freebsd/sys/dev/hid/u2f.c

/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) 2022-2023 Vladimir Kondratyev <[email protected]>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "opt_hid.h"

#include <sys/param.h>
#ifdef COMPAT_FREEBSD32
#include <sys/abi_compat.h>
#endif
#include <sys/bus.h>
#include <sys/conf.h>
#include <sys/fcntl.h>
#include <sys/filio.h>
#include <sys/ioccom.h>
#include <sys/kernel.h>
#include <sys/lock.h>
#include <sys/malloc.h>
#include <sys/module.h>
#include <sys/mutex.h>
#include <sys/poll.h>
#include <sys/priv.h>
#include <sys/proc.h>
#include <sys/selinfo.h>
#include <sys/sysctl.h>
#include <sys/systm.h>
#include <sys/taskqueue.h>
#include <sys/uio.h>

#include <dev/evdev/input.h>

#define HID_DEBUG_VAR	u2f_debug
#include <dev/hid/hid.h>
#include <dev/hid/hidbus.h>
#include <dev/hid/hidquirk.h>

#include <dev/usb/usb_ioctl.h>

#ifdef HID_DEBUG
static int u2f_debug = 0;
static SYSCTL_NODE(_hw_hid, OID_AUTO, u2f, CTLFLAG_RW, 0,
    "FIDO/U2F authenticator");
SYSCTL_INT(_hw_hid_u2f, OID_AUTO, debug, CTLFLAG_RWTUN,
    &u2f_debug, 0, "Debug level");
#endif

#define	U2F_MAX_REPORT_SIZE	64

/* A match on these entries will load u2f */
static const struct hid_device_id u2f_devs[] = {
	{ HID_BUS(BUS_USB), HID_TLC(HUP_FIDO, HUF_U2FHID) },
};

struct u2f_softc {
	device_t sc_dev;		/* base device */
	struct cdev *dev;

	struct mtx sc_mtx;		/* hidbus private mutex */
	struct task sc_kqtask;		/* kqueue task */
	void *sc_rdesc;
	hid_size_t sc_rdesc_size;
	hid_size_t sc_isize;
	hid_size_t sc_osize;
	struct selinfo sc_rsel;
	struct {			/* driver state */
		bool	open:1;		/* device is open */
		bool	aslp:1;		/* waiting for device data in read() */
		bool	sel:1;		/* waiting for device data in poll() */
		bool	data:1;		/* input report is stored in sc_buf */
		int	reserved:28;
	} sc_state;
	int sc_fflags;			/* access mode for open lifetime */

	uint8_t sc_buf[U2F_MAX_REPORT_SIZE];
};

static d_open_t		u2f_open;
static d_read_t		u2f_read;
static d_write_t	u2f_write;
static d_ioctl_t	u2f_ioctl;
static d_poll_t		u2f_poll;
static d_kqfilter_t	u2f_kqfilter;

static d_priv_dtor_t	u2f_dtor;

static struct cdevsw u2f_cdevsw = {
	.d_version =	D_VERSION,
	.d_open =	u2f_open,
	.d_read =	u2f_read,
	.d_write =	u2f_write,
	.d_ioctl =	u2f_ioctl,
	.d_poll =	u2f_poll,
	.d_kqfilter =	u2f_kqfilter,
	.d_name =	"u2f",
};

static hid_intr_t	u2f_intr;

static device_probe_t	u2f_probe;
static device_attach_t	u2f_attach;
static device_detach_t	u2f_detach;

static void		u2f_kqtask(void *context, int pending);
static int		u2f_kqread(struct knote *, long);
static void		u2f_kqdetach(struct knote *);
static void		u2f_notify(struct u2f_softc *);

static struct filterops u2f_filterops_read = {
	.f_isfd =	1,
	.f_detach =	u2f_kqdetach,
	.f_event =	u2f_kqread,
	.f_copy =	knote_triv_copy,
};

static int
u2f_probe(device_t dev)
{
	int error;

	error = HIDBUS_LOOKUP_DRIVER_INFO(dev, u2f_devs);
	if (error != 0)
                return (error);

	hidbus_set_desc(dev, "Authenticator");

	return (BUS_PROBE_GENERIC);
}

static int
u2f_attach(device_t dev)
{
	struct u2f_softc *sc = device_get_softc(dev);
	struct hid_device_info *hw = __DECONST(struct hid_device_info *,
	    hid_get_device_info(dev));
	struct make_dev_args mda;
	int error;

	sc->sc_dev = dev;

