1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2022-2023 Vladimir Kondratyev <wulf@FreeBSD.org>
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28 #include "opt_hid.h"
29
30 #include <sys/param.h>
31 #ifdef COMPAT_FREEBSD32
32 #include <sys/abi_compat.h>
33 #endif
34 #include <sys/bus.h>
35 #include <sys/conf.h>
36 #include <sys/fcntl.h>
37 #include <sys/filio.h>
38 #include <sys/ioccom.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/malloc.h>
42 #include <sys/module.h>
43 #include <sys/mutex.h>
44 #include <sys/poll.h>
45 #include <sys/priv.h>
46 #include <sys/proc.h>
47 #include <sys/selinfo.h>
48 #include <sys/sysctl.h>
49 #include <sys/systm.h>
50 #include <sys/taskqueue.h>
51 #include <sys/uio.h>
52
53 #include <dev/evdev/input.h>
54
55 #define HID_DEBUG_VAR u2f_debug
56 #include <dev/hid/hid.h>
57 #include <dev/hid/hidbus.h>
58 #include <dev/hid/hidquirk.h>
59
60 #include <dev/usb/usb_ioctl.h>
61
62 #ifdef HID_DEBUG
63 static int u2f_debug = 0;
64 static SYSCTL_NODE(_hw_hid, OID_AUTO, u2f, CTLFLAG_RW, 0,
65 "FIDO/U2F authenticator");
66 SYSCTL_INT(_hw_hid_u2f, OID_AUTO, debug, CTLFLAG_RWTUN,
67 &u2f_debug, 0, "Debug level");
68 #endif
69
70 #define U2F_MAX_REPORT_SIZE 64
71
72 /* A match on these entries will load u2f */
73 static const struct hid_device_id u2f_devs[] = {
74 { HID_BUS(BUS_USB), HID_TLC(HUP_FIDO, HUF_U2FHID) },
75 };
76
77 struct u2f_softc {
78 device_t sc_dev; /* base device */
79 struct cdev *dev;
80
81 struct mtx sc_mtx; /* hidbus private mutex */
82 struct task sc_kqtask; /* kqueue task */
83 void *sc_rdesc;
84 hid_size_t sc_rdesc_size;
85 hid_size_t sc_isize;
86 hid_size_t sc_osize;
87 struct selinfo sc_rsel;
88 struct { /* driver state */
89 bool open:1; /* device is open */
90 bool aslp:1; /* waiting for device data in read() */
91 bool sel:1; /* waiting for device data in poll() */
92 bool data:1; /* input report is stored in sc_buf */
93 int reserved:28;
94 } sc_state;
95 int sc_fflags; /* access mode for open lifetime */
96
97 uint8_t sc_buf[U2F_MAX_REPORT_SIZE];
98 };
99
100 static d_open_t u2f_open;
101 static d_read_t u2f_read;
102 static d_write_t u2f_write;
103 static d_ioctl_t u2f_ioctl;
104 static d_poll_t u2f_poll;
105 static d_kqfilter_t u2f_kqfilter;
106
107 static d_priv_dtor_t u2f_dtor;
108
109 static struct cdevsw u2f_cdevsw = {
110 .d_version = D_VERSION,
111 .d_open = u2f_open,
112 .d_read = u2f_read,
113 .d_write = u2f_write,
114 .d_ioctl = u2f_ioctl,
115 .d_poll = u2f_poll,
116 .d_kqfilter = u2f_kqfilter,
117 .d_name = "u2f",
118 };
119
120 static hid_intr_t u2f_intr;
121
122 static device_probe_t u2f_probe;
123 static device_attach_t u2f_attach;
124 static device_detach_t u2f_detach;
125
126 static void u2f_kqtask(void *context, int pending);
127 static int u2f_kqread(struct knote *, long);
128 static void u2f_kqdetach(struct knote *);
129 static void u2f_notify(struct u2f_softc *);
130
131 static struct filterops u2f_filterops_read = {
132 .f_isfd = 1,
