drivers/hid/hid-u2fzero.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * U2F Zero LED and RNG driver
   4  *
   5  * Copyright 2018 Andrej Shadura <andrew@shadura.me>
   6  * Loosely based on drivers/hid/hid-led.c
   7  *              and drivers/usb/misc/chaoskey.c
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU General Public License as
  11  * published by the Free Software Foundation, version 2.
  12  */
  13
  14 #include <linux/hid.h>
  15 #include <linux/hidraw.h>
  16 #include <linux/hw_random.h>
  17 #include <linux/leds.h>
  18 #include <linux/module.h>
  19 #include <linux/mutex.h>
  20 #include <linux/usb.h>
  21
  22 #include "usbhid/usbhid.h"
  23 #include "hid-ids.h"
  24
  25 #define DRIVER_SHORT            "u2fzero"
  26
  27 #define HID_REPORT_SIZE         64
  28
  29 enum hw_revision {
  30         HW_U2FZERO,
  31         HW_NITROKEY_U2F,
  32 };
  33
  34 struct hw_revision_config {
  35         u8 rng_cmd;
  36         u8 wink_cmd;
  37         const char *name;
  38 };
  39
  40 static const struct hw_revision_config hw_configs[] = {
  41         [HW_U2FZERO] = {
  42                 .rng_cmd  = 0x21,
  43                 .wink_cmd = 0x24,
  44                 .name = "U2F Zero",
  45         },
  46         [HW_NITROKEY_U2F] = {
  47                 .rng_cmd  = 0xc0,
  48                 .wink_cmd = 0xc2,
  49                 .name = "NitroKey U2F",
  50         },
  51 };
  52
  53 /* We only use broadcast (CID-less) messages */
  54 #define CID_BROADCAST           0xffffffff
  55
  56 struct u2f_hid_msg {
  57         u32 cid;
  58         union {
  59                 struct {
  60                         u8 cmd;
  61                         u8 bcnth;
  62                         u8 bcntl;
  63                         u8 data[HID_REPORT_SIZE - 7];
  64                 } init;
  65                 struct {
  66                         u8 seq;
  67                         u8 data[HID_REPORT_SIZE - 5];
  68                 } cont;
  69         };
  70 } __packed;
  71
  72 struct u2f_hid_report {
  73         u8 report_type;
  74         struct u2f_hid_msg msg;
  75 } __packed;
  76
  77 #define U2F_HID_MSG_LEN(f)      (size_t)(((f).init.bcnth << 8) + (f).init.bcntl)
  78
  79 struct u2fzero_device {
  80         struct hid_device       *hdev;
  81         struct urb              *urb;       /* URB for the RNG data */
  82         struct led_classdev     ldev;       /* Embedded struct for led */
  83         struct hwrng            hwrng;      /* Embedded struct for hwrng */
  84         char                    *led_name;
  85         char                    *rng_name;
  86         u8                      *buf_out;
  87         u8                      *buf_in;
  88         struct mutex            lock;
  89         bool                    present;
  90         kernel_ulong_t          hw_revision;
  91 };
  92
  93 static int u2fzero_send(struct u2fzero_device *dev, struct u2f_hid_report *req)
  94 {
  95         int ret;
  96
  97         mutex_lock(&dev->lock);
  98
  99         memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
 100
 101         ret = hid_hw_output_report(dev->hdev, dev->buf_out,
 102                                    sizeof(struct u2f_hid_msg));
 103
 104         mutex_unlock(&dev->lock);
 105
 106         if (ret < 0)
 107                 return ret;
 108
 109         return ret == sizeof(struct u2f_hid_msg) ? 0 : -EMSGSIZE;
 110 }
 111
 112 struct u2fzero_transfer_context {
 113         struct completion done;
 114         int status;
 115 };
 116
 117 static void u2fzero_read_callback(struct urb *urb)
 118 {
 119         struct u2fzero_transfer_context *ctx = urb->context;
 120
 121         ctx->status = urb->status;
 122         complete(&ctx->done);
 123 }
 124
 125 static int u2fzero_recv(struct u2fzero_device *dev,
 126                         struct u2f_hid_report *req,
 127                         struct u2f_hid_msg *resp)
 128 {
 129         int ret;
 130         struct hid_device *hdev = dev->hdev;
 131         struct u2fzero_transfer_context ctx;
 132
 133         mutex_lock(&dev->lock);
 134
 135         memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
 136
 137         dev->urb->context = &ctx;
 138         init_completion(&ctx.done);
 139
 140         ret = usb_submit_urb(dev->urb, GFP_NOIO);
 141         if (unlikely(ret)) {
 142                 hid_err(hdev, "usb_submit_urb failed: %d", ret);