	error = hid_get_report_descr(dev, &sc->sc_rdesc, &sc->sc_rdesc_size);
	if (error != 0)
		return (ENXIO);
	sc->sc_isize = hid_report_size_max(sc->sc_rdesc, sc->sc_rdesc_size,
	    hid_input, NULL);
	if (sc->sc_isize > U2F_MAX_REPORT_SIZE) {
		device_printf(dev, "Input report size too large. Truncate.\n");
		sc->sc_isize = U2F_MAX_REPORT_SIZE;
	}
	sc->sc_osize = hid_report_size_max(sc->sc_rdesc, sc->sc_rdesc_size,
	    hid_output, NULL);
	if (sc->sc_osize > U2F_MAX_REPORT_SIZE) {
		device_printf(dev, "Output report size too large. Truncate.\n");
		sc->sc_osize = U2F_MAX_REPORT_SIZE;
	}

	mtx_init(&sc->sc_mtx, "u2f lock", NULL, MTX_DEF);
	knlist_init_mtx(&sc->sc_rsel.si_note, &sc->sc_mtx);
	TASK_INIT(&sc->sc_kqtask, 0, u2f_kqtask, sc);

	make_dev_args_init(&mda);
	mda.mda_flags = MAKEDEV_WAITOK;
	mda.mda_devsw = &u2f_cdevsw;
	mda.mda_uid = UID_ROOT;
	mda.mda_gid = GID_U2F;
	mda.mda_mode = 0660;
	mda.mda_si_drv1 = sc;

	error = make_dev_s(&mda, &sc->dev, "u2f/%d", device_get_unit(dev));
	if (error) {
		device_printf(dev, "Can not create character device\n");
		u2f_detach(dev);
		return (error);
	}
#ifndef U2F_DROP_UHID_ALIAS
	(void)make_dev_alias(sc->dev, "uhid%d", device_get_unit(dev));
#endif

	hid_add_dynamic_quirk(hw, HQ_NO_READAHEAD);

	hidbus_set_lock(dev, &sc->sc_mtx);
	hidbus_set_intr(dev, u2f_intr, sc);

	return (0);
}

static int
u2f_detach(device_t dev)
{
	struct u2f_softc *sc = device_get_softc(dev);

	DPRINTF("sc=%p\n", sc);

	if (sc->dev != NULL) {
		mtx_lock(&sc->sc_mtx);
		sc->dev->si_drv1 = NULL;
		/* Wake everyone */
		u2f_notify(sc);
		mtx_unlock(&sc->sc_mtx);
		destroy_dev(sc->dev);
	}

	taskqueue_drain(taskqueue_thread, &sc->sc_kqtask);

	knlist_clear(&sc->sc_rsel.si_note, 0);
	knlist_destroy(&sc->sc_rsel.si_note);
	seldrain(&sc->sc_rsel);
	mtx_destroy(&sc->sc_mtx);

	return (0);
}

void
u2f_intr(void *context, void *buf, hid_size_t len)
{
	struct u2f_softc *sc = context;

	mtx_assert(&sc->sc_mtx, MA_OWNED);

	DPRINTFN(5, "len=%d\n", len);
	DPRINTFN(5, "data = %*D\n", len, buf, " ");

	if (sc->sc_state.data)
		return;

	if (len > sc->sc_isize)
		len = sc->sc_isize;

	bcopy(buf, sc->sc_buf, len);

	/* Make sure we don't process old data */
	if (len < sc->sc_isize)
		bzero(sc->sc_buf + len, sc->sc_isize - len);

	sc->sc_state.data = true;

	u2f_notify(sc);
}

static int
u2f_open(struct cdev *dev, int flag, int mode, struct thread *td)
{
	struct u2f_softc *sc = dev->si_drv1;
	int error;

	if (sc == NULL)
		return (ENXIO);

	DPRINTF("sc=%p\n", sc);

	mtx_lock(&sc->sc_mtx);
	if (sc->sc_state.open) {
		mtx_unlock(&sc->sc_mtx);
		return (EBUSY);
	}
	sc->sc_state.open = true;
	mtx_unlock(&sc->sc_mtx);

	error = devfs_set_cdevpriv(sc, u2f_dtor);
	if (error != 0) {
		mtx_lock(&sc->sc_mtx);
		sc->sc_state.open = false;
		mtx_unlock(&sc->sc_mtx);
		return (error);
	}

	/* Set up interrupt pipe. */
	sc->sc_state.data = false;
	sc->sc_fflags = flag;

	return (0);
}


static void
u2f_dtor(void *data)
{
	struct u2f_softc *sc = data;

	/* Disable interrupts. */
	hid_intr_stop(sc->sc_dev);

	mtx_lock(&sc->sc_mtx);
	sc->sc_state.open = false;
	mtx_unlock(&sc->sc_mtx);
}

static int
u2f_read(struct cdev *dev, struct uio *uio, int flag)
{
	uint8_t buf[U2F_MAX_REPORT_SIZE];
	struct u2f_softc *sc = dev->si_drv1;
	size_t length = 0;
	int error;

