Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * U2F Zero LED and RNG driver
4 *
5 * Copyright 2018 Andrej Shadura <andrew@shadura.me>
6 * Loosely based on drivers/hid/hid-led.c
7 * and drivers/usb/misc/chaoskey.c
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2.
12 */
13
14#include <linux/hid.h>
15#include <linux/hidraw.h>
16#include <linux/hw_random.h>
17#include <linux/leds.h>
18#include <linux/module.h>
19#include <linux/mutex.h>
20#include <linux/usb.h>
21
22#include "usbhid/usbhid.h"
23#include "hid-ids.h"
24
25#define DRIVER_SHORT "u2fzero"
26
27#define HID_REPORT_SIZE 64
28
29/* We only use broadcast (CID-less) messages */
30#define CID_BROADCAST 0xffffffff
31
32struct u2f_hid_msg {
33 u32 cid;
34 union {
35 struct {
36 u8 cmd;
37 u8 bcnth;
38 u8 bcntl;
39 u8 data[HID_REPORT_SIZE - 7];
40 } init;
41 struct {
42 u8 seq;
43 u8 data[HID_REPORT_SIZE - 5];
44 } cont;
45 };
46} __packed;
47
48struct u2f_hid_report {
49 u8 report_type;
50 struct u2f_hid_msg msg;
51} __packed;
52
53#define U2F_HID_MSG_LEN(f) (size_t)(((f).init.bcnth << 8) + (f).init.bcntl)
54
55/* Custom extensions to the U2FHID protocol */
56#define U2F_CUSTOM_GET_RNG 0x21
57#define U2F_CUSTOM_WINK 0x24
58
59struct u2fzero_device {
60 struct hid_device *hdev;
61 struct urb *urb; /* URB for the RNG data */
62 struct led_classdev ldev; /* Embedded struct for led */
63 struct hwrng hwrng; /* Embedded struct for hwrng */
64 char *led_name;
65 char *rng_name;
66 u8 *buf_out;
67 u8 *buf_in;
68 struct mutex lock;
69 bool present;
70};
71
72static int u2fzero_send(struct u2fzero_device *dev, struct u2f_hid_report *req)
73{
74 int ret;
75
76 mutex_lock(&dev->lock);
77
78 memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
79
80 ret = hid_hw_output_report(dev->hdev, dev->buf_out,
81 sizeof(struct u2f_hid_msg));
82
83 mutex_unlock(&dev->lock);
84
85 if (ret < 0)
86 return ret;
87
88 return ret == sizeof(struct u2f_hid_msg) ? 0 : -EMSGSIZE;
89}
90
91struct u2fzero_transfer_context {
92 struct completion done;
93 int status;
94};
95
96static void u2fzero_read_callback(struct urb *urb)
97{
98 struct u2fzero_transfer_context *ctx = urb->context;
99
100 ctx->status = urb->status;
101 complete(&ctx->done);
102}
103
104static int u2fzero_recv(struct u2fzero_device *dev,
105 struct u2f_hid_report *req,
106 struct u2f_hid_msg *resp)
107{
108 int ret;
109 struct hid_device *hdev = dev->hdev;
110 struct u2fzero_transfer_context ctx;
111
112 mutex_lock(&dev->lock);
113
114 memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
115
116 dev->urb->context = &ctx;
117 init_completion(&ctx.done);
118
119 ret = usb_submit_urb(dev->urb, GFP_NOIO);
120 if (unlikely(ret)) {
121 hid_err(hdev, "usb_submit_urb failed: %d", ret);
122 goto err;
123 }
124
125 ret = hid_hw_output_report(dev->hdev, dev->buf_out,
126 sizeof(struct u2f_hid_msg));
127
128 if (ret < 0) {
129 hid_err(hdev, "hid_hw_output_report failed: %d", ret);
130 goto err;
131 }
132
133 ret = (wait_for_completion_timeout(
134 &ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT)));
