1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * U2F Zero LED and RNG driver 4 * 5 * Copyright 2018 Andrej Shadura <andrew@shadura.me> 6 * Loosely based on drivers/hid/hid-led.c 7 * and drivers/usb/misc/chaoskey.c 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2. 12 */ 13 14 #include <linux/hid.h> 15 #include <linux/hidraw.h> 16 #include <linux/hw_random.h> 17 #include <linux/leds.h> 18 #include <linux/module.h> 19 #include <linux/mutex.h> 20 #include <linux/usb.h> 21 22 #include "usbhid/usbhid.h" 23 #include "hid-ids.h" 24 25 #define DRIVER_SHORT "u2fzero" 26 27 #define HID_REPORT_SIZE 64 28 29 /* We only use broadcast (CID-less) messages */ 30 #define CID_BROADCAST 0xffffffff 31 32 struct u2f_hid_msg { 33 u32 cid; 34 union { 35 struct { 36 u8 cmd; 37 u8 bcnth; 38 u8 bcntl; 39 u8 data[HID_REPORT_SIZE - 7]; 40 } init; 41 struct { 42 u8 seq; 43 u8 data[HID_REPORT_SIZE - 5]; 44 } cont; 45 }; 46 } __packed; 47 48 struct u2f_hid_report { 49 u8 report_type; 50 struct u2f_hid_msg msg; 51 } __packed; 52 53 #define U2F_HID_MSG_LEN(f) (size_t)(((f).init.bcnth << 8) + (f).init.bcntl) 54 55 /* Custom extensions to the U2FHID protocol */ 56 #define U2F_CUSTOM_GET_RNG 0x21 57 #define U2F_CUSTOM_WINK 0x24 58 59 struct u2fzero_device { 60 struct hid_device *hdev; 61 struct urb *urb; /* URB for the RNG data */ 62 struct led_classdev ldev; /* Embedded struct for led */ 63 struct hwrng hwrng; /* Embedded struct for hwrng */ 64 char *led_name; 65 char *rng_name; 66 u8 *buf_out; 67 u8 *buf_in; 68 struct mutex lock; 69 bool present; 70 }; 71 72 static int u2fzero_send(struct u2fzero_device *dev, struct u2f_hid_report *req) 73 { 74 int ret; 75 76 mutex_lock(&dev->lock); 77 78 memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report)); 79 80 ret = hid_hw_output_report(dev->hdev, dev->buf_out, 81 sizeof(struct u2f_hid_msg)); 82 83 mutex_unlock(&dev->lock); 84 85 if (ret < 0) 86 return ret; 87 88 return ret == sizeof(struct u2f_hid_msg) ? 0 : -EMSGSIZE; 89 } 90 91 struct u2fzero_transfer_context { 92 struct completion done; 93 int status; 94 }; 95 96 static void u2fzero_read_callback(struct urb *urb) 97 { 98 struct u2fzero_transfer_context *ctx = urb->context; 99 100 ctx->status = urb->status; 101 complete(&ctx->done); 102 } 103 104 static int u2fzero_recv(struct u2fzero_device *dev, 105 struct u2f_hid_report *req, 106 struct u2f_hid_msg *resp) 107 { 108 int ret; 109 struct hid_device *hdev = dev->hdev; 110 struct u2fzero_transfer_context ctx; 111 112 mutex_lock(&dev->lock); 113 114 memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report)); 115 116 dev->urb->context = &ctx; 117 init_completion(&ctx.done); 118 119 ret = usb_submit_urb(dev->urb, GFP_NOIO); 120 if (unlikely(ret)) { 121 hid_err(hdev, "usb_submit_urb failed: %d", ret); 122 goto err; 123 } 124 125 ret = hid_hw_output_report(dev->hdev, dev->buf_out, 126 sizeof(struct u2f_hid_msg)); 127 128 if (ret < 0) { 129 hid_err(hdev, "hid_hw_output_report failed: %d", ret); 130 goto err; 131 } 132 133 ret = (wait_for_completion_timeout( 134 &ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT))); 135 if (ret < 0) { 136 usb_kill_urb(dev->urb); 137 hid_err(hdev, "urb submission timed out"); 138 } else { 139 ret = dev->urb->actual_length; 140 memcpy(resp, dev->buf_in, ret); 141 } 142 143 err: 144 mutex_unlock(&dev->lock); 145 146 return ret; 147 } 148 149 static int u2fzero_blink(struct led_classdev *ldev) 150 { 151 struct u2fzero_device *dev = container_of(ldev, 152 struct u2fzero_device, ldev); 153 struct u2f_hid_report req = { 154 .report_type = 0, 155 .msg.cid = CID_BROADCAST, 156 .msg.init = { 157 .cmd = U2F_CUSTOM_WINK, 158 .bcnth = 0, 159 .bcntl = 0, 160 .data = {0}, 161 } 162 }; 163 return u2fzero_send(dev, &req); 164 } 165 166 static int u2fzero_brightness_set(struct led_classdev *ldev, 167 enum led_brightness brightness) 168 { 169 ldev->brightness = LED_OFF; 170 if (brightness) 171 return u2fzero_blink(ldev); 172 else 173 return 0; 174 } 175 176 static int u2fzero_rng_read(struct hwrng *rng, void *data, 177 size_t max, bool wait) 178 { 179 struct u2fzero_device *dev = container_of(rng, 180 struct u2fzero_device, hwrng); 181 struct u2f_hid_report req = { 182 .report_type = 0, 183 .msg.cid = CID_BROADCAST, 184 .msg.init = { 185 .cmd = U2F_CUSTOM_GET_RNG, 186 .bcnth = 0, 187 .bcntl = 0, 188 .data = {0}, 189 } 190 }; 191 struct u2f_hid_msg resp; 192 int ret; 193 size_t actual_length; 194 /* valid packets must have a correct header */ 195 int min_length = offsetof(struct u2f_hid_msg, init.data); 196 197 if (!dev->present) { 198 hid_dbg(dev->hdev, "device not present"); 199 return 0; 200 } 201 202 ret = u2fzero_recv(dev, &req, &resp); 203 204 /* ignore errors or packets without data */ 205 if (ret < min_length) 206 return 0; 207 208 /* only take the minimum amount of data it is safe to take */ 209 actual_length = min3((size_t)ret - min_length, 210 U2F_HID_MSG_LEN(resp), max); 211 212 memcpy(data, resp.init.data, actual_length); 213 214 return actual_length; 215 } 216 217 static int u2fzero_init_led(struct u2fzero_device *dev, 218 unsigned int minor) 219 { 220 dev->led_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL, 221 "%s%u", DRIVER_SHORT, minor); 222 if (dev->led_name == NULL) 223 return -ENOMEM; 224 225 dev->ldev.name = dev->led_name; 226 dev->ldev.max_brightness = LED_ON; 227 dev->ldev.flags = LED_HW_PLUGGABLE; 228 dev->ldev.brightness_set_blocking = u2fzero_brightness_set; 229 230 return devm_led_classdev_register(&dev->hdev->dev, &dev->ldev); 231 } 232 233 static int u2fzero_init_hwrng(struct u2fzero_device *dev, 234 unsigned int minor) 235 { 236 dev->rng_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL, 237 "%s-rng%u", DRIVER_SHORT, minor); 238 if (dev->rng_name == NULL) 239 return -ENOMEM; 240 241 dev->hwrng.name = dev->rng_name; 242 dev->hwrng.read = u2fzero_rng_read; 243 dev->hwrng.quality = 1; 244 245 return devm_hwrng_register(&dev->hdev->dev, &dev->hwrng); 246 } 247 248 static int u2fzero_fill_in_urb(struct u2fzero_device *dev) 249 { 250 struct