	DPRINTFN(1, "\n");

	if (sc == NULL)
		return (EIO);

	if (!sc->sc_state.data)
		hid_intr_start(sc->sc_dev);

	mtx_lock(&sc->sc_mtx);
	if (dev->si_drv1 == NULL) {
		error = EIO;
		goto exit;
	}

	while (!sc->sc_state.data) {
		if (flag & O_NONBLOCK) {
			error = EWOULDBLOCK;
			goto exit;
		}
		sc->sc_state.aslp = true;
		DPRINTFN(5, "sleep on %p\n", &sc->sc_buf);
		error = mtx_sleep(&sc->sc_buf, &sc->sc_mtx, PZERO | PCATCH,
		    "u2frd", 0);
		DPRINTFN(5, "woke, error=%d\n", error);
		if (dev->si_drv1 == NULL)
			error = EIO;
		if (error) {
			sc->sc_state.aslp = false;
			goto exit;
		}
	}

	if (sc->sc_state.data && uio->uio_resid > 0) {
		length = min(uio->uio_resid, sc->sc_isize);
		memcpy(buf, sc->sc_buf, length);
		sc->sc_state.data = false;
	}
exit:
	mtx_unlock(&sc->sc_mtx);
	if (length != 0) {
		/* Copy the data to the user process. */
		DPRINTFN(5, "got %lu chars\n", (u_long)length);
		error = uiomove(buf, length, uio);
	}

	return (error);
}

static int
u2f_write(struct cdev *dev, struct uio *uio, int flag)
{
	uint8_t buf[U2F_MAX_REPORT_SIZE];
	struct u2f_softc *sc = dev->si_drv1;
	int error;

	DPRINTFN(1, "\n");

	if (sc == NULL)
		return (EIO);

	if (uio->uio_resid != sc->sc_osize)
		return (EINVAL);
	error = uiomove(buf, uio->uio_resid, uio);
	if (error == 0)
		error = hid_write(sc->sc_dev, buf, sc->sc_osize);

	return (error);
}

#ifdef COMPAT_FREEBSD32
static void
update_ugd32(const struct usb_gen_descriptor *ugd,
    struct usb_gen_descriptor32 *ugd32)
{
	/* Don't update hgd_data pointer */
	CP(*ugd, *ugd32, ugd_lang_id);
	CP(*ugd, *ugd32, ugd_maxlen);
	CP(*ugd, *ugd32, ugd_actlen);
	CP(*ugd, *ugd32, ugd_offset);
	CP(*ugd, *ugd32, ugd_config_index);
	CP(*ugd, *ugd32, ugd_string_index);
	CP(*ugd, *ugd32, ugd_iface_index);
	CP(*ugd, *ugd32, ugd_altif_index);
	CP(*ugd, *ugd32, ugd_endpt_index);
	CP(*ugd, *ugd32, ugd_report_type);
	/* Don't update reserved */
}
#endif

static int
u2f_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag,
    struct thread *td)
{
#ifdef COMPAT_FREEBSD32
	struct usb_gen_descriptor local_ugd;
	struct usb_gen_descriptor32 *ugd32 = NULL;
#endif
	struct u2f_softc *sc = dev->si_drv1;
	struct usb_gen_descriptor *ugd = (struct usb_gen_descriptor *)addr;
	uint32_t size;

	DPRINTFN(2, "cmd=%lx\n", cmd);

	if (sc == NULL)
		return (EIO);

#ifdef COMPAT_FREEBSD32
	switch (cmd) {
	case USB_GET_REPORT_DESC32:
		cmd = _IOC_NEWTYPE(cmd, struct usb_gen_descriptor);
		ugd32 = (struct usb_gen_descriptor32 *)addr;
		ugd = &local_ugd;
		PTRIN_CP(*ugd32, *ugd, ugd_data);
		CP(*ugd32, *ugd, ugd_lang_id);
		CP(*ugd32, *ugd, ugd_maxlen);
		CP(*ugd32, *ugd, ugd_actlen);
		CP(*ugd32, *ugd, ugd_offset);
		CP(*ugd32, *ugd, ugd_config_index);
		CP(*ugd32, *ugd, ugd_string_index);
		CP(*ugd32, *ugd, ugd_iface_index);
		CP(*ugd32, *ugd, ugd_altif_index);
		CP(*ugd32, *ugd, ugd_endpt_index);
		CP(*ugd32, *ugd, ugd_report_type);
		/* Don't copy reserved */
		break;
	}
#endif