 143                 goto err;
 144         }
 145
 146         ret = hid_hw_output_report(dev->hdev, dev->buf_out,
 147                                    sizeof(struct u2f_hid_msg));
 148
 149         if (ret < 0) {
 150                 hid_err(hdev, "hid_hw_output_report failed: %d", ret);
 151                 goto err;
 152         }
 153
 154         ret = (wait_for_completion_timeout(
 155                 &ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT)));
 156         if (ret == 0) {
 157                 usb_kill_urb(dev->urb);
 158                 hid_err(hdev, "urb submission timed out");
 159         } else {
 160                 ret = dev->urb->actual_length;
 161                 memcpy(resp, dev->buf_in, ret);
 162         }
 163
 164 err:
 165         mutex_unlock(&dev->lock);
 166
 167         return ret;
 168 }
 169
 170 static int u2fzero_blink(struct led_classdev *ldev)
 171 {
 172         struct u2fzero_device *dev = container_of(ldev,
 173                 struct u2fzero_device, ldev);
 174         struct u2f_hid_report req = {
 175                 .report_type = 0,
 176                 .msg.cid = CID_BROADCAST,
 177                 .msg.init = {
 178                         .cmd = hw_configs[dev->hw_revision].wink_cmd,
 179                         .bcnth = 0,
 180                         .bcntl = 0,
 181                         .data  = {0},
 182                 }
 183         };
 184         return u2fzero_send(dev, &req);
 185 }
 186
 187 static int u2fzero_brightness_set(struct led_classdev *ldev,
 188                                   enum led_brightness brightness)
 189 {
 190         ldev->brightness = LED_OFF;
 191         if (brightness)
 192                 return u2fzero_blink(ldev);
 193         else
 194                 return 0;
 195 }
 196
 197 static int u2fzero_rng_read(struct hwrng *rng, void *data,
 198                             size_t max, bool wait)
 199 {
 200         struct u2fzero_device *dev = container_of(rng,
 201                 struct u2fzero_device, hwrng);
 202         struct u2f_hid_report req = {
 203                 .report_type = 0,
 204                 .msg.cid = CID_BROADCAST,
 205                 .msg.init = {
 206                         .cmd = hw_configs[dev->hw_revision].rng_cmd,
 207                         .bcnth = 0,
 208                         .bcntl = 0,
 209                         .data  = {0},
 210                 }
 211         };
 212         struct u2f_hid_msg resp;
 213         int ret;
 214         size_t actual_length;
 215         /* valid packets must have a correct header */
 216         int min_length = offsetof(struct u2f_hid_msg, init.data);
 217
 218         if (!dev->present) {
 219                 hid_dbg(dev->hdev, "device not present");
 220                 return 0;
 221         }
 222
 223         ret = u2fzero_recv(dev, &req, &resp);
 224
 225         /* ignore errors or packets without data */
 226         if (ret < min_length)
 227                 return 0;
 228
 229         /* only take the minimum amount of data it is safe to take */
 230         actual_length = min3((size_t)ret - min_length,
 231                 U2F_HID_MSG_LEN(resp), max);
 232
 233         memcpy(data, resp.init.data, actual_length);
 234
 235         return actual_length;
 236 }
 237
 238 static int u2fzero_init_led(struct u2fzero_device *dev,
 239                             unsigned int minor)
 240 {
 241         dev->led_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
 242                 "%s%u", DRIVER_SHORT, minor);
 243         if (dev->led_name == NULL)
 244                 return -ENOMEM;
 245
 246         dev->ldev.name = dev->led_name;
 247         dev->ldev.max_brightness = LED_ON;
 248         dev->ldev.flags = LED_HW_PLUGGABLE;
 249         dev->ldev.brightness_set_blocking = u2fzero_brightness_set;
 250
 251         return devm_led_classdev_register(&dev->hdev->dev, &dev->ldev);
 252 }
 253
 254 static int u2fzero_init_hwrng(struct u2fzero_device *dev,
 255                               unsigned int minor)
 256 {
 257         dev->rng_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
 258                 "%s-rng%u", DRIVER_SHORT, minor);
 259         if (dev->rng_name == NULL)
 260                 return -ENOMEM;
 261
 262         dev->hwrng.name = dev->rng_name;
 263         dev->hwrng.read = u2fzero_rng_read;
 264         dev->hwrng.quality = 1;
