1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2022-2023 Vladimir Kondratyev <wulf@FreeBSD.org> 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include "opt_hid.h" 29 30 #include <sys/param.h> 31 #ifdef COMPAT_FREEBSD32 32 #include <sys/abi_compat.h> 33 #endif 34 #include <sys/bus.h> 35 #include <sys/conf.h> 36 #include <sys/fcntl.h> 37 #include <sys/filio.h> 38 #include <sys/ioccom.h> 39 #include <sys/kernel.h> 40 #include <sys/lock.h> 41 #include <sys/malloc.h> 42 #include <sys/module.h> 43 #include <sys/mutex.h> 44 #include <sys/poll.h> 45 #include <sys/priv.h> 46 #include <sys/proc.h> 47 #include <sys/selinfo.h> 48 #include <sys/sysctl.h> 49 #include <sys/systm.h> 50 #include <sys/taskqueue.h> 51 #include <sys/uio.h> 52 53 #include <dev/evdev/input.h> 54 55 #define HID_DEBUG_VAR u2f_debug 56 #include <dev/hid/hid.h> 57 #include <dev/hid/hidbus.h> 58 #include <dev/hid/hidquirk.h> 59 60 #include <dev/usb/usb_ioctl.h> 61 62 #ifdef HID_DEBUG 63 static int u2f_debug = 0; 64 static SYSCTL_NODE(_hw_hid, OID_AUTO, u2f, CTLFLAG_RW, 0, 65 "FIDO/U2F authenticator"); 66 SYSCTL_INT(_hw_hid_u2f, OID_AUTO, debug, CTLFLAG_RWTUN, 67 &u2f_debug, 0, "Debug level"); 68 #endif 69 70 #define U2F_MAX_REPORT_SIZE 64 71 72 /* A match on these entries will load u2f */ 73 static const struct hid_device_id u2f_devs[] = { 74 { HID_BUS(BUS_USB), HID_TLC(HUP_FIDO, HUF_U2FHID) }, 75 }; 76 77 struct u2f_softc { 78 device_t sc_dev; /* base device */ 79 struct cdev *dev; 80 81 struct mtx sc_mtx; /* hidbus private mutex */ 82 struct task sc_kqtask; /* kqueue task */ 83 void *sc_rdesc; 84 hid_size_t sc_rdesc_size; 85 hid_size_t sc_isize; 86 hid_size_t sc_osize; 87 struct selinfo sc_rsel; 88 struct { /* driver state */ 89 bool open:1; /* device is open */ 90 bool aslp:1; /* waiting for device data in read() */ 91 bool sel:1; /* waiting for device data in poll() */ 92 bool data:1; /* input report is stored in sc_buf */ 93 int reserved:28; 94 } sc_state; 95 int sc_fflags; /* access mode for open lifetime */ 96 97 uint8_t sc_buf[U2F_MAX_REPORT_SIZE]; 98 }; 99 100 static d_open_t u2f_open; 101 static d_read_t u2f_read; 102 static d_write_t u2f_write; 103 static d_ioctl_t u2f_ioctl; 104 static d_poll_t u2f_poll; 105 static d_kqfilter_t u2f_kqfilter; 106 107 static d_priv_dtor_t u2f_dtor; 108 109 static struct cdevsw u2f_cdevsw = { 110 .d_version = D_VERSION, 111 .d_open = u2f_open, 112 .d_read = u2f_read, 113 .d_write = u2f_write, 114 .d_ioctl = u2f_ioctl, 115 .d_poll = u2f_poll, 116 .d_kqfilter = u2f_kqfilter, 117 .d_name = "u2f", 118 }; 119 120 static hid_intr_t u2f_intr; 121 122 static device_probe_t u2f_probe; 123 static device_attach_t u2f_attach; 124 static device_detach_t u2f_detach; 125 126 static void u2f_kqtask(void *context, int pending); 127 static int u2f_kqread(struct knote *, long); 128 static void