From 4352b8aee98005853aa63f57d6377282de17a33f Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Sun, 23 Aug 2026 13:28:57 -0700 Subject: Merge tag 'i3c/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull I3C updates from Alexandre Belloni: "A new driver this cycle, for the AMD AXI I3C controller. There are also new features such as IBI wakeup support, SETAASA device discovery and ACPI support for the the DAA methods, meaning we can now communicate with the SPD devices on DDR5 modules. New driver: - AMD AXI I3C master controller Subsystem: - I3C Common Command Code (CCC) handling improvements, especially around GET CCCs - SETAASA device discovery support - ACPI support for all existing DAA methods like SETDASA, SETNEWDA as well as I2C devices on I3C bus - IBI-based wakeup support Drivers: - dw: SETAASA support - mipi-i3c-hci: advertise IBI wakeup capability, AMD_PT I3C controller support, PIO queue management support for HCI v1.2 - renesas: improve suspend to RAM support, add runtime PM support" * tag 'i3c/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (70 commits) i3c: dw: reduce do_daa time if there's no client i3c: mipi-i3c-hci: Add support for AMD_PT I3C controller i3c: mipi-i3c-hci: Add PIO queue management support for HCI v1.2 i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode i3c: dw: rename "pclk" to "apb" to match dt-binding i3c: dw: make struct dw_i3c_cmd smaller i3c: dw: use COMMAND_PORT_TRANSFER_ARG instead of hardcoding i3c: renesas: Don't register devices when ENTDAA times out i3c: master: dw-i3c-master: fix OD timing for first broadcast i3c: mipi-i3c-hci: Advertise IBI wakeup capability i3c: mipi-i3c-hci: Factor out i3c_hci_sysdev() i3c: mipi-i3c-hci-pci: Propagate I3C wakeup requirements to PCI i3c: master: Reject IBI requests from non-IBI-capable devices i3c: master: Add helper to query bus wakeup requirements i3c: master: Report wakeup events for IBIs i3c: master: Support IBI-based wakeup capability i3c: master: Fix potential UAF in i3c_device_match() i3c: master: Fix potential UAF in i3c_device_uevent() i3c: Make dev->desc locking assumptions explicit i3c: master: Fix use-after-free of master->this ... --- drivers/hid/hid-u2fzero.c | 408 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 408 insertions(+) create mode 100644 drivers/hid/hid-u2fzero.c (limited to 'drivers/hid/hid-u2fzero.c') diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c new file mode 100644 index 000000000..82404b6e2 --- /dev/null +++ b/drivers/hid/hid-u2fzero.c @@ -0,0 +1,408 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * U2F Zero LED and RNG driver + * + * Copyright 2018 Andrej Shadura + * Loosely based on drivers/hid/hid-led.c + * and drivers/usb/misc/chaoskey.c + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation, version 2. + */ + +#include +#include +#include +#include +#include +#include +#include + +#include "usbhid/usbhid.h" +#include "hid-ids.h" + +#define DRIVER_SHORT "u2fzero" + +#define HID_REPORT_SIZE 64 + +enum hw_revision { + HW_U2FZERO, + HW_NITROKEY_U2F, +}; + +struct hw_revision_config { + u8 rng_cmd; + u8 wink_cmd; + const char *name; +}; + +static const struct hw_revision_config hw_configs[] = { + [HW_U2FZERO] = { + .rng_cmd = 0x21, + .wink_cmd = 0x24, + .name = "U2F Zero", + }, + [HW_NITROKEY_U2F] = { + .rng_cmd = 0xc0, + .wink_cmd = 0xc2, + .name = "NitroKey U2F", + }, +}; + +/* We only use broadcast (CID-less) messages */ +#define CID_BROADCAST 0xffffffff + +struct u2f_hid_msg { + u32 cid; + union { + struct { + u8 cmd; + u8 bcnth; + u8 bcntl; + u8 data[HID_REPORT_SIZE - 7]; + } init; + struct { + u8 seq; + u8 data[HID_REPORT_SIZE - 5]; + } cont; + }; +} __packed; + +struct u2f_hid_report { + u8 report_type; + struct u2f_hid_msg msg; +} __packed; + +#define