133 .f_detach = u2f_kqdetach,
134 .f_event = u2f_kqread,
135 .f_copy = knote_triv_copy,
136 };
137
138 static int
u2f_probe(device_t dev)139 u2f_probe(device_t dev)
140 {
141 int error;
142
143 error = HIDBUS_LOOKUP_DRIVER_INFO(dev, u2f_devs);
144 if (error != 0)
145 return (error);
146
147 hidbus_set_desc(dev, "Authenticator");
148
149 return (BUS_PROBE_GENERIC);
150 }
151
152 static int
u2f_attach(device_t dev)153 u2f_attach(device_t dev)
154 {
155 struct u2f_softc *sc = device_get_softc(dev);
156 struct hid_device_info *hw = __DECONST(struct hid_device_info *,
157 hid_get_device_info(dev));
158 struct make_dev_args mda;
159 int error;
160
161 sc->sc_dev = dev;
162
163 error = hid_get_report_descr(dev, &sc->sc_rdesc, &sc->sc_rdesc_size);
164 if (error != 0)
165 return (ENXIO);
166 sc->sc_isize = hid_report_size_max(sc->sc_rdesc, sc->sc_rdesc_size,
167 hid_input, NULL);
168 if (sc->sc_isize > U2F_MAX_REPORT_SIZE) {
169 device_printf(dev, "Input report size too large. Truncate.\n");
170 sc->sc_isize = U2F_MAX_REPORT_SIZE;
171 }
172 sc->sc_osize = hid_report_size_max(sc->sc_rdesc, sc->sc_rdesc_size,
173 hid_output, NULL);
174 if (sc->sc_osize > U2F_MAX_REPORT_SIZE) {
175 device_printf(dev, "Output report size too large. Truncate.\n");
176 sc->sc_osize = U2F_MAX_REPORT_SIZE;
177 }
178
179 mtx_init(&sc->sc_mtx, "u2f lock", NULL, MTX_DEF);
180 knlist_init_mtx(&sc->sc_rsel.si_note, &sc->sc_mtx);
181 TASK_INIT(&sc->sc_kqtask, 0, u2f_kqtask, sc);
182
183 make_dev_args_init(&mda);
184 mda.mda_flags = MAKEDEV_WAITOK;
185 mda.mda_devsw = &u2f_cdevsw;
186 mda.mda_uid = UID_ROOT;
187 mda.mda_gid = GID_U2F;
188 mda.mda_mode = 0660;
189 mda.mda_si_drv1 = sc;
190
191 error = make_dev_s(&mda, &sc->dev, "u2f/%d", device_get_unit(dev));
192 if (error) {
193 device_printf(dev, "Can not create character device\n");
194 u2f_detach(dev);
195 return (error);
196 }
197 #ifndef U2F_DROP_UHID_ALIAS
198 (void)make_dev_alias(sc->dev, "uhid%d", device_get_unit(dev));
199 #endif
200
201 hid_add_dynamic_quirk(hw, HQ_NO_READAHEAD);
202
203 hidbus_set_lock(dev, &sc->sc_mtx);
204 hidbus_set_intr(dev, u2f_intr, sc);
205
206 return (0);
207 }
208
209 static int
u2f_detach(device_t dev)210 u2f_detach(device_t dev)
211 {
212 struct u2f_softc *sc = device_get_softc(dev);
213
214 DPRINTF("sc=%p\n", sc);
215
216 if (sc->dev != NULL) {
217 mtx_lock(&sc->sc_mtx);
218 sc->dev->si_drv1 = NULL;
219 /* Wake everyone */
220 u2f_notify(sc);
221 mtx_unlock(&sc->sc_mtx);
222 destroy_dev(sc->dev);
223 }
224
225 taskqueue_drain(taskqueue_thread, &sc->sc_kqtask);
226
227 knlist_clear(&sc->sc_rsel.si_note, 0);
228 knlist_destroy(&sc->sc_rsel.si_note);
229 seldrain(&sc->sc_rsel);
230 mtx_destroy(&sc->sc_mtx);
231
232 return (0);
233 }
234
235 void
u2f_intr(void * context,void * buf,hid_size_t len)236 u2f_intr(void *context, void *buf, hid_size_t len)
237 {
238 struct u2f_softc *sc = context;
239
240 mtx_assert(&sc->sc_mtx, MA_OWNED);
241
242 DPRINTFN(5, "len=%d\n", len);