u2f_kqdetach(struct knote *); 129 static void u2f_notify(struct u2f_softc *); 130 131 static struct filterops u2f_filterops_read = { 132 .f_isfd = 1, 133 .f_detach = u2f_kqdetach, 134 .f_event = u2f_kqread, 135 .f_copy = knote_triv_copy, 136 }; 137 138 static int 139 u2f_probe(device_t dev) 140 { 141 int error; 142 143 error = HIDBUS_LOOKUP_DRIVER_INFO(dev, u2f_devs); 144 if (error != 0) 145 return (error); 146 147 hidbus_set_desc(dev, "Authenticator"); 148 149 return (BUS_PROBE_GENERIC); 150 } 151 152 static int 153 u2f_attach(device_t dev) 154 { 155 struct u2f_softc *sc = device_get_softc(dev); 156 struct hid_device_info *hw = __DECONST(struct hid_device_info *, 157 hid_get_device_info(dev)); 158 struct make_dev_args mda; 159 int error; 160 161 sc->sc_dev = dev; 162 163 error = hid_get_report_descr(dev, &sc->sc_rdesc, &sc->sc_rdesc_size); 164 if (error != 0) 165 return (ENXIO); 166 sc->sc_isize = hid_report_size_max(sc->sc_rdesc, sc->sc_rdesc_size, 167 hid_input, NULL); 168 if (sc->sc_isize > U2F_MAX_REPORT_SIZE) { 169 device_printf(dev, "Input report size too large. Truncate.\n"); 170 sc->sc_isize = U2F_MAX_REPORT_SIZE; 171 } 172 sc->sc_osize = hid_report_size_max(sc->sc_rdesc, sc->sc_rdesc_size, 173 hid_output, NULL); 174 if (sc->sc_osize > U2F_MAX_REPORT_SIZE) { 175 device_printf(dev, "Output report size too large. Truncate.\n"); 176 sc->sc_osize = U2F_MAX_REPORT_SIZE; 177 } 178 179 mtx_init(&sc->sc_mtx, "u2f lock", NULL, MTX_DEF); 180 knlist_init_mtx(&sc->sc_rsel.si_note, &sc->sc_mtx); 181 TASK_INIT(&sc->sc_kqtask, 0, u2f_kqtask, sc); 182 183 make_dev_args_init(&mda); 184 mda.mda_flags = MAKEDEV_WAITOK; 185 mda.mda_devsw = &u2f_cdevsw; 186 mda.mda_uid = UID_ROOT; 187 mda.mda_gid = GID_U2F; 188 mda.mda_mode = 0660; 189 mda.mda_si_drv1 = sc; 190 191 error = make_dev_s(&mda, &sc->dev, "u2f/%d", device_get_unit(dev)); 192 if (error) { 193 device_printf(dev, "Can not create character device\n"); 194 u2f_detach(dev); 195 return (error); 196 } 197 #ifndef U2F_DROP_UHID_ALIAS 198 (void)make_dev_alias(sc->dev, "uhid%d", device_get_unit(dev)); 199 #endif 200 201 hid_add_dynamic_quirk(hw, HQ_NO_READAHEAD); 202 203 hidbus_set_lock(dev, &sc->sc_mtx); 204 hidbus_set_intr(dev, u2f_intr, sc); 205 206 return (0); 207 } 208 209 static int 210 u2f_detach(device_t dev) 211 { 212 struct u2f_softc *sc = device_get_softc(dev); 213 214 DPRINTF("sc=%p\n", sc); 215 216 if (sc->dev != NULL) { 217 mtx_lock(&sc->sc_mtx); 218 sc->dev->si_drv1 = NULL; 219 /* Wake everyone */ 220 u2f_notify(sc); 221 mtx_unlock(&sc->sc_mtx); 222 destroy_dev(sc->dev); 223 } 224 225 taskqueue_drain(taskqueue_thread, &sc->sc_kqtask); 226 227 knlist_clear(&sc->sc_rsel.si_note, 0); 228 knlist_destroy(&sc->sc_rsel.si_note); 229 seldrain(&sc->sc_rsel); 230 mtx_destroy(&sc->sc_mtx); 231 232 return (0); 233 } 234 235 void 236 u2f_intr(void *context, void *buf, hid_size_t len) 237 { 238 struct u2f_softc *sc = context; 239 240 mtx_assert(&sc->sc_mtx, MA_OWNED); 241 242 DPRINTFN(5, "len=%d\n", len); 243 DPRINTFN(5, "data = %*D\n", len, buf, " "); 244 245 if (sc->sc_state.data) 246 return; 247 248 if (len > sc->sc_isize) 249 len = sc->sc_isize; 250 251 bcopy(buf, sc->sc_buf, len); 252 253 /* Make sure we don't process old data */ 254 if (len < sc->sc_isize) 255 bzero(sc->sc_buf + len, sc->sc_isize - len); 256 257 sc->sc_state.data = true; 258 259 u2f_notify(sc); 260 } 261 262 static int 263 u2f_open(struct cdev *dev, int flag, int mode, struct thread *td) 264 { 265 struct u2f_softc *sc = dev->si_drv1; 266 int error; 267 268 if (sc == NULL) 269 return (ENXIO); 270 271 DPRINTF("sc=%p\n", sc); 272 273 mtx_lock(&sc->sc_mtx); 274 if (sc->sc_state.open) { 275 mtx_unlock(&sc->sc_mtx); 276 return (EBUSY); 277 } 278 sc->sc_state.open = true; 279 mtx_unlock(&sc->sc_mtx); 280 281 error = devfs_set_cdevpriv(sc, u2f_dtor); 282 if (error != 0) { 283 mtx_lock(&sc->sc_mtx); 284 sc->sc_state.open = false; 285 mtx_unlock(&sc->sc_mtx); 286 return (error); 287 } 288 289 /* Set up interrupt pipe. */ 290 sc->sc_state.data = false; 291 sc->sc_fflags = flag; 292 293 return (0); 294 } 295 296 297 static void 298 u2f_dtor(void *data) 299 { 300 struct u2f_softc *sc = data; 301 302 /* Disable interrupts. */ 303 hid_intr_stop(sc->sc_dev); 304 305 mtx_lock(&sc->sc_mtx); 306 sc->sc_state.open = false; 307 mtx_unlock(&sc->sc_mtx); 308 } 309 310 static int 311 u2f_read(struct cdev *dev, struct uio *uio, int flag) 312 { 313 uint8_t buf[U2F_MAX_REPORT_SIZE]; 314 struct u2f_softc *sc = dev->si_drv1; 315 size_t length = 0; 316 int error; 317 318 DPRINTFN(1, "\n"); 319 320 if (sc == NULL) 321 return (EIO); 322 323 if (!sc->sc_state.data) 324 hid_intr_start(sc->sc_dev); 325 326 mtx_lock(&sc->sc_mtx); 327 if (dev->si_drv1 == NULL) { 328 error = EIO; 329 goto exit; 330 } 331 332 while (!sc->sc_state.data) { 333 if (flag & O_NONBLOCK) { 334 error = EWOULDBLOCK; 335 goto exit; 336 } 337 sc->sc_state.aslp = true; 338 DPRINTFN(5, "sleep on %p\n", &sc->sc_buf); 339 error = mtx_sleep(&sc->sc_buf, &sc->sc_mtx, PZERO | PCATCH, 340 "u2frd", 0); 341 DPRINTFN(5, "woke, error=%d\n", error); 342 if (dev->si_drv1 == NULL) 343 error = EIO; 344 if (error) { 345 sc->sc_state.aslp = false; 346 goto exit; 347 } 348 } 349 350 if (sc->sc_state.data && uio->uio_resid > 0) { 351 length = min(uio->uio_resid, sc->sc_isize); 352 memcpy(buf, sc->sc_buf, length); 353 sc->sc_state.data = false; 354 } 355 exit: 356 mtx_unlock(&sc->sc_mtx); 357 if (length != 0) { 358 /* Copy the data to the user process. */ 359 DPRINTFN(5, "got %lu chars\n", (u_long)length); 360 error = uiomove(buf, length, uio); 361 } 362 363 return (error); 364 } 365 366 static int 367 u2f_write(struct cdev *dev, struct uio *uio, int flag) 368 { 369 uint8_t buf[U2F_MAX_REPORT_SIZE]; 370 struct u2f_softc *sc = dev->si_drv1; 371 int error; 372 373 DPRINTFN(1, "\n"); 374 375 if (sc == NULL) 376 return (EIO); 377 378 if (uio->uio_resid != sc->sc_osize) 379 return (EINVAL); 380 error = uiomove(buf, uio->uio_resid, uio); 381 if (error == 0) 382 error = hid_write(sc->sc_dev, buf, sc->sc_osize); 383 384 return (error); 385 } 386 387 #ifdef COMPAT_FREEBSD32 388 static void 389 update_ugd32(const struct usb_gen_descriptor *ugd, 390 struct usb_gen_descriptor32 *ugd32) 391 { 392 /* Don't update hgd_data pointer */ 393 CP(*ugd, *ugd32, ugd_lang_id); 394 CP(*ugd, *ugd32, ugd_maxlen); 395 CP(*ugd, *ugd32, ugd_actlen); 396 CP(*ugd, *ugd32, ugd_offset); 397 CP(*ugd, *ugd32, ugd_config_index); 398 CP(*ugd, *ugd32, ugd_string_index); 399 CP(*ugd, *ugd32, ugd_iface_index); 400 CP(*ugd, *ugd32, ugd_altif_index); 401 CP(*ugd, *ugd32, ugd_endpt_index); 402 CP(*ugd, *ugd32, ugd_report_type); 403 /* Don't update reserved */ 404 } 405 #endif 406 407 static int 408 u2f_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag, 409 struct thread *td) 410 { 411 #ifdef COMPAT_FREEBSD32 412 struct usb_gen_descriptor local_ugd; 413 struct usb_gen_descriptor32 *ugd32 = NULL; 414 #endif 415 struct u2f_softc *sc = dev->si_drv1; 416 struct usb_gen_descriptor *ugd = (struct usb_gen_descriptor *)addr; 417 uint32_t size; 418 419 DPRINTFN(2, "cmd=%lx\n", cmd); 420 421 if (sc == NULL) 422 return (EIO); 423 424 #ifdef COMPAT_FREEBSD32 425 switch (cmd) { 426 case USB_GET_REPORT_DESC32: 427 cmd = _IOC_NEWTYPE(cmd, struct usb_gen_descriptor); 428 ugd32 = (struct usb_gen_descriptor32 *)addr; 429 ugd = &local_ugd; 430 PTRIN_CP(*ugd32, *ugd, ugd_data); 431 CP(*ugd32, *ugd, ugd_lang_id); 432 CP(*ugd32, *ugd, ugd_maxlen); 433 CP(*ugd32, *ugd, ugd_actlen); 434 CP(*ugd32, *ugd, ugd_offset); 435 CP(*ugd32, *ugd, ugd_config_index); 436 CP(*ugd32, *ugd, ugd_string_index); 437 CP(*ugd32, *ugd, ugd_iface_index); 438 CP(*ugd32, *ugd, ugd_altif_index); 439 CP(*ugd32, *ugd, ugd_endpt_index); 440 CP(*ugd32, *ugd, ugd_report_type); 441 /* Don't copy reserved */ 442 break; 443 } 444 #endif 445 446 /* fixed-length ioctls handling */ 447 switch (cmd) { 448 case FIONBIO: 449 /* All handled in the upper FS layer. */ 450 return (0); 451 452 case USB_GET_REPORT_DESC: 453 size = MIN(sc->sc_rdesc_size, ugd->ugd_maxlen); 454 ugd->ugd_actlen = size; 455 #ifdef COMPAT_FREEBSD32 456 if (ugd32 != NULL) 457 update_ugd32(ugd, ugd32); 458 #endif 459 if (ugd->ugd_data == NULL) 460 return (0); /* descriptor length only */ 461 462 return (copyout(sc->sc_rdesc, ugd->ugd_data, size)); 463 464 case USB_GET_DEVICEINFO: 465 return(hid_ioctl( 466 sc->sc_dev, USB_GET_DEVICEINFO, (uintptr_t)addr)); 467 } 468 469 return (EINVAL); 470 } 471 472 static int 473 u2f_poll(struct cdev *dev, int events, struct