1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * U2F Zero LED and RNG driver
4 *
5 * Copyright 2018 Andrej Shadura <andrew@shadura.me>
6 * Loosely based on drivers/hid/hid-led.c
7 * and drivers/usb/misc/chaoskey.c
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2.
12 */
13
14 #include <linux/hid.h>
15 #include <linux/hidraw.h>
16 #include <linux/hw_random.h>
17 #include <linux/leds.h>
18 #include <linux/module.h>
19 #include <linux/mutex.h>
20 #include <linux/usb.h>
21
22 #include "usbhid/usbhid.h"
23 #include "hid-ids.h"
24
25 #define DRIVER_SHORT "u2fzero"
26
27 #define HID_REPORT_SIZE 64
28
29 /* We only use broadcast (CID-less) messages */
30 #define CID_BROADCAST 0xffffffff
31
32 struct u2f_hid_msg {
33 u32 cid;
34 union {
35 struct {
36 u8 cmd;
37 u8 bcnth;
38 u8 bcntl;
39 u8 data[HID_REPORT_SIZE - 7];
40 } init;
41 struct {
42 u8 seq;
43 u8 data[HID_REPORT_SIZE - 5];
44 } cont;
45 };
46 } __packed;
47
48 struct u2f_hid_report {
49 u8 report_type;
50 struct u2f_hid_msg msg;
51 } __packed;
52
53 #define U2F_HID_MSG_LEN(f) (size_t)(((f).init.bcnth << 8) + (f).init.bcntl)
54
55 /* Custom extensions to the U2FHID protocol */
56 #define U2F_CUSTOM_GET_RNG 0x21
57 #define U2F_CUSTOM_WINK 0x24
58
59 struct u2fzero_device {
60 struct hid_device *hdev;
61 struct urb *urb; /* URB for the RNG data */
62 struct led_classdev ldev; /* Embedded struct for led */
63 struct hwrng hwrng; /* Embedded struct for hwrng */
64 char *led_name;
65 char *rng_name;
66 u8 *buf_out;
67 u8 *buf_in;
68 struct mutex lock;
69 bool present;
70 };
71
u2fzero_send(struct u2fzero_device * dev,struct u2f_hid_report * req)72 static int u2fzero_send(struct u2fzero_device *dev, struct u2f_hid_report *req)
73 {
74 int ret;
75
76 mutex_lock(&dev->lock);
77
78 memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
79
80 ret = hid_hw_output_report(dev->hdev, dev->buf_out,
81 sizeof(struct u2f_hid_msg));
82
83 mutex_unlock(&dev->lock);
84
85 if (ret < 0)
86 return ret;
87
88 return ret == sizeof(struct u2f_hid_msg) ? 0 : -EMSGSIZE;
89 }
90
91 struct u2fzero_transfer_context {
92 struct completion done;
93 int status;
94 };
95
u2fzero_read_callback(struct urb * urb)96 static void u2fzero_read_callback(struct urb *urb)
97 {
98 struct u2fzero_transfer_context *ctx = urb->context;
99
100 ctx->status = urb->status;
101 complete(&ctx->done);
102 }
103
u2fzero_recv(struct u2fzero_device * dev,struct u2f_hid_report * req,struct u2f_hid_msg * resp)104 static int u2fzero_recv(struct u2fzero_device *dev,
105 struct u2f_hid_report *req,
106 struct u2f_hid_msg *resp)
107 {
108 int ret;
109 struct hid_device *hdev = dev->hdev;
110 struct u2fzero_transfer_context ctx;
111
112 mutex_lock(&dev->lock);
113
114 memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
115
116 dev->urb->context = &ctx;
117 init_completion(&ctx.done);
118
119 ret = usb_submit_urb(dev->urb, GFP_NOIO);
120 if (unlikely(ret)) {
121 hid_err(hdev, "usb_submit_urb failed: %d", ret);
122 goto err;
123 }
124
125 ret = hid_hw_output_report(dev->hdev, dev->buf_out,
126 sizeof(struct u2f_hid_msg));
127
128 if (ret < 0) {
129 hid_err(hdev, "hid_hw_output_report failed: %d", ret);
130 goto err;
131 }
132
133 ret = (wait_for_completion_timeout(