243 DPRINTFN(5, "data = %*D\n", len, buf, " ");
244
245 if (sc->sc_state.data)
246 return;
247
248 if (len > sc->sc_isize)
249 len = sc->sc_isize;
250
251 bcopy(buf, sc->sc_buf, len);
252
253 /* Make sure we don't process old data */
254 if (len < sc->sc_isize)
255 bzero(sc->sc_buf + len, sc->sc_isize - len);
256
257 sc->sc_state.data = true;
258
259 u2f_notify(sc);
260 }
261
262 static int
u2f_open(struct cdev * dev,int flag,int mode,struct thread * td)263 u2f_open(struct cdev *dev, int flag, int mode, struct thread *td)
264 {
265 struct u2f_softc *sc = dev->si_drv1;
266 int error;
267
268 if (sc == NULL)
269 return (ENXIO);
270
271 DPRINTF("sc=%p\n", sc);
272
273 mtx_lock(&sc->sc_mtx);
274 if (sc->sc_state.open) {
275 mtx_unlock(&sc->sc_mtx);
276 return (EBUSY);
277 }
278 sc->sc_state.open = true;
279 mtx_unlock(&sc->sc_mtx);
280
281 error = devfs_set_cdevpriv(sc, u2f_dtor);
282 if (error != 0) {
283 mtx_lock(&sc->sc_mtx);
284 sc->sc_state.open = false;
285 mtx_unlock(&sc->sc_mtx);
286 return (error);
287 }
288
289 /* Set up interrupt pipe. */
290 sc->sc_state.data = false;
291 sc->sc_fflags = flag;
292
293 return (0);
294 }
295
296
297 static void
u2f_dtor(void * data)298 u2f_dtor(void *data)
299 {
300 struct u2f_softc *sc = data;
301
302 /* Disable interrupts. */
303 hid_intr_stop(sc->sc_dev);
304
305 mtx_lock(&sc->sc_mtx);
306 sc->sc_state.open = false;
307 mtx_unlock(&sc->sc_mtx);
308 }
309
310 static int
u2f_read(struct cdev * dev,struct uio * uio,int flag)311 u2f_read(struct cdev *dev, struct uio *uio, int flag)
312 {
313 uint8_t buf[U2F_MAX_REPORT_SIZE];
314 struct u2f_softc *sc = dev->si_drv1;
315 size_t length = 0;
316 int error;
317
318 DPRINTFN(1, "\n");
319
320 if (sc == NULL)
321 return (EIO);
322
323 if (!sc->sc_state.data)
324 hid_intr_start(sc->sc_dev);
325
326 mtx_lock(&sc->sc_mtx);
327 if (dev->si_drv1 == NULL) {
328 error = EIO;
329 goto exit;
330 }
331
332 while (!sc->sc_state.data) {
333 if (flag & O_NONBLOCK) {
334 error = EWOULDBLOCK;
335 goto exit;
336 }
337 sc->sc_state.aslp = true;
338 DPRINTFN(5, "sleep on %p\n", &sc->sc_buf);
339 error = mtx_sleep(&sc->sc_buf, &sc->sc_mtx, PZERO | PCATCH,
340 "u2frd", 0);
341 DPRINTFN(5, "woke, error=%d\n", error);
342 if (dev->si_drv1 == NULL)
343 error = EIO;
344 if (error) {
345 sc->sc_state.aslp = false;
346 goto exit;
347 }
348 }
349
350 if (sc->sc_state.data && uio->uio_resid > 0) {
351 length = min(uio->uio_resid, sc->sc_isize);
352 memcpy(buf, sc->sc_buf, length);
353 sc->sc_state.data = false;
354 }
355 exit:
356 mtx_unlock(&sc->sc_mtx);
357 if (length != 0) {
358 /* Copy the data to the user process. */
359 DPRINTFN(5, "got %lu chars\n", (u_long)length);
360 error = uiomove(buf, length, uio);
361 }
362
363 return (error);
364 }
365
366 static int
u2f_write(struct cdev * dev,struct uio * uio,int flag)367 u2f_write(struct cdev *dev, struct uio *uio, int flag)
368 {
369 uint8_t buf[U2F_MAX_REPORT_SIZE];
370 struct u2f_softc *sc = dev->si_drv1;
371 int error;
372
373 DPRINTFN(1, "\n");
