There seems to be an issue when running a YubiKey with hw.usb.usbhid.enable set in /boot/loader.conf The browser presents the prompt for pressing the YubiKey, but the press is never registered in the browser. Steps to reproduce: 0. Have access to a YubiKey 1. Boot 13.1-RELEASE with hw.usb.usbhid.enable=1 in /boot/loader.conf 2. Install www/firefox and sysutils/u2f-devd 2a. Ensure the user is in the u2f group and restart devd for the key to get proper permissions 3. Go to https://demo.yubico.com/webauthn-technical/registration and click next. 4. You will get a prompt to press the YubiKey, but the press will never register, and the only way out is to cancel. Booting without hw.usb.usbhid.enable=0 (or not set) does work. The only difference I can see in /dev between the two boots is that there are entries for uhid* when hw.usb.usbhid.enable=0, but none when enable=1. From looking at u2f-devd, web browsers use uhid for webauth.
This is a known issue. UGEN had a patch to not do read-ahead, and usbhid.enable=1 needs the same. Adding wulf@ --HPS
https://cgit.freebsd.org/src/commit/?id=b6f615255d8bcdf40604005b11998eee86872364 --HPS
(In reply to Hans Petter Selasky from comment #2) OK. Thanks for the info. I guess I can do a stable build and see if that works. Unless, was the one commit in comment #2 only part of the fix?
This change is already merged to 13/stable, but only for /dev/uhidN access! https://cgit.freebsd.org/src/commit/?id=20d32249196ea6122b481bd61841337a67855337 --HPS
(In reply to Hans Petter Selasky from comment #4) OK, Hans Petter, I understand. This fix is in 13-STABLE for uhid, but not for the newer usbhid (hence why there are no *hid entries in /dev when hw.usb.usbhid.enable=1 on 13.1-RELEASE and 13-STABLE) For the time being, running with hw.usb.usbhid.enable=0 (the default) is fine. I was more trying the newer drivers just to see how they worked. I will be happy to test things out when a patch is ready.
(In reply to Trenton Schulz from comment #5) Hi Trenton, I have some WIP patches in my local repo to disable read-ahead for YubiKey with usbhid. But they require some additional work. I hope to continue work on them in couple of weeks. Unfortunately usbhid(4) read-ahead can not be disabled with one-line patch like uhid(4) did.
+1 I also use YubiKey and could make use of that patch please let me know when its ready for testing I have 13-STABLE :-)
(In reply to Tomasz "CeDeROM" CEDRO from comment #7) > let me know See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263995 It requires some tweaking for STABLE13
I tried out the -stable patch from #263995, and it seems to work well with the webauth demos I reported here. So, for this bug, I would say that it seems to work. Thanks.