134 &ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT)));
135 if (ret == 0) {
136 usb_kill_urb(dev->urb);
137 hid_err(hdev, "urb submission timed out");
138 } else {
139 ret = dev->urb->actual_length;
140 memcpy(resp, dev->buf_in, ret);
141 }
142
143 err:
144 mutex_unlock(&dev->lock);
145
146 return ret;
147 }
148
u2fzero_blink(struct led_classdev * ldev)149 static int u2fzero_blink(struct led_classdev *ldev)
150 {
151 struct u2fzero_device *dev = container_of(ldev,
152 struct u2fzero_device, ldev);
153 struct u2f_hid_report req = {
154 .report_type = 0,
155 .msg.cid = CID_BROADCAST,
156 .msg.init = {
157 .cmd = U2F_CUSTOM_WINK,
158 .bcnth = 0,
159 .bcntl = 0,
160 .data = {0},
161 }
162 };
163 return u2fzero_send(dev, &req);
164 }
165
u2fzero_brightness_set(struct led_classdev * ldev,enum led_brightness brightness)166 static int u2fzero_brightness_set(struct led_classdev *ldev,
167 enum led_brightness brightness)
168 {
169 ldev->brightness = LED_OFF;
170 if (brightness)
171 return u2fzero_blink(ldev);
172 else
173 return 0;
174 }
175
u2fzero_rng_read(struct hwrng * rng,void * data,size_t max,bool wait)176 static int u2fzero_rng_read(struct hwrng *rng, void *data,
177 size_t max, bool wait)
178 {
179 struct u2fzero_device *dev = container_of(rng,
180 struct u2fzero_device, hwrng);
181 struct u2f_hid_report req = {
182 .report_type = 0,
183 .msg.cid = CID_BROADCAST,
184 .msg.init = {
185 .cmd = U2F_CUSTOM_GET_RNG,
186 .bcnth = 0,
187 .bcntl = 0,
188 .data = {0},
189 }
190 };
191 struct u2f_hid_msg resp;
192 int ret;
193 size_t actual_length;
194 /* valid packets must have a correct header */
195 int min_length = offsetof(struct u2f_hid_msg, init.data);
196
197 if (!dev->present) {
198 hid_dbg(dev->hdev, "device not present");
199 return 0;
200 }
201
202 ret = u2fzero_recv(dev, &req, &resp);
203
204 /* ignore errors or packets without data */
205 if (ret < min_length)
206 return 0;
207
208 /* only take the minimum amount of data it is safe to take */
209 actual_length = min3((size_t)ret - min_length,
210 U2F_HID_MSG_LEN(resp), max);
211
212 memcpy(data, resp.init.data, actual_length);
213
214 return actual_length;
215 }
216
u2fzero_init_led(struct u2fzero_device * dev,unsigned int minor)217 static int u2fzero_init_led(struct u2fzero_device *dev,
218 unsigned int minor)
219 {
220 dev->led_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
221 "%s%u", DRIVER_SHORT, minor);
222 if (dev->led_name == NULL)
223 return -ENOMEM;
224
225 dev->ldev.name = dev->led_name;
226 dev->ldev.max_brightness = LED_ON;
227 dev->ldev.flags = LED_HW_PLUGGABLE;
228 dev->ldev.brightness_set_blocking = u2fzero_brightness_set;
229
230 return devm_led_classdev_register(&dev->hdev->dev, &dev->ldev);
231 }
232
u2fzero_init_hwrng(struct u2fzero_device * dev,unsigned int minor)233 static int u2fzero_init_hwrng(struct u2fzero_device *dev,
234 unsigned int minor)
235 {
236 dev->rng_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
237 "%s-rng%u", DRIVER_SHORT, minor);
238 if (dev->rng_name == NULL)
239 return -ENOMEM;
240
241 dev->hwrng.name = dev->rng_name;
242 dev->hwrng.read = u2fzero_rng_read;
243 dev->hwrng.quality = 1;
244
245 return devm_hwrng_register(&dev->hdev->dev, &dev->hwrng);
246 }