	/* fixed-length ioctls handling */
	switch (cmd) {
	case FIONBIO:
		/* All handled in the upper FS layer. */
		return (0);

	case USB_GET_REPORT_DESC:
		size = MIN(sc->sc_rdesc_size, ugd->ugd_maxlen);
		ugd->ugd_actlen = size;
#ifdef COMPAT_FREEBSD32
		if (ugd32 != NULL)
			update_ugd32(ugd, ugd32);
#endif
		if (ugd->ugd_data == NULL)
			return (0);		/* descriptor length only */

		return (copyout(sc->sc_rdesc, ugd->ugd_data, size));

	case USB_GET_DEVICEINFO:
		return(hid_ioctl(
		    sc->sc_dev, USB_GET_DEVICEINFO, (uintptr_t)addr));
	}

	return (EINVAL);
}

static int
u2f_poll(struct cdev *dev, int events, struct thread *td)
{
	struct u2f_softc *sc = dev->si_drv1;
	int revents = 0;
	bool start_intr = false;

	if (sc == NULL)
                return (POLLHUP);

	if (events & (POLLOUT | POLLWRNORM) && (sc->sc_fflags & FWRITE))
		revents |= events & (POLLOUT | POLLWRNORM);
	if (events & (POLLIN | POLLRDNORM) && (sc->sc_fflags & FREAD)) {
		mtx_lock(&sc->sc_mtx);
		if (sc->sc_state.data)
			revents |= events & (POLLIN | POLLRDNORM);
		else {
			sc->sc_state.sel = true;
			start_intr = true;
			selrecord(td, &sc->sc_rsel);
		}
		mtx_unlock(&sc->sc_mtx);
		if (start_intr)
			hid_intr_start(sc->sc_dev);
	}

	return (revents);
}

static int
u2f_kqfilter(struct cdev *dev, struct knote *kn)
{
	struct u2f_softc *sc = dev->si_drv1;

	if (sc == NULL)
		return (ENXIO);

	switch(kn->kn_filter) {
	case EVFILT_READ:
		if (sc->sc_fflags & FREAD) {
			kn->kn_fop = &u2f_filterops_read;
			break;
		}
		/* FALLTHROUGH */
	default:
		return(EINVAL);
	}
	kn->kn_hook = sc;

	knlist_add(&sc->sc_rsel.si_note, kn, 0);
	return (0);
}

static void
u2f_kqtask(void *context, int pending)
{
	struct u2f_softc *sc = context;

	hid_intr_start(sc->sc_dev);
}

static int
u2f_kqread(struct knote *kn, long hint)
{
	struct u2f_softc *sc = kn->kn_hook;
	int ret;

	mtx_assert(&sc->sc_mtx, MA_OWNED);

	if (sc->dev->si_drv1 == NULL) {
		kn->kn_flags |= EV_EOF;
		ret = 1;
	} else {
		ret = sc->sc_state.data ? 1 : 0;
		if (!sc->sc_state.data)
			taskqueue_enqueue(taskqueue_thread, &sc->sc_kqtask);
	}

	return (ret);
}

static void
u2f_kqdetach(struct knote *kn)
{
	struct u2f_softc *sc = kn->kn_hook;

	knlist_remove(&sc->sc_rsel.si_note, kn, 0);
}

static void
u2f_notify(struct u2f_softc *sc)
{
	mtx_assert(&sc->sc_mtx, MA_OWNED);

	if (sc->sc_state.aslp) {
		sc->sc_state.aslp = false;
		DPRINTFN(5, "waking %p\n", &sc->sc_buf);
		wakeup(&sc->sc_buf);
	}
	if (sc->sc_state.sel) {
		sc->sc_state.sel = false;
		selwakeuppri(&sc->sc_rsel, PZERO);
	}
	KNOTE_LOCKED(&sc->sc_rsel.si_note, 0);
}

static device_method_t u2f_methods[] = {
	/* Device interface */
	DEVMETHOD(device_probe,		u2f_probe),
	DEVMETHOD(device_attach,	u2f_attach),
	DEVMETHOD(device_detach,	u2f_detach),

	DEVMETHOD_END
};

static driver_t u2f_driver = {
#ifdef U2F_DROP_UHID_ALIAS
	"uf2",
#else
	"uhid",
#endif
	u2f_methods,
	sizeof(struct u2f_softc)
};

DRIVER_MODULE(u2f, hidbus, u2f_driver, NULL, NULL);
MODULE_DEPEND(u2f, hidbus, 1, 1, 1);
MODULE_DEPEND(u2f, hid, 1, 1, 1);
MODULE_VERSION(u2f, 1);
HID_PNP_INFO(u2f_devs);