drivers/hid/hid-u2fzero.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * U2F Zero LED and RNG driver
0004  *
0005  * Copyright 2018 Andrej Shadura <andrew@shadura.me>
0006  * Loosely based on drivers/hid/hid-led.c
0007  *              and drivers/usb/misc/chaoskey.c
0008  *
0009  * This program is free software; you can redistribute it and/or
0010  * modify it under the terms of the GNU General Public License as
0011  * published by the Free Software Foundation, version 2.
0012  */
0013
0014 #include <linux/hid.h>
0015 #include <linux/hidraw.h>
0016 #include <linux/hw_random.h>
0017 #include <linux/leds.h>
0018 #include <linux/module.h>
0019 #include <linux/mutex.h>
0020 #include <linux/usb.h>
0021
0022 #include "usbhid/usbhid.h"
0023 #include "hid-ids.h"
0024
0025 #define DRIVER_SHORT        "u2fzero"
0026
0027 #define HID_REPORT_SIZE     64
0028
0029 enum hw_revision {
0030     HW_U2FZERO,
0031     HW_NITROKEY_U2F,
0032 };
0033
0034 struct hw_revision_config {
0035     u8 rng_cmd;
0036     u8 wink_cmd;
0037     const char *name;
0038 };
0039
0040 static const struct hw_revision_config hw_configs[] = {
0041     [HW_U2FZERO] = {
0042         .rng_cmd  = 0x21,
0043         .wink_cmd = 0x24,
0044         .name = "U2F Zero",
0045     },
0046     [HW_NITROKEY_U2F] = {
0047         .rng_cmd  = 0xc0,
0048         .wink_cmd = 0xc2,
0049         .name = "NitroKey U2F",
0050     },
0051 };
0052
0053 /* We only use broadcast (CID-less) messages */
0054 #define CID_BROADCAST       0xffffffff
0055
0056 struct u2f_hid_msg {
0057     u32 cid;
0058     union {
0059         struct {
0060             u8 cmd;
0061             u8 bcnth;
0062             u8 bcntl;
0063             u8 data[HID_REPORT_SIZE - 7];
0064         } init;
0065         struct {
0066             u8 seq;
0067             u8 data[HID_REPORT_SIZE - 5];
0068         } cont;
0069     };
0070 } __packed;
0071
0072 struct u2f_hid_report {
0073     u8 report_type;
0074     struct u2f_hid_msg msg;
0075 } __packed;
0076
0077 #define U2F_HID_MSG_LEN(f)  (size_t)(((f).init.bcnth << 8) + (f).init.bcntl)
0078
0079 struct u2fzero_device {
0080     struct hid_device   *hdev;
0081     struct urb      *urb;       /* URB for the RNG data */
0082     struct led_classdev ldev;       /* Embedded struct for led */
0083     struct hwrng        hwrng;      /* Embedded struct for hwrng */
0084     char            *led_name;
0085     char            *rng_name;
0086     u8          *buf_out;
0087     u8          *buf_in;
0088     struct mutex        lock;
0089     bool            present;
0090     kernel_ulong_t      hw_revision;
0091 };
0092
0093 static int u2fzero_send(struct u2fzero_device *dev, struct u2f_hid_report *req)
0094 {
0095     int ret;
0096
0097     mutex_lock(&dev->lock);
0098
0099     memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
0100
0101     ret = hid_hw_output_report(dev->hdev, dev->buf_out,
0102                    sizeof(struct u2f_hid_msg));
0103
0104     mutex_unlock(&dev->lock);
0105
0106     if (ret < 0)
0107         return ret;
0108
0109     return ret == sizeof(struct u2f_hid_msg) ? 0 : -EMSGSIZE;
0110 }
0111
0112 struct u2fzero_transfer_context {
0113     struct completion done;
0114     int status;
0115 };
0116
0117 static void u2fzero_read_callback(struct urb *urb)
0118 {
0119     struct u2fzero_transfer_context *ctx = urb->context;
0120
0121     ctx->status = urb->status;
0122     complete(&ctx->done);
0123 }
0124
0125 static int u2fzero_recv(struct u2fzero_device *dev,
0126             struct u2f_hid_report *req,
0127             struct u2f_hid_msg *resp)
0128 {
0129     int ret;
0130     struct hid_device *hdev = dev->hdev;
0131     struct u2fzero_transfer_context ctx;
0132
0133     mutex_lock(&dev->lock);
0134
0135     memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
0136
0137     dev->urb->context = &ctx;
0138     init_completion(&ctx.done);
0139
0140     ret = usb_submit_urb(dev->urb, GFP_NOIO);