247
u2fzero_fill_in_urb(struct u2fzero_device * dev)248 static int u2fzero_fill_in_urb(struct u2fzero_device *dev)
249 {
250 struct hid_device *hdev = dev->hdev;
251 struct usb_device *udev;
252 struct usbhid_device *usbhid = hdev->driver_data;
253 unsigned int pipe_in;
254 struct usb_host_endpoint *ep;
255
256 if (dev->hdev->bus != BUS_USB)
257 return -EINVAL;
258
259 udev = hid_to_usb_dev(hdev);
260
261 if (!usbhid->urbout || !usbhid->urbin)
262 return -ENODEV;
263
264 ep = usb_pipe_endpoint(udev, usbhid->urbin->pipe);
265 if (!ep)
266 return -ENODEV;
267
268 dev->urb = usb_alloc_urb(0, GFP_KERNEL);
269 if (!dev->urb)
270 return -ENOMEM;
271
272 pipe_in = (usbhid->urbin->pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
273
274 usb_fill_int_urb(dev->urb,
275 udev,
276 pipe_in,
277 dev->buf_in,
278 HID_REPORT_SIZE,
279 u2fzero_read_callback,
280 NULL,
281 ep->desc.bInterval);
282
283 return 0;
284 }
285
u2fzero_probe(struct hid_device * hdev,const struct hid_device_id * id)286 static int u2fzero_probe(struct hid_device *hdev,
287 const struct hid_device_id *id)
288 {
289 struct u2fzero_device *dev;
290 unsigned int minor;
291 int ret;
292
293 if (!hid_is_usb(hdev))
294 return -EINVAL;
295
296 dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL);
297 if (dev == NULL)
298 return -ENOMEM;
299
300 dev->buf_out = devm_kmalloc(&hdev->dev,
301 sizeof(struct u2f_hid_report), GFP_KERNEL);
302 if (dev->buf_out == NULL)
303 return -ENOMEM;
304
305 dev->buf_in = devm_kmalloc(&hdev->dev,
306 sizeof(struct u2f_hid_msg), GFP_KERNEL);
307 if (dev->buf_in == NULL)
308 return -ENOMEM;
309
310 ret = hid_parse(hdev);
311 if (ret)
312 return ret;
313
314 dev->hdev = hdev;
315 hid_set_drvdata(hdev, dev);
316 mutex_init(&dev->lock);
317
318 ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
319 if (ret)
320 return ret;
321
322 u2fzero_fill_in_urb(dev);
323
324 dev->present = true;
325
326 minor = ((struct hidraw *) hdev->hidraw)->minor;
327
328 ret = u2fzero_init_led(dev, minor);
329 if (ret) {
330 hid_hw_stop(hdev);
331 return ret;
332 }
333
334 hid_info(hdev, "U2F Zero LED initialised\n");
335
336 ret = u2fzero_init_hwrng(dev, minor);
337 if (ret) {
338 hid_hw_stop(hdev);
339 return ret;
340 }
341
342 hid_info(hdev, "U2F Zero RNG initialised\n");
343
344 return 0;
345 }
346
u2fzero_remove(struct hid_device * hdev)347 static void u2fzero_remove(struct hid_device *hdev)
348 {
349 struct u2fzero_device *dev = hid_get_drvdata(hdev);
350
351 mutex_lock(&dev->lock);
352 dev->present = false;
353 mutex_unlock(&dev->lock);
354
355 hid_hw_stop(hdev);
356 usb_poison_urb(dev->urb);
357 usb_free_urb(dev->urb);
358 }
359
360 static const struct hid_device_id u2fzero_table[] = {
361 { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL,
362 USB_DEVICE_ID_U2F_ZERO) },
363 { }
364 };
365 MODULE_DEVICE_TABLE(hid, u2fzero_table);
366
367 static struct hid_driver u2fzero_driver = {
368 .name = "hid-" DRIVER_SHORT,
369 .probe = u2fzero_probe,
370 .remove = u2fzero_remove,
371 .id_table = u2fzero_table,
372 };
373
374 module_hid_driver(u2fzero_driver);
375
376 MODULE_LICENSE("GPL");
377 MODULE_AUTHOR("Andrej Shadura <andrew@shadura.me>");
378 MODULE_DESCRIPTION("U2F Zero LED and RNG driver");
379