135 if (ret < 0) {
136 usb_kill_urb(dev->urb);
137 hid_err(hdev, "urb submission timed out");
138 } else {
139 ret = dev->urb->actual_length;
140 memcpy(resp, dev->buf_in, ret);
141 }
142
143err:
144 mutex_unlock(&dev->lock);
145
146 return ret;
147}
148
149static int u2fzero_blink(struct led_classdev *ldev)
150{
151 struct u2fzero_device *dev = container_of(ldev,
152 struct u2fzero_device, ldev);
153 struct u2f_hid_report req = {
154 .report_type = 0,
155 .msg.cid = CID_BROADCAST,
156 .msg.init = {
157 .cmd = U2F_CUSTOM_WINK,
158 .bcnth = 0,
159 .bcntl = 0,
160 .data = {0},
161 }
162 };
163 return u2fzero_send(dev, &req);
164}
165
166static int u2fzero_brightness_set(struct led_classdev *ldev,
167 enum led_brightness brightness)
168{
169 ldev->brightness = LED_OFF;
170 if (brightness)
171 return u2fzero_blink(ldev);
172 else
173 return 0;
174}
175
176static int u2fzero_rng_read(struct hwrng *rng, void *data,
177 size_t max, bool wait)
178{
179 struct u2fzero_device *dev = container_of(rng,
180 struct u2fzero_device, hwrng);
181 struct u2f_hid_report req = {
182 .report_type = 0,
183 .msg.cid = CID_BROADCAST,
184 .msg.init = {
185 .cmd = U2F_CUSTOM_GET_RNG,
186 .bcnth = 0,
187 .bcntl = 0,
188 .data = {0},
189 }
190 };
191 struct u2f_hid_msg resp;
192 int ret;
193 size_t actual_length;
194
195 if (!dev->present) {
196 hid_dbg(dev->hdev, "device not present");
197 return 0;
198 }
199
200 ret = u2fzero_recv(dev, &req, &resp);
201 if (ret < 0)
202 return 0;
203
204 /* only take the minimum amount of data it is safe to take */
205 actual_length = min3((size_t)ret - offsetof(struct u2f_hid_msg,
206 init.data), U2F_HID_MSG_LEN(resp), max);
207
208 memcpy(data, resp.init.data, actual_length);
209
210 return actual_length;
211}
212
213static int u2fzero_init_led(struct u2fzero_device *dev,
214 unsigned int minor)
215{
216 dev->led_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
217 "%s%u", DRIVER_SHORT, minor);
218 if (dev->led_name == NULL)
219 return -ENOMEM;
220
221 dev->ldev.name = dev->led_name;
222 dev->ldev.max_brightness = LED_ON;
223 dev->ldev.flags = LED_HW_PLUGGABLE;
224 dev->ldev.brightness_set_blocking = u2fzero_brightness_set;
225
226 return devm_led_classdev_register(&dev->hdev->dev, &dev->ldev);
227}
228
229static int u2fzero_init_hwrng(struct u2fzero_device *dev,
230 unsigned int minor)
231{
232 dev->rng_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
233 "%s-rng%u", DRIVER_SHORT, minor);
234 if (dev->rng_name == NULL)
235 return -ENOMEM;
236
237 dev->hwrng.name = dev->rng_name;
238 dev->hwrng.read = u2fzero_rng_read;
239 dev->hwrng.quality = 1;
240
241 return devm_hwrng_register(&dev->hdev->dev, &dev->hwrng);
242}
243
244static int u2fzero_fill_in_urb(struct u2fzero_device *dev)
245{
246 struct hid_device *hdev = dev->hdev;
247 struct usb_device *udev;
248 struct usbhid_device *usbhid = hdev->driver_data;
249 unsigned int pipe_in;
250 struct usb_host_endpoint *ep;
251
252 if (dev->hdev->bus != BUS_USB)
253 return -EINVAL;
254