0141     if (unlikely(ret)) {
0142         hid_err(hdev, "usb_submit_urb failed: %d", ret);
0143         goto err;
0144     }
0145
0146     ret = hid_hw_output_report(dev->hdev, dev->buf_out,
0147                    sizeof(struct u2f_hid_msg));
0148
0149     if (ret < 0) {
0150         hid_err(hdev, "hid_hw_output_report failed: %d", ret);
0151         goto err;
0152     }
0153
0154     ret = (wait_for_completion_timeout(
0155         &ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT)));
0156     if (ret == 0) {
0157         usb_kill_urb(dev->urb);
0158         hid_err(hdev, "urb submission timed out");
0159     } else {
0160         ret = dev->urb->actual_length;
0161         memcpy(resp, dev->buf_in, ret);
0162     }
0163
0164 err:
0165     mutex_unlock(&dev->lock);
0166
0167     return ret;
0168 }
0169
0170 static int u2fzero_blink(struct led_classdev *ldev)
0171 {
0172     struct u2fzero_device *dev = container_of(ldev,
0173         struct u2fzero_device, ldev);
0174     struct u2f_hid_report req = {
0175         .report_type = 0,
0176         .msg.cid = CID_BROADCAST,
0177         .msg.init = {
0178             .cmd = hw_configs[dev->hw_revision].wink_cmd,
0179             .bcnth = 0,
0180             .bcntl = 0,
0181             .data  = {0},
0182         }
0183     };
0184     return u2fzero_send(dev, &req);
0185 }
0186
0187 static int u2fzero_brightness_set(struct led_classdev *ldev,
0188                   enum led_brightness brightness)
0189 {
0190     ldev->brightness = LED_OFF;
0191     if (brightness)
0192         return u2fzero_blink(ldev);
0193     else
0194         return 0;
0195 }
0196
0197 static int u2fzero_rng_read(struct hwrng *rng, void *data,
0198                 size_t max, bool wait)
0199 {
0200     struct u2fzero_device *dev = container_of(rng,
0201         struct u2fzero_device, hwrng);
0202     struct u2f_hid_report req = {
0203         .report_type = 0,
0204         .msg.cid = CID_BROADCAST,
0205         .msg.init = {
0206             .cmd = hw_configs[dev->hw_revision].rng_cmd,
0207             .bcnth = 0,
0208             .bcntl = 0,
0209             .data  = {0},
0210         }
0211     };
0212     struct u2f_hid_msg resp;
0213     int ret;
0214     size_t actual_length;
0215     /* valid packets must have a correct header */
0216     int min_length = offsetof(struct u2f_hid_msg, init.data);
0217
0218     if (!dev->present) {
0219         hid_dbg(dev->hdev, "device not present");
0220         return 0;
0221     }
0222
0223     ret = u2fzero_recv(dev, &req, &resp);
0224
0225     /* ignore errors or packets without data */
0226     if (ret < min_length)
0227         return 0;
0228
0229     /* only take the minimum amount of data it is safe to take */
0230     actual_length = min3((size_t)ret - min_length,
0231         U2F_HID_MSG_LEN(resp), max);
0232
0233     memcpy(data, resp.init.data, actual_length);
0234
0235     return actual_length;
0236 }
0237
0238 static int u2fzero_init_led(struct u2fzero_device *dev,
0239                 unsigned int minor)
0240 {
0241     dev->led_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
0242         "%s%u", DRIVER_SHORT, minor);
0243     if (dev->led_name == NULL)
0244         return -ENOMEM;
0245
0246     dev->ldev.name = dev->led_name;
0247     dev->ldev.max_brightness = LED_ON;
0248     dev->ldev.flags = LED_HW_PLUGGABLE;
0249     dev->ldev.brightness_set_blocking = u2fzero_brightness_set;
0250
0251     return devm_led_classdev_register(&dev->hdev->dev, &dev->ldev);
0252 }
0253
0254 static int u2fzero_init_hwrng(struct u2fzero_device *dev,
0255                   unsigned int minor)
0256 {
0257     dev->rng_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
0258         "%s-rng%u", DRIVER_SHORT, minor);
0259     if (dev->rng_name == NULL)
0260         return -ENOMEM;
0261
0262     dev->hwrng.name = dev->rng_name;
0263     dev->hwrng.read = u2fzero_rng_read;
0264     dev->hwrng.quality = 1;
0265