hid_device *hdev = dev->hdev; 251 struct usb_device *udev; 252 struct usbhid_device *usbhid = hdev->driver_data; 253 unsigned int pipe_in; 254 struct usb_host_endpoint *ep; 255 256 if (dev->hdev->bus != BUS_USB) 257 return -EINVAL; 258 259 udev = hid_to_usb_dev(hdev); 260 261 if (!usbhid->urbout || !usbhid->urbin) 262 return -ENODEV; 263 264 ep = usb_pipe_endpoint(udev, usbhid->urbin->pipe); 265 if (!ep) 266 return -ENODEV; 267 268 dev->urb = usb_alloc_urb(0, GFP_KERNEL); 269 if (!dev->urb) 270 return -ENOMEM; 271 272 pipe_in = (usbhid->urbin->pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30); 273 274 usb_fill_int_urb(dev->urb, 275 udev, 276 pipe_in, 277 dev->buf_in, 278 HID_REPORT_SIZE, 279 u2fzero_read_callback, 280 NULL, 281 ep->desc.bInterval); 282 283 return 0; 284 } 285 286 static int u2fzero_probe(struct hid_device *hdev, 287 const struct hid_device_id *id) 288 { 289 struct u2fzero_device *dev; 290 unsigned int minor; 291 int ret; 292 293 if (!hid_is_using_ll_driver(hdev, &usb_hid_driver)) 294 return -EINVAL; 295 296 dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL); 297 if (dev == NULL) 298 return -ENOMEM; 299 300 dev->buf_out = devm_kmalloc(&hdev->dev, 301 sizeof(struct u2f_hid_report), GFP_KERNEL); 302 if (dev->buf_out == NULL) 303 return -ENOMEM; 304 305 dev->buf_in = devm_kmalloc(&hdev->dev, 306 sizeof(struct u2f_hid_msg), GFP_KERNEL); 307 if (dev->buf_in == NULL) 308 return -ENOMEM; 309 310 ret = hid_parse(hdev); 311 if (ret) 312 return ret; 313 314 dev->hdev = hdev; 315 hid_set_drvdata(hdev, dev); 316 mutex_init(&dev->lock); 317 318 ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW); 319 if (ret) 320 return ret; 321 322 u2fzero_fill_in_urb(dev); 323 324 dev->present = true; 325 326 minor = ((struct hidraw *) hdev->hidraw)->minor; 327 328 ret = u2fzero_init_led(dev, minor); 329 if (ret) { 330 hid_hw_stop(hdev); 331 return ret; 332 } 333 334 hid_info(hdev, "U2F Zero LED initialised\n"); 335 336 ret = u2fzero_init_hwrng(dev, minor); 337 if (ret) { 338 hid_hw_stop(hdev); 339 return ret; 340 } 341 342 hid_info(hdev, "U2F Zero RNG initialised\n"); 343 344 return 0; 345 } 346 347 static void u2fzero_remove(struct hid_device *hdev) 348 { 349 struct u2fzero_device *dev = hid_get_drvdata(hdev); 350 351 mutex_lock(&dev->lock); 352 dev->present = false; 353 mutex_unlock(&dev->lock); 354 355 hid_hw_stop(hdev); 356 usb_poison_urb(dev->urb); 357 usb_free_urb(dev->urb); 358 } 359 360 static const struct hid_device_id u2fzero_table[] = { 361 { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, 362 USB_DEVICE_ID_U2F_ZERO) }, 363 { } 364 }; 365 MODULE_DEVICE_TABLE(hid, u2fzero_table); 366 367 static struct hid_driver u2fzero_driver = { 368 .name = "hid-" DRIVER_SHORT, 369 .probe = u2fzero_probe, 370 .remove = u2fzero_remove, 371 .id_table = u2fzero_table, 372 }; 373 374 module_hid_driver(u2fzero_driver); 375 376 MODULE_LICENSE("GPL"); 377 MODULE_AUTHOR("Andrej Shadura <andrew@shadura.me>"); 378 MODULE_DESCRIPTION("U2F Zero LED and RNG driver"); 379