====================

drivers/hid/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -771,6 +771,7 @@ config HID_MULTITOUCH 
	  Say Y here if you have one of the following devices:

	  - 3M PCT touch screens

	  - ActionStar dual touch panels

	  - Apple Touch Bar on x86 MacBook Pros

	  - Atmel panels

	  - Cando dual touch panels

	  - Chunghwa panels

drivers/hid/amd-sfh-hid/amd_sfh_client.c

+23 −0
Original line number Diff line number Diff line
@@ -146,6 +146,8 @@ static const char *get_sensor_name(int idx) 
		return "gyroscope";

	case mag_idx:

		return "magnetometer";

	case op_idx:

		return "operating-mode";

	case als_idx:

	case ACS_IDX: /* ambient color sensor */

		return "ALS";
@@ -243,6 +245,20 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata) 
			rc = -ENOMEM;

			goto cleanup;

		}



		if (cl_data->sensor_idx[i] == op_idx) {

			info.period = AMD_SFH_IDLE_LOOP;

			info.sensor_idx = cl_data->sensor_idx[i];

			info.dma_address = cl_data->sensor_dma_addr[i];

			mp2_ops->start(privdata, info);

			cl_data->sensor_sts[i] = amd_sfh_wait_for_response(privdata,

									   cl_data->sensor_idx[i],

									   SENSOR_ENABLED);

			if (cl_data->sensor_sts[i] == SENSOR_ENABLED)

				cl_data->is_any_sensor_enabled = true;

			continue;

		}



		cl_data->sensor_sts[i] = SENSOR_DISABLED;

		cl_data->sensor_requested_cnt[i] = 0;

		cl_data->cur_hid_dev = i;
@@ -303,6 +319,13 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata) 


	for (i = 0; i < cl_data->num_hid_devices; i++) {

		cl_data->cur_hid_dev = i;

		if (cl_data->sensor_idx[i] == op_idx) {

			dev_dbg(dev, "sid 0x%x (%s) status 0x%x\n",

				cl_data->sensor_idx[i], get_sensor_name(cl_data->sensor_idx[i]),

				cl_data->sensor_sts[i]);

			continue;

		}



		if (cl_data->sensor_sts[i] == SENSOR_ENABLED) {

			rc = amdtp_hid_probe(i, cl_data);

			if (rc)

drivers/hid/amd-sfh-hid/amd_sfh_hid.h

+1 −1
Original line number Diff line number Diff line
@@ -11,7 +11,7 @@ 
#ifndef AMDSFH_HID_H

#define AMDSFH_HID_H



#define MAX_HID_DEVICES		6

#define MAX_HID_DEVICES		7

#define AMD_SFH_HID_VENDOR	0x1022

#define AMD_SFH_HID_PRODUCT	0x0001

drivers/hid/amd-sfh-hid/amd_sfh_pcie.c

+4 −0
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ 
#define ACEL_EN		BIT(0)

#define GYRO_EN		BIT(1)

#define MAGNO_EN	BIT(2)

#define OP_EN		BIT(15)

#define HPD_EN		BIT(16)

#define ALS_EN		BIT(19)

#define ACS_EN		BIT(22)
@@ -232,6 +233,9 @@ int amd_mp2_get_sensor_num(struct amd_mp2_dev *privdata, u8 *sensor_id) 
	if (MAGNO_EN & activestatus)

		sensor_id[num_of_sensors++] = mag_idx;



	if (OP_EN & activestatus)

		sensor_id[num_of_sensors++] = op_idx;



	if (ALS_EN & activestatus)

		sensor_id[num_of_sensors++] = als_idx;