255 udev = hid_to_usb_dev(hdev);
256
257 if (!usbhid->urbout || !usbhid->urbin)
258 return -ENODEV;
259
260 ep = usb_pipe_endpoint(udev, usbhid->urbin->pipe);
261 if (!ep)
262 return -ENODEV;
263
264 dev->urb = usb_alloc_urb(0, GFP_KERNEL);
265 if (!dev->urb)
266 return -ENOMEM;
267
268 pipe_in = (usbhid->urbin->pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
269
270 usb_fill_int_urb(dev->urb,
271 udev,
272 pipe_in,
273 dev->buf_in,
274 HID_REPORT_SIZE,
275 u2fzero_read_callback,
276 NULL,
277 ep->desc.bInterval);
278
279 return 0;
280}
281
282static int u2fzero_probe(struct hid_device *hdev,
283 const struct hid_device_id *id)
284{
285 struct u2fzero_device *dev;
286 unsigned int minor;
287 int ret;
288
289 if (!hid_is_using_ll_driver(hdev, &usb_hid_driver))
290 return -EINVAL;
291
292 dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL);
293 if (dev == NULL)
294 return -ENOMEM;
295
296 dev->buf_out = devm_kmalloc(&hdev->dev,
297 sizeof(struct u2f_hid_report), GFP_KERNEL);
298 if (dev->buf_out == NULL)
299 return -ENOMEM;
300
301 dev->buf_in = devm_kmalloc(&hdev->dev,
302 sizeof(struct u2f_hid_msg), GFP_KERNEL);
303 if (dev->buf_in == NULL)
304 return -ENOMEM;
305
306 ret = hid_parse(hdev);
307 if (ret)
308 return ret;
309
310 dev->hdev = hdev;
311 hid_set_drvdata(hdev, dev);
312 mutex_init(&dev->lock);
313
314 ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
315 if (ret)
316 return ret;
317
318 u2fzero_fill_in_urb(dev);
319
320 dev->present = true;
321
322 minor = ((struct hidraw *) hdev->hidraw)->minor;
323
324 ret = u2fzero_init_led(dev, minor);
325 if (ret) {
326 hid_hw_stop(hdev);
327 return ret;
328 }
329
330 hid_info(hdev, "U2F Zero LED initialised\n");
331
332 ret = u2fzero_init_hwrng(dev, minor);
333 if (ret) {
334 hid_hw_stop(hdev);
335 return ret;
336 }
337
338 hid_info(hdev, "U2F Zero RNG initialised\n");
339
340 return 0;
341}
342
343static void u2fzero_remove(struct hid_device *hdev)
344{
345 struct u2fzero_device *dev = hid_get_drvdata(hdev);
346
347 mutex_lock(&dev->lock);
348 dev->present = false;
349 mutex_unlock(&dev->lock);
350
351 hid_hw_stop(hdev);
352 usb_poison_urb(dev->urb);
353 usb_free_urb(dev->urb);
354}
355
356static const struct hid_device_id u2fzero_table[] = {
357 { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL,
358 USB_DEVICE_ID_U2F_ZERO) },
359 { }
360};
361MODULE_DEVICE_TABLE(hid, u2fzero_table);
362
363static struct hid_driver u2fzero_driver = {
364 .name = "hid-" DRIVER_SHORT,
365 .probe = u2fzero_probe,
366 .remove = u2fzero_remove,
367 .id_table = u2fzero_table,
368};
369
370module_hid_driver(u2fzero_driver);
371
372MODULE_LICENSE("GPL");
373MODULE_AUTHOR("Andrej Shadura <andrew@shadura.me>");
374MODULE_DESCRIPTION("U2F Zero LED and RNG driver");
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * U2F Zero LED and RNG driver
4 *
5 * Copyright 2018 Andrej Shadura <andrew@shadura.me>
6 * Loosely based on drivers/hid/hid-led.c
7 * and drivers/usb/misc/chaoskey.c
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2.