U2F_HID_MSG_LEN(f) (size_t)(((f).init.bcnth << 8) + (f).init.bcntl) + +struct u2fzero_device { + struct hid_device *hdev; + struct urb *urb; /* URB for the RNG data */ + struct led_classdev ldev; /* Embedded struct for led */ + struct hwrng hwrng; /* Embedded struct for hwrng */ + char *led_name; + char *rng_name; + u8 *buf_out; + u8 *buf_in; + struct mutex lock; + bool present; + kernel_ulong_t hw_revision; +}; + +static int u2fzero_send(struct u2fzero_device *dev, struct u2f_hid_report *req) +{ + int ret; + + mutex_lock(&dev->lock); + + memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report)); + + ret = hid_hw_output_report(dev->hdev, dev->buf_out, + sizeof(struct u2f_hid_msg)); + + mutex_unlock(&dev->lock); + + if (ret < 0) + return ret; + + return ret == sizeof(struct u2f_hid_msg) ? 0 : -EMSGSIZE; +} + +struct u2fzero_transfer_context { + struct completion done; + int status; +}; + +static void u2fzero_read_callback(struct urb *urb) +{ + struct u2fzero_transfer_context *ctx = urb->context; + + ctx->status = urb->status; + complete(&ctx->done); +} + +static int u2fzero_recv(struct u2fzero_device *dev, + struct u2f_hid_report *req, + struct u2f_hid_msg *resp) +{ + int ret; + struct hid_device *hdev = dev->hdev; + struct u2fzero_transfer_context ctx; + + mutex_lock(&dev->lock); + + memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report)); + + dev->urb->context = &ctx; + init_completion(&ctx.done); + + ret = usb_submit_urb(dev->urb, GFP_NOIO); + if (unlikely(ret)) { + hid_err(hdev, "usb_submit_urb failed: %d", ret); + goto err; + } + + ret = hid_hw_output_report(dev->hdev, dev->buf_out, + sizeof(struct u2f_hid_msg)); + + if (ret < 0) { + hid_err(hdev, "hid_hw_output_report failed: %d", ret); + goto err; + } + + ret = (wait_for_completion_timeout( + &ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT))); + if (ret == 0) { + usb_kill_urb(dev->urb); + hid_err(hdev, "urb submission timed out"); + } else { + ret = dev->urb->actual_length; + memcpy(resp, dev->buf_in, ret); + } + +err: + mutex_unlock(&dev->lock); + + return ret; +} + +static int u2fzero_blink(struct led_classdev *ldev) +{ + struct u2fzero_device *dev = container_of(ldev, + struct u2fzero_device, ldev); + struct u2f_hid_report req = { + .report_type = 0, + .msg.cid = CID_BROADCAST, + .msg.init = { + .cmd = hw_configs[dev->hw_revision].wink_cmd, + .bcnth = 0, + .bcntl = 0, + .data = {0}, + } + }; + return u2fzero_send(dev, &req); +} + +static int u2fzero_brightness_set(struct led_classdev *ldev, + enum led_brightness brightness) +{ + ldev->brightness = LED_OFF; + if (brightness) + return u2fzero_blink(ldev); + else + return 0; +} + +static int u2fzero_rng_read(struct hwrng *rng, void *data, + size_t max, bool wait) +{ + struct u2fzero_device *dev = container_of(rng, + struct u2fzero_device, hwrng); + struct u2f_hid_report req = { + .report_type = 0, + .msg.cid = CID_BROADCAST, + .msg.init = { + .cmd = hw_configs[dev->hw_revision].rng_cmd, + .bcnth = 0, + .bcntl = 0, + .data = {0}, + } + }; + struct u2f_hid_msg resp; + int ret; + size_t actual_length; + /* valid packets must have a correct header */ + int min_length = offsetof(struct u2f_hid_msg, init.data); + + if (!dev->present) { + hid_dbg(dev->hdev, "device not present"); + return 0; + } + + ret = u2fzero_recv(dev, &req, &resp); + + /* ignore errors or packets without data */ + if (ret < min_length) + return 0; + + /* only take the minimum amount of data it is safe to take */ + actual_length = min3((size_t)ret - min_length, + U2F_HID_MSG_LEN(resp), max); + + memcpy(data, resp.init.data, actual_length); + + return actual_length; +} + +static int u2fzero_init_led(struct u2fzero_device *dev, + unsigned int minor) +{ + dev->led_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL, + "%s%u", DRIVER_SHORT, minor); + if (dev->led_name == NULL) + return -ENOMEM; + + dev->ldev.name = dev->led_name; + dev->ldev.max_brightness = LED_ON; + dev->ldev.flags = LED_HW_PLUGGABLE; + dev->ldev.brightness_set_blocking = u2fzero_brightness_set; + + return devm_led_classdev_register(&dev->hdev->dev, &dev->ldev); +} + +static int u2fzero_init_hwrng(struct u2fzero_device *dev, + unsigned int minor) +{ + dev->rng_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL, + "%s-rng%u", DRIVER_SHORT, minor); + if (dev->rng_name == NULL) + return -ENOMEM; + + dev->hwrng.name = dev->rng_name; + dev->hwrng.read = u2fzero_rng_read; + + return devm_hwrng_register(&dev->hdev->dev, &dev->hwrng); +} + +static int u2fzero_fill_in_urb(struct u2fzero_device *dev) +{ + struct hid_device *hdev = dev->hdev; + struct usb_device *udev; + struct usbhid_device *usbhid = hdev->driver_data; + unsigned int pipe_in; + struct usb_host_endpoint *ep; + + if (dev->hdev->bus != BUS_USB) + return -EINVAL; + + udev = hid_to_usb_dev(hdev); + + if (!usbhid->urbout || !usbhid->urbin) + return -ENODEV; + + ep = usb_pipe_endpoint(udev, usbhid->urbin->pipe); + if (!ep) + return -ENODEV; + + dev->urb = usb_alloc_urb(0, GFP_KERNEL); + if (!dev->urb) + return -ENOMEM; + + pipe_in = (usbhid->urbin->pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30); + + usb_fill_int_urb(dev->urb, + udev, + pipe_in, + dev->buf_in, + HID_REPORT_SIZE, + u2fzero_read_callback, + NULL, + ep->desc.bInterval); + + return 0; +} + +static int u2fzero_probe(struct hid_device *hdev, + const struct hid_device_id *id) +{ + struct u2fzero_device *dev; + unsigned int minor; + int ret; + + if (!hid_is_usb(hdev)) + return -EINVAL; + + dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL); + if (dev == NULL) + return -ENOMEM; + + dev->hw_revision = id->driver_data; + + dev->buf_out = devm_kmalloc(&hdev->dev, + sizeof(struct u2f_hid_report), GFP_KERNEL); + if (dev->buf_out == NULL) + return -ENOMEM; + + dev->buf_in = devm_kmalloc(&hdev->dev, + sizeof(struct u2f_hid_msg), GFP_KERNEL); + if (dev->buf_in == NULL) + return -ENOMEM; + + ret = hid_parse(hdev); + if (ret) + return ret; + + dev->hdev = hdev; + hid_set_drvdata(hdev, dev); + mutex_init(&dev->lock); + + ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW); + if (ret) + return ret; + + ret = u2fzero_fill_in_urb(dev); + if (ret) + goto err_hid_hw_stop; + + dev->present = true; + + minor = ((struct hidraw *) hdev->hidraw)->minor; + + ret = u2fzero_init_led(dev, minor); + if (ret) + goto err_free_urb; + + hid_info(hdev, "%s LED initialised\n", hw_configs[dev->hw_revision].name); + + ret = u2fzero_init_hwrng(dev, minor); + if (ret) + goto err_free_urb; + + hid_info(hdev, "%s RNG initialised\n", hw_configs[dev->hw_revision].name); + + return 0; + +err_free_urb: + usb_free_urb(dev->urb); +err_hid_hw_stop: + hid_hw_stop(hdev); + return ret; +} + +static void u2fzero_remove(struct hid_device *hdev) +{ + struct u2fzero_device *dev = hid_get_drvdata(hdev); + + mutex_lock(&dev->lock); + dev->present = false; + mutex_unlock(&dev->lock); + + hid_hw_stop(hdev); + usb_poison_urb(dev->urb); + usb_free_urb(dev->urb); +} + +static const struct hid_device_id u2fzero_table[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, + USB_DEVICE_ID_U2F_ZERO), + .driver_data = HW_U2FZERO }, + { HID_USB_DEVICE(USB_VENDOR_ID_CLAY_LOGIC, + USB_DEVICE_ID_NITROKEY_U2F), + .driver_data = HW_NITROKEY_U2F }, + { } +}; +MODULE_DEVICE_TABLE(hid, u2fzero_table); + +static struct hid_driver u2fzero_driver = { + .name = "hid-" DRIVER_SHORT, + .probe = u2fzero_probe, + .remove = u2fzero_remove, + .id_table = u2fzero_table, +}; + +module_hid_driver(u2fzero_driver); + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Andrej Shadura "); +MODULE_DESCRIPTION("U2F Zero LED and RNG driver"); -- cgit v1.3.1