 265
 266         return devm_hwrng_register(&dev->hdev->dev, &dev->hwrng);
 267 }
 268
 269 static int u2fzero_fill_in_urb(struct u2fzero_device *dev)
 270 {
 271         struct hid_device *hdev = dev->hdev;
 272         struct usb_device *udev;
 273         struct usbhid_device *usbhid = hdev->driver_data;
 274         unsigned int pipe_in;
 275         struct usb_host_endpoint *ep;
 276
 277         if (dev->hdev->bus != BUS_USB)
 278                 return -EINVAL;
 279
 280         udev = hid_to_usb_dev(hdev);
 281
 282         if (!usbhid->urbout || !usbhid->urbin)
 283                 return -ENODEV;
 284
 285         ep = usb_pipe_endpoint(udev, usbhid->urbin->pipe);
 286         if (!ep)
 287                 return -ENODEV;
 288
 289         dev->urb = usb_alloc_urb(0, GFP_KERNEL);
 290         if (!dev->urb)
 291                 return -ENOMEM;
 292
 293         pipe_in = (usbhid->urbin->pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
 294
 295         usb_fill_int_urb(dev->urb,
 296                 udev,
 297                 pipe_in,
 298                 dev->buf_in,
 299                 HID_REPORT_SIZE,
 300                 u2fzero_read_callback,
 301                 NULL,
 302                 ep->desc.bInterval);
 303
 304         return 0;
 305 }
 306
 307 static int u2fzero_probe(struct hid_device *hdev,
 308                          const struct hid_device_id *id)
 309 {
 310         struct u2fzero_device *dev;
 311         unsigned int minor;
 312         int ret;
 313
 314         if (!hid_is_usb(hdev))
 315                 return -EINVAL;
 316
 317         dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL);
 318         if (dev == NULL)
 319                 return -ENOMEM;
 320
 321         dev->hw_revision = id->driver_data;
 322
 323         dev->buf_out = devm_kmalloc(&hdev->dev,
 324                 sizeof(struct u2f_hid_report), GFP_KERNEL);
 325         if (dev->buf_out == NULL)
 326                 return -ENOMEM;
 327
 328         dev->buf_in = devm_kmalloc(&hdev->dev,
 329                 sizeof(struct u2f_hid_msg), GFP_KERNEL);
 330         if (dev->buf_in == NULL)
 331                 return -ENOMEM;
 332
 333         ret = hid_parse(hdev);
 334         if (ret)
 335                 return ret;
 336
 337         dev->hdev = hdev;
 338         hid_set_drvdata(hdev, dev);
 339         mutex_init(&dev->lock);
 340
 341         ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
 342         if (ret)
 343                 return ret;
 344
 345         u2fzero_fill_in_urb(dev);
 346
 347         dev->present = true;
 348
 349         minor = ((struct hidraw *) hdev->hidraw)->minor;
 350
 351         ret = u2fzero_init_led(dev, minor);
 352         if (ret) {
 353                 hid_hw_stop(hdev);
 354                 return ret;
 355         }
 356
 357         hid_info(hdev, "%s LED initialised\n", hw_configs[dev->hw_revision].name);
 358
 359         ret = u2fzero_init_hwrng(dev, minor);
 360         if (ret) {
 361                 hid_hw_stop(hdev);
 362                 return ret;
 363         }
 364
 365         hid_info(hdev, "%s RNG initialised\n", hw_configs[dev->hw_revision].name);
 366
 367         return 0;
 368 }
 369
 370 static void u2fzero_remove(struct hid_device *hdev)
 371 {
 372         struct u2fzero_device *dev = hid_get_drvdata(hdev);
 373
 374         mutex_lock(&dev->lock);
 375         dev->present = false;
 376         mutex_unlock(&dev->lock);
 377
 378         hid_hw_stop(hdev);
 379         usb_poison_urb(dev->urb);
 380         usb_free_urb(dev->urb);
 381 }
 382
 383 static const struct hid_device_id u2fzero_table[] = {
 384         { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL,
 385           USB_DEVICE_ID_U2F_ZERO),
 386           .driver_data = HW_U2FZERO },
 387         { HID_USB_DEVICE(USB_VENDOR_ID_CLAY_LOGIC,
 388           USB_DEVICE_ID_NITROKEY_U2F),
 389           .driver_data = HW_NITROKEY_U2F },
 390         { }
 391 };
 392 MODULE_DEVICE_TABLE(hid, u2fzero_table);
 393
 394 static struct hid_driver u2fzero_driver = {
 395         .name = "hid-" DRIVER_SHORT,
 396         .probe = u2fzero_probe,
 397         .remove = u2fzero_remove,
 398         .id_table = u2fzero_table,
 399 };
 400
 401 module_hid_driver(u2fzero_driver);
 402
 403 MODULE_LICENSE("GPL");
 404 MODULE_AUTHOR("Andrej Shadura <andrew@shadura.me>");
 405 MODULE_DESCRIPTION("U2F Zero LED and RNG driver");