12 */
13
14#include <linux/hid.h>
15#include <linux/hidraw.h>
16#include <linux/hw_random.h>
17#include <linux/leds.h>
18#include <linux/module.h>
19#include <linux/mutex.h>
20#include <linux/usb.h>
21
22#include "usbhid/usbhid.h"
23#include "hid-ids.h"
24
25#define DRIVER_SHORT "u2fzero"
26
27#define HID_REPORT_SIZE 64
28
29enum hw_revision {
30 HW_U2FZERO,
31 HW_NITROKEY_U2F,
32};
33
34struct hw_revision_config {
35 u8 rng_cmd;
36 u8 wink_cmd;
37 const char *name;
38};
39
40static const struct hw_revision_config hw_configs[] = {
41 [HW_U2FZERO] = {
42 .rng_cmd = 0x21,
43 .wink_cmd = 0x24,
44 .name = "U2F Zero",
45 },
46 [HW_NITROKEY_U2F] = {
47 .rng_cmd = 0xc0,
48 .wink_cmd = 0xc2,
49 .name = "NitroKey U2F",
50 },
51};
52
53/* We only use broadcast (CID-less) messages */
54#define CID_BROADCAST 0xffffffff
55
56struct u2f_hid_msg {
57 u32 cid;
58 union {
59 struct {
60 u8 cmd;
61 u8 bcnth;
62 u8 bcntl;
63 u8 data[HID_REPORT_SIZE - 7];
64 } init;
65 struct {
66 u8 seq;
67 u8 data[HID_REPORT_SIZE - 5];
68 } cont;
69 };
70} __packed;
71
72struct u2f_hid_report {
73 u8 report_type;
74 struct u2f_hid_msg msg;
75} __packed;
76
77#define U2F_HID_MSG_LEN(f) (size_t)(((f).init.bcnth << 8) + (f).init.bcntl)
78
79struct u2fzero_device {
80 struct hid_device *hdev;
81 struct urb *urb; /* URB for the RNG data */
82 struct led_classdev ldev; /* Embedded struct for led */
83 struct hwrng hwrng; /* Embedded struct for hwrng */
84 char *led_name;
85 char *rng_name;
86 u8 *buf_out;
87 u8 *buf_in;
88 struct mutex lock;
89 bool present;
90 kernel_ulong_t hw_revision;
91};
92
93static int u2fzero_send(struct u2fzero_device *dev, struct u2f_hid_report *req)
94{
95 int ret;
96
97 mutex_lock(&dev->lock);
98
99 memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
100
101 ret = hid_hw_output_report(dev->hdev, dev->buf_out,
102 sizeof(struct u2f_hid_msg));
103
104 mutex_unlock(&dev->lock);
105
106 if (ret < 0)
107 return ret;
108
109 return ret == sizeof(struct u2f_hid_msg) ? 0 : -EMSGSIZE;
110}
111
112struct u2fzero_transfer_context {
113 struct completion done;
114 int status;
115};
116
117static void u2fzero_read_callback(struct urb *urb)
118{
119 struct u2fzero_transfer_context *ctx = urb->context;
120
121 ctx->status = urb->status;
122 complete(&ctx->done);
123}
124
125static int u2fzero_recv(struct u2fzero_device *dev,
126 struct u2f_hid_report *req,
127 struct u2f_hid_msg *resp)
128{
129 int ret;
130 struct hid_device *hdev = dev->hdev;
131 struct u2fzero_transfer_context ctx;
132
133 mutex_lock(&dev->lock);
134
135 memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
136
137 dev->urb->context = &ctx;
138 init_completion(&ctx.done);
139
140 ret = usb_submit_urb(dev->urb, GFP_NOIO);
141 if (unlikely(ret)) {
142 hid_err(hdev, "usb_submit_urb failed: %d", ret);
143 goto err;
144 }
145
146 ret = hid_hw_output_report(dev->hdev, dev->buf_out,
147 sizeof(struct u2f_hid_msg));
148
149 if (ret < 0) {
150 hid_err(hdev, "hid_hw_output_report failed: %d", ret);
151 goto err;
152 }
153
154 ret = (wait_for_completion_timeout(