374
375 if (sc == NULL)
376 return (EIO);
377
378 if (uio->uio_resid != sc->sc_osize)
379 return (EINVAL);
380 error = uiomove(buf, uio->uio_resid, uio);
381 if (error == 0)
382 error = hid_write(sc->sc_dev, buf, sc->sc_osize);
383
384 return (error);
385 }
386
387 #ifdef COMPAT_FREEBSD32
388 static void
update_ugd32(const struct usb_gen_descriptor * ugd,struct usb_gen_descriptor32 * ugd32)389 update_ugd32(const struct usb_gen_descriptor *ugd,
390 struct usb_gen_descriptor32 *ugd32)
391 {
392 /* Don't update hgd_data pointer */
393 CP(*ugd, *ugd32, ugd_lang_id);
394 CP(*ugd, *ugd32, ugd_maxlen);
395 CP(*ugd, *ugd32, ugd_actlen);
396 CP(*ugd, *ugd32, ugd_offset);
397 CP(*ugd, *ugd32, ugd_config_index);
398 CP(*ugd, *ugd32, ugd_string_index);
399 CP(*ugd, *ugd32, ugd_iface_index);
400 CP(*ugd, *ugd32, ugd_altif_index);
401 CP(*ugd, *ugd32, ugd_endpt_index);
402 CP(*ugd, *ugd32, ugd_report_type);
403 /* Don't update reserved */
404 }
405 #endif
406
407 static int
u2f_ioctl(struct cdev * dev,u_long cmd,caddr_t addr,int flag,struct thread * td)408 u2f_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag,
409 struct thread *td)
410 {
411 #ifdef COMPAT_FREEBSD32
412 struct usb_gen_descriptor local_ugd;
413 struct usb_gen_descriptor32 *ugd32 = NULL;
414 #endif
415 struct u2f_softc *sc = dev->si_drv1;
416 struct usb_gen_descriptor *ugd = (struct usb_gen_descriptor *)addr;
417 uint32_t size;
418
419 DPRINTFN(2, "cmd=%lx\n", cmd);
420
421 if (sc == NULL)
422 return (EIO);
423
424 #ifdef COMPAT_FREEBSD32
425 switch (cmd) {
426 case USB_GET_REPORT_DESC32:
427 cmd = _IOC_NEWTYPE(cmd, struct usb_gen_descriptor);
428 ugd32 = (struct usb_gen_descriptor32 *)addr;
429 ugd = &local_ugd;
430 PTRIN_CP(*ugd32, *ugd, ugd_data);
431 CP(*ugd32, *ugd, ugd_lang_id);
432 CP(*ugd32, *ugd, ugd_maxlen);
433 CP(*ugd32, *ugd, ugd_actlen);
434 CP(*ugd32, *ugd, ugd_offset);
435 CP(*ugd32, *ugd, ugd_config_index);
436 CP(*ugd32, *ugd, ugd_string_index);
437 CP(*ugd32, *ugd, ugd_iface_index);
438 CP(*ugd32, *ugd, ugd_altif_index);
439 CP(*ugd32, *ugd, ugd_endpt_index);
440 CP(*ugd32, *ugd, ugd_report_type);
441 /* Don't copy reserved */
442 break;
443 }
444 #endif
445
446 /* fixed-length ioctls handling */
447 switch (cmd) {
448 case FIONBIO:
449 /* All handled in the upper FS layer. */
450 return (0);
451
452 case USB_GET_REPORT_DESC:
453 size = MIN(sc->sc_rdesc_size, ugd->ugd_maxlen);
454 ugd->ugd_actlen = size;
455 #ifdef COMPAT_FREEBSD32
456 if (ugd32 != NULL)
457 update_ugd32(ugd, ugd32);
458 #endif
459 if (ugd->ugd_data == NULL)
460 return (0); /* descriptor length only */
461
462 return (copyout(sc->sc_rdesc, ugd->ugd_data, size));
463
464 case USB_GET_DEVICEINFO:
465 return(hid_ioctl(
466 sc->sc_dev, USB_GET_DEVICEINFO, (uintptr_t)addr));
467 }
468
469 return (EINVAL);
470 }
471
472 static int
u2f_poll(struct cdev * dev,int events,struct thread * td)473 u2f_poll(struct cdev *dev, int events, struct thread *td)
474 {
475 struct u2f_softc *sc = dev->si_drv1;