0266     return devm_hwrng_register(&dev->hdev->dev, &dev->hwrng);
0267 }
0268
0269 static int u2fzero_fill_in_urb(struct u2fzero_device *dev)
0270 {
0271     struct hid_device *hdev = dev->hdev;
0272     struct usb_device *udev;
0273     struct usbhid_device *usbhid = hdev->driver_data;
0274     unsigned int pipe_in;
0275     struct usb_host_endpoint *ep;
0276
0277     if (dev->hdev->bus != BUS_USB)
0278         return -EINVAL;
0279
0280     udev = hid_to_usb_dev(hdev);
0281
0282     if (!usbhid->urbout || !usbhid->urbin)
0283         return -ENODEV;
0284
0285     ep = usb_pipe_endpoint(udev, usbhid->urbin->pipe);
0286     if (!ep)
0287         return -ENODEV;
0288
0289     dev->urb = usb_alloc_urb(0, GFP_KERNEL);
0290     if (!dev->urb)
0291         return -ENOMEM;
0292
0293     pipe_in = (usbhid->urbin->pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
0294
0295     usb_fill_int_urb(dev->urb,
0296         udev,
0297         pipe_in,
0298         dev->buf_in,
0299         HID_REPORT_SIZE,
0300         u2fzero_read_callback,
0301         NULL,
0302         ep->desc.bInterval);
0303
0304     return 0;
0305 }
0306
0307 static int u2fzero_probe(struct hid_device *hdev,
0308              const struct hid_device_id *id)
0309 {
0310     struct u2fzero_device *dev;
0311     unsigned int minor;
0312     int ret;
0313
0314     if (!hid_is_usb(hdev))
0315         return -EINVAL;
0316
0317     dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL);
0318     if (dev == NULL)
0319         return -ENOMEM;
0320
0321     dev->hw_revision = id->driver_data;
0322
0323     dev->buf_out = devm_kmalloc(&hdev->dev,
0324         sizeof(struct u2f_hid_report), GFP_KERNEL);
0325     if (dev->buf_out == NULL)
0326         return -ENOMEM;
0327
0328     dev->buf_in = devm_kmalloc(&hdev->dev,
0329         sizeof(struct u2f_hid_msg), GFP_KERNEL);
0330     if (dev->buf_in == NULL)
0331         return -ENOMEM;
0332
0333     ret = hid_parse(hdev);
0334     if (ret)
0335         return ret;
0336
0337     dev->hdev = hdev;
0338     hid_set_drvdata(hdev, dev);
0339     mutex_init(&dev->lock);
0340
0341     ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
0342     if (ret)
0343         return ret;
0344
0345     u2fzero_fill_in_urb(dev);
0346
0347     dev->present = true;
0348
0349     minor = ((struct hidraw *) hdev->hidraw)->minor;
0350
0351     ret = u2fzero_init_led(dev, minor);
0352     if (ret) {
0353         hid_hw_stop(hdev);
0354         return ret;
0355     }
0356
0357     hid_info(hdev, "%s LED initialised\n", hw_configs[dev->hw_revision].name);
0358
0359     ret = u2fzero_init_hwrng(dev, minor);
0360     if (ret) {
0361         hid_hw_stop(hdev);
0362         return ret;
0363     }
0364
0365     hid_info(hdev, "%s RNG initialised\n", hw_configs[dev->hw_revision].name);
0366
0367     return 0;
0368 }
0369
0370 static void u2fzero_remove(struct hid_device *hdev)
0371 {
0372     struct u2fzero_device *dev = hid_get_drvdata(hdev);
0373
0374     mutex_lock(&dev->lock);
0375     dev->present = false;
0376     mutex_unlock(&dev->lock);
0377
0378     hid_hw_stop(hdev);
0379     usb_poison_urb(dev->urb);
0380     usb_free_urb(dev->urb);
0381 }
0382
0383 static const struct hid_device_id u2fzero_table[] = {
0384     { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL,
0385       USB_DEVICE_ID_U2F_ZERO),
0386       .driver_data = HW_U2FZERO },
0387     { HID_USB_DEVICE(USB_VENDOR_ID_CLAY_LOGIC,
0388       USB_DEVICE_ID_NITROKEY_U2F),
0389       .driver_data = HW_NITROKEY_U2F },
0390     { }
0391 };
0392 MODULE_DEVICE_TABLE(hid, u2fzero_table);
0393
0394 static struct hid_driver u2fzero_driver = {
0395     .name = "hid-" DRIVER_SHORT,
0396     .probe = u2fzero_probe,
0397     .remove = u2fzero_remove,
0398     .id_table = u2fzero_table,
0399 };
0400
0401 module_hid_driver(u2fzero_driver);
0402
0403 MODULE_LICENSE("GPL");
0404 MODULE_AUTHOR("Andrej Shadura <andrew@shadura.me>");
0405 MODULE_DESCRIPTION("U2F Zero LED and RNG driver");