155 &ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT)));
156 if (ret == 0) {
157 usb_kill_urb(dev->urb);
158 hid_err(hdev, "urb submission timed out");
159 } else {
160 ret = dev->urb->actual_length;
161 memcpy(resp, dev->buf_in, ret);
162 }
163
164err:
165 mutex_unlock(&dev->lock);
166
167 return ret;
168}
169
170static int u2fzero_blink(struct led_classdev *ldev)
171{
172 struct u2fzero_device *dev = container_of(ldev,
173 struct u2fzero_device, ldev);
174 struct u2f_hid_report req = {
175 .report_type = 0,
176 .msg.cid = CID_BROADCAST,
177 .msg.init = {
178 .cmd = hw_configs[dev->hw_revision].wink_cmd,
179 .bcnth = 0,
180 .bcntl = 0,
181 .data = {0},
182 }
183 };
184 return u2fzero_send(dev, &req);
185}
186
187static int u2fzero_brightness_set(struct led_classdev *ldev,
188 enum led_brightness brightness)
189{
190 ldev->brightness = LED_OFF;
191 if (brightness)
192 return u2fzero_blink(ldev);
193 else
194 return 0;
195}
196
197static int u2fzero_rng_read(struct hwrng *rng, void *data,
198 size_t max, bool wait)
199{
200 struct u2fzero_device *dev = container_of(rng,
201 struct u2fzero_device, hwrng);
202 struct u2f_hid_report req = {
203 .report_type = 0,
204 .msg.cid = CID_BROADCAST,
205 .msg.init = {
206 .cmd = hw_configs[dev->hw_revision].rng_cmd,
207 .bcnth = 0,
208 .bcntl = 0,
209 .data = {0},
210 }
211 };
212 struct u2f_hid_msg resp;
213 int ret;
214 size_t actual_length;
215 /* valid packets must have a correct header */
216 int min_length = offsetof(struct u2f_hid_msg, init.data);
217
218 if (!dev->present) {
219 hid_dbg(dev->hdev, "device not present");
220 return 0;
221 }
222
223 ret = u2fzero_recv(dev, &req, &resp);
224
225 /* ignore errors or packets without data */
226 if (ret < min_length)
227 return 0;
228
229 /* only take the minimum amount of data it is safe to take */
230 actual_length = min3((size_t)ret - min_length,
231 U2F_HID_MSG_LEN(resp), max);
232
233 memcpy(data, resp.init.data, actual_length);
234
235 return actual_length;
236}
237
238static int u2fzero_init_led(struct u2fzero_device *dev,
239 unsigned int minor)
240{
241 dev->led_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
242 "%s%u", DRIVER_SHORT, minor);
243 if (dev->led_name == NULL)
244 return -ENOMEM;
245
246 dev->ldev.name = dev->led_name;
247 dev->ldev.max_brightness = LED_ON;
248 dev->ldev.flags = LED_HW_PLUGGABLE;
249 dev->ldev.brightness_set_blocking = u2fzero_brightness_set;
250
251 return devm_led_classdev_register(&dev->hdev->dev, &dev->ldev);
252}
253
254static int u2fzero_init_hwrng(struct u2fzero_device *dev,
255 unsigned int minor)
256{
257 dev->rng_name = devm_kasprintf(&dev->hdev->dev, GFP_KERNEL,
258 "%s-rng%u", DRIVER_SHORT, minor);
259 if (dev->rng_name == NULL)
260 return -ENOMEM;
261
262 dev->hwrng.name = dev->rng_name;
263 dev->hwrng.read = u2fzero_rng_read;
264
265 return devm_hwrng_register(&dev->hdev->dev, &dev->hwrng);
266}
267
268static int u2fzero_fill_in_urb(struct u2fzero_device *dev)
269{
270 struct hid_device *hdev = dev->hdev;
271 struct usb_device *udev;
272 struct usbhid_device *usbhid = hdev->driver_data;
273 unsigned int pipe_in;