476 int revents = 0;
477 bool start_intr = false;
478
479 if (sc == NULL)
480 return (POLLHUP);
481
482 if (events & (POLLOUT | POLLWRNORM) && (sc->sc_fflags & FWRITE))
483 revents |= events & (POLLOUT | POLLWRNORM);
484 if (events & (POLLIN | POLLRDNORM) && (sc->sc_fflags & FREAD)) {
485 mtx_lock(&sc->sc_mtx);
486 if (sc->sc_state.data)
487 revents |= events & (POLLIN | POLLRDNORM);
488 else {
489 sc->sc_state.sel = true;
490 start_intr = true;
491 selrecord(td, &sc->sc_rsel);
492 }
493 mtx_unlock(&sc->sc_mtx);
494 if (start_intr)
495 hid_intr_start(sc->sc_dev);
496 }
497
498 return (revents);
499 }
500
501 static int
u2f_kqfilter(struct cdev * dev,struct knote * kn)502 u2f_kqfilter(struct cdev *dev, struct knote *kn)
503 {
504 struct u2f_softc *sc = dev->si_drv1;
505
506 if (sc == NULL)
507 return (ENXIO);
508
509 switch(kn->kn_filter) {
510 case EVFILT_READ:
511 if (sc->sc_fflags & FREAD) {
512 kn->kn_fop = &u2f_filterops_read;
513 break;
514 }
515 /* FALLTHROUGH */
516 default:
517 return(EINVAL);
518 }
519 kn->kn_hook = sc;
520
521 knlist_add(&sc->sc_rsel.si_note, kn, 0);
522 return (0);
523 }
524
525 static void
u2f_kqtask(void * context,int pending)526 u2f_kqtask(void *context, int pending)
527 {
528 struct u2f_softc *sc = context;
529
530 hid_intr_start(sc->sc_dev);
531 }
532
533 static int
u2f_kqread(struct knote * kn,long hint)534 u2f_kqread(struct knote *kn, long hint)
535 {
536 struct u2f_softc *sc = kn->kn_hook;
537 int ret;
538
539 mtx_assert(&sc->sc_mtx, MA_OWNED);
540
541 if (sc->dev->si_drv1 == NULL) {
542 kn->kn_flags |= EV_EOF;
543 ret = 1;
544 } else {
545 ret = sc->sc_state.data ? 1 : 0;
546 if (!sc->sc_state.data)
547 taskqueue_enqueue(taskqueue_thread, &sc->sc_kqtask);
548 }
549
550 return (ret);
551 }
552
553 static void
u2f_kqdetach(struct knote * kn)554 u2f_kqdetach(struct knote *kn)
555 {
556 struct u2f_softc *sc = kn->kn_hook;
557
558 knlist_remove(&sc->sc_rsel.si_note, kn, 0);
559 }
560
561 static void
u2f_notify(struct u2f_softc * sc)562 u2f_notify(struct u2f_softc *sc)
563 {
564 mtx_assert(&sc->sc_mtx, MA_OWNED);
565
566 if (sc->sc_state.aslp) {
567 sc->sc_state.aslp = false;
568 DPRINTFN(5, "waking %p\n", &sc->sc_buf);
569 wakeup(&sc->sc_buf);
570 }
571 if (sc->sc_state.sel) {
572 sc->sc_state.sel = false;
573 selwakeuppri(&sc->sc_rsel, PZERO);
574 }
575 KNOTE_LOCKED(&sc->sc_rsel.si_note, 0);
576 }
577
578 static device_method_t u2f_methods[] = {
579 /* Device interface */
580 DEVMETHOD(device_probe, u2f_probe),
581 DEVMETHOD(device_attach, u2f_attach),
582 DEVMETHOD(device_detach, u2f_detach),
583
584 DEVMETHOD_END
585 };
586
587 static driver_t u2f_driver = {
588 #ifdef U2F_DROP_UHID_ALIAS
589 "uf2",
590 #else
591 "uhid",
592 #endif
593 u2f_methods,
594 sizeof(struct u2f_softc)
595 };
596
597 DRIVER_MODULE(u2f, hidbus, u2f_driver, NULL, NULL);
598 MODULE_DEPEND(u2f, hidbus, 1, 1, 1);
599 MODULE_DEPEND(u2f, hid, 1, 1, 1);
600 MODULE_VERSION(u2f, 1);
601 HID_PNP_INFO(u2f_devs);
602