drivers/nfc/st21nfca/se.c

   1 /*
   2  * Copyright (C) 2014  STMicroelectronics SAS. All rights reserved.
   3  *
   4  * This program is free software; you can redistribute it and/or modify it
   5  * under the terms and conditions of the GNU General Public License,
   6  * version 2, as published by the Free Software Foundation.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License
  14  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  15  */
  16
  17 #include <net/nfc/hci.h>
  18
  19 #include "st21nfca.h"
  20
  21 #define ST21NFCA_EVT_UICC_ACTIVATE              0x10
  22 #define ST21NFCA_EVT_UICC_DEACTIVATE            0x13
  23 #define ST21NFCA_EVT_SE_HARD_RESET              0x20
  24 #define ST21NFCA_EVT_SE_SOFT_RESET              0x11
  25 #define ST21NFCA_EVT_SE_END_OF_APDU_TRANSFER    0x21
  26 #define ST21NFCA_EVT_SE_ACTIVATE                0x22
  27 #define ST21NFCA_EVT_SE_DEACTIVATE              0x23
  28
  29 #define ST21NFCA_EVT_TRANSMIT_DATA              0x10
  30 #define ST21NFCA_EVT_WTX_REQUEST                0x11
  31
  32 #define ST21NFCA_EVT_CONNECTIVITY               0x10
  33 #define ST21NFCA_EVT_TRANSACTION                0x12
  34
  35 #define ST21NFCA_SE_TO_HOT_PLUG                 1000
  36 /* Connectivity pipe only */
  37 #define ST21NFCA_SE_COUNT_PIPE_UICC             0x01
  38 /* Connectivity + APDU Reader pipe */
  39 #define ST21NFCA_SE_COUNT_PIPE_EMBEDDED 0x02
  40
  41 #define ST21NFCA_SE_MODE_OFF                    0x00
  42 #define ST21NFCA_SE_MODE_ON                             0x01
  43
  44 #define ST21NFCA_PARAM_ATR                              0x01
  45 #define ST21NFCA_ATR_DEFAULT_BWI                0x04
  46
  47 /*
  48  * WT = 2^BWI/10[s], convert into msecs and add a secure
  49  * room by increasing by 2 this timeout
  50  */
  51 #define ST21NFCA_BWI_TO_TIMEOUT(x)              ((1 << x) * 200)
  52 #define ST21NFCA_ATR_GET_Y_FROM_TD(x)   (x >> 4)
  53
  54 /* If TA is present bit 0 is set */
  55 #define ST21NFCA_ATR_TA_PRESENT(x) (x & 0x01)
  56 /* If TB is present bit 1 is set */
  57 #define ST21NFCA_ATR_TB_PRESENT(x) (x & 0x02)
  58
  59 static u8 st21nfca_se_get_bwi(struct nfc_hci_dev *hdev)
  60 {
  61         int i;
  62         u8 td;
  63         struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
  64
  65         /* Bits 8 to 5 of the first TB for T=1 encode BWI from zero to nine */
  66         for (i = 1; i < ST21NFCA_ESE_MAX_LENGTH; i++) {
  67                 td = ST21NFCA_ATR_GET_Y_FROM_TD(info->se_info.atr[i]);
  68                 if (ST21NFCA_ATR_TA_PRESENT(td))
  69                         i++;
  70                 if (ST21NFCA_ATR_TB_PRESENT(td)) {
  71                         i++;
  72                         return info->se_info.atr[i] >> 4;
  73                 }
  74         }
  75         return ST21NFCA_ATR_DEFAULT_BWI;
  76 }
  77
  78 static void st21nfca_se_get_atr(struct nfc_hci_dev *hdev)
  79 {
  80         int r;
  81         struct sk_buff *skb;
  82         struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
  83
  84         r = nfc_hci_get_param(hdev, ST21NFCA_APDU_READER_GATE,
  85                         ST21NFCA_PARAM_ATR, &skb);
  86         if (r < 0)
  87                 return;
  88
  89         if (skb->len <= ST21NFCA_ESE_MAX_LENGTH) {
  90                 memcpy(info->se_info.atr, skb->data, skb->len);
  91                 info->se_info.wt_timeout =
  92                         ST21NFCA_BWI_TO_TIMEOUT(st21nfca_se_get_bwi(hdev));
  93         }
  94         kfree_skb(skb);
  95 }
  96
  97 static int st21nfca_hci_control_se(struct nfc_hci_dev *hdev, u32 se_idx,
  98                                 u8 state)
  99 {
 100         struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
 101         int r, i;
 102         struct sk_buff *sk_host_list;
 103         u8 se_event, host_id;
 104
 105         switch (se_idx) {
 106         case NFC_HCI_UICC_HOST_ID:
 107                 se_event = (state == ST21NFCA_SE_MODE_ON ?