thread *td) 474 { 475 struct u2f_softc *sc = dev->si_drv1; 476 int revents = 0; 477 bool start_intr = false; 478 479 if (sc == NULL) 480 return (POLLHUP); 481 482 if (events & (POLLOUT | POLLWRNORM) && (sc->sc_fflags & FWRITE)) 483 revents |= events & (POLLOUT | POLLWRNORM); 484 if (events & (POLLIN | POLLRDNORM) && (sc->sc_fflags & FREAD)) { 485 mtx_lock(&sc->sc_mtx); 486 if (sc->sc_state.data) 487 revents |= events & (POLLIN | POLLRDNORM); 488 else { 489 sc->sc_state.sel = true; 490 start_intr = true; 491 selrecord(td, &sc->sc_rsel); 492 } 493 mtx_unlock(&sc->sc_mtx); 494 if (start_intr) 495 hid_intr_start(sc->sc_dev); 496 } 497 498 return (revents); 499 } 500 501 static int 502 u2f_kqfilter(struct cdev *dev, struct knote *kn) 503 { 504 struct u2f_softc *sc = dev->si_drv1; 505 506 if (sc == NULL) 507 return (ENXIO); 508 509 switch(kn->kn_filter) { 510 case EVFILT_READ: 511 if (sc->sc_fflags & FREAD) { 512 kn->kn_fop = &u2f_filterops_read; 513 break; 514 } 515 /* FALLTHROUGH */ 516 default: 517 return(EINVAL); 518 } 519 kn->kn_hook = sc; 520 521 knlist_add(&sc->sc_rsel.si_note, kn, 0); 522 return (0); 523 } 524 525 static void 526 u2f_kqtask(void *context, int pending) 527 { 528 struct u2f_softc *sc = context; 529 530 hid_intr_start(sc->sc_dev); 531 } 532 533 static int 534 u2f_kqread(struct knote *kn, long hint) 535 { 536 struct u2f_softc *sc = kn->kn_hook; 537 int ret; 538 539 mtx_assert(&sc->sc_mtx, MA_OWNED); 540 541 if (sc->dev->si_drv1 == NULL) { 542 kn->kn_flags |= EV_EOF; 543 ret = 1; 544 } else { 545 ret = sc->sc_state.data ? 1 : 0; 546 if (!sc->sc_state.data) 547 taskqueue_enqueue(taskqueue_thread, &sc->sc_kqtask); 548 } 549 550 return (ret); 551 } 552 553 static void 554 u2f_kqdetach(struct knote *kn) 555 { 556 struct u2f_softc *sc = kn->kn_hook; 557 558 knlist_remove(&sc->sc_rsel.si_note, kn, 0); 559 } 560 561 static void 562 u2f_notify(struct u2f_softc *sc) 563 { 564 mtx_assert(&sc->sc_mtx, MA_OWNED); 565 566 if (sc->sc_state.aslp) { 567 sc->sc_state.aslp = false; 568 DPRINTFN(5, "waking %p\n", &sc->sc_buf); 569 wakeup(&sc->sc_buf); 570 } 571 if (sc->sc_state.sel) { 572 sc->sc_state.sel = false; 573 selwakeuppri(&sc->sc_rsel, PZERO); 574 } 575 KNOTE_LOCKED(&sc->sc_rsel.si_note, 0); 576 } 577 578 static device_method_t u2f_methods[] = { 579 /* Device interface */ 580 DEVMETHOD(device_probe, u2f_probe), 581 DEVMETHOD(device_attach, u2f_attach), 582 DEVMETHOD(device_detach, u2f_detach), 583 584 DEVMETHOD_END 585 }; 586 587 static driver_t u2f_driver = { 588 #ifdef U2F_DROP_UHID_ALIAS 589 "uf2", 590 #else 591 "uhid", 592 #endif 593 u2f_methods, 594 sizeof(struct u2f_softc) 595 }; 596 597 DRIVER_MODULE(u2f, hidbus, u2f_driver, NULL, NULL); 598 MODULE_DEPEND(u2f, hidbus, 1, 1, 1); 599 MODULE_DEPEND(u2f, hid, 1, 1, 1); 600 MODULE_VERSION(u2f, 1); 601 HID_PNP_INFO(u2f_devs); 602