274 struct usb_host_endpoint *ep;
275
276 if (dev->hdev->bus != BUS_USB)
277 return -EINVAL;
278
279 udev = hid_to_usb_dev(hdev);
280
281 if (!usbhid->urbout || !usbhid->urbin)
282 return -ENODEV;
283
284 ep = usb_pipe_endpoint(udev, usbhid->urbin->pipe);
285 if (!ep)
286 return -ENODEV;
287
288 dev->urb = usb_alloc_urb(0, GFP_KERNEL);
289 if (!dev->urb)
290 return -ENOMEM;
291
292 pipe_in = (usbhid->urbin->pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
293
294 usb_fill_int_urb(dev->urb,
295 udev,
296 pipe_in,
297 dev->buf_in,
298 HID_REPORT_SIZE,
299 u2fzero_read_callback,
300 NULL,
301 ep->desc.bInterval);
302
303 return 0;
304}
305
306static int u2fzero_probe(struct hid_device *hdev,
307 const struct hid_device_id *id)
308{
309 struct u2fzero_device *dev;
310 unsigned int minor;
311 int ret;
312
313 if (!hid_is_usb(hdev))
314 return -EINVAL;
315
316 dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL);
317 if (dev == NULL)
318 return -ENOMEM;
319
320 dev->hw_revision = id->driver_data;
321
322 dev->buf_out = devm_kmalloc(&hdev->dev,
323 sizeof(struct u2f_hid_report), GFP_KERNEL);
324 if (dev->buf_out == NULL)
325 return -ENOMEM;
326
327 dev->buf_in = devm_kmalloc(&hdev->dev,
328 sizeof(struct u2f_hid_msg), GFP_KERNEL);
329 if (dev->buf_in == NULL)
330 return -ENOMEM;
331
332 ret = hid_parse(hdev);
333 if (ret)
334 return ret;
335
336 dev->hdev = hdev;
337 hid_set_drvdata(hdev, dev);
338 mutex_init(&dev->lock);
339
340 ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
341 if (ret)
342 return ret;
343
344 u2fzero_fill_in_urb(dev);
345
346 dev->present = true;
347
348 minor = ((struct hidraw *) hdev->hidraw)->minor;
349
350 ret = u2fzero_init_led(dev, minor);
351 if (ret) {
352 hid_hw_stop(hdev);
353 return ret;
354 }
355
356 hid_info(hdev, "%s LED initialised\n", hw_configs[dev->hw_revision].name);
357
358 ret = u2fzero_init_hwrng(dev, minor);
359 if (ret) {
360 hid_hw_stop(hdev);
361 return ret;
362 }
363
364 hid_info(hdev, "%s RNG initialised\n", hw_configs[dev->hw_revision].name);
365
366 return 0;
367}
368
369static void u2fzero_remove(struct hid_device *hdev)
370{
371 struct u2fzero_device *dev = hid_get_drvdata(hdev);
372
373 mutex_lock(&dev->lock);
374 dev->present = false;
375 mutex_unlock(&dev->lock);
376
377 hid_hw_stop(hdev);
378 usb_poison_urb(dev->urb);
379 usb_free_urb(dev->urb);
380}
381
382static const struct hid_device_id u2fzero_table[] = {
383 { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL,
384 USB_DEVICE_ID_U2F_ZERO),
385 .driver_data = HW_U2FZERO },
386 { HID_USB_DEVICE(USB_VENDOR_ID_CLAY_LOGIC,
387 USB_DEVICE_ID_NITROKEY_U2F),
388 .driver_data = HW_NITROKEY_U2F },
389 { }
390};
391MODULE_DEVICE_TABLE(hid, u2fzero_table);
392
393static struct hid_driver u2fzero_driver = {
394 .name = "hid-" DRIVER_SHORT,
395 .probe = u2fzero_probe,
396 .remove = u2fzero_remove,
397 .id_table = u2fzero_table,
398};
399
400module_hid_driver(u2fzero_driver);
401
402MODULE_LICENSE("GPL");
403MODULE_AUTHOR("Andrej Shadura <andrew@shadura.me>");
404MODULE_DESCRIPTION("U2F Zero LED and RNG driver");