 108                                         ST21NFCA_EVT_UICC_ACTIVATE :
 109                                         ST21NFCA_EVT_UICC_DEACTIVATE);
 110
 111                 info->se_info.count_pipes = 0;
 112                 info->se_info.expected_pipes = ST21NFCA_SE_COUNT_PIPE_UICC;
 113                 break;
 114         case ST21NFCA_ESE_HOST_ID:
 115                 se_event = (state == ST21NFCA_SE_MODE_ON ?
 116                                         ST21NFCA_EVT_SE_ACTIVATE :
 117                                         ST21NFCA_EVT_SE_DEACTIVATE);
 118
 119                 info->se_info.count_pipes = 0;
 120                 info->se_info.expected_pipes = ST21NFCA_SE_COUNT_PIPE_EMBEDDED;
 121                 break;
 122         default:
 123                 return -EINVAL;
 124         }
 125
 126         /*
 127          * Wait for an EVT_HOT_PLUG in order to
 128          * retrieve a relevant host list.
 129          */
 130         reinit_completion(&info->se_info.req_completion);
 131         r = nfc_hci_send_event(hdev, ST21NFCA_DEVICE_MGNT_GATE, se_event,
 132                                NULL, 0);
 133         if (r < 0)
 134                 return r;
 135
 136         mod_timer(&info->se_info.se_active_timer, jiffies +
 137                 msecs_to_jiffies(ST21NFCA_SE_TO_HOT_PLUG));
 138         info->se_info.se_active = true;
 139
 140         /* Ignore return value and check in any case the host_list */
 141         wait_for_completion_interruptible(&info->se_info.req_completion);
 142
 143         r = nfc_hci_get_param(hdev, NFC_HCI_ADMIN_GATE,
 144                         NFC_HCI_ADMIN_HOST_LIST,
 145                         &sk_host_list);
 146         if (r < 0)
 147                 return r;
 148
 149         for (i = 0; i < sk_host_list->len &&
 150                 sk_host_list->data[i] != se_idx; i++)
 151                 ;
 152         host_id = sk_host_list->data[i];
 153         kfree_skb(sk_host_list);
 154
 155         if (state == ST21NFCA_SE_MODE_ON && host_id == se_idx)
 156                 return se_idx;
 157         else if (state == ST21NFCA_SE_MODE_OFF && host_id != se_idx)
 158                 return se_idx;
 159
 160         return -1;
 161 }
 162
 163 int st21nfca_hci_discover_se(struct nfc_hci_dev *hdev)
 164 {
 165         struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
 166         int se_count = 0;
 167
 168         if (test_bit(ST21NFCA_FACTORY_MODE, &hdev->quirks))
 169                 return 0;
 170
 171         if (info->se_status->is_uicc_present) {
 172                 nfc_add_se(hdev->ndev, NFC_HCI_UICC_HOST_ID, NFC_SE_UICC);
 173                 se_count++;
 174         }
 175
 176         if (info->se_status->is_ese_present) {
 177                 nfc_add_se(hdev->ndev, ST21NFCA_ESE_HOST_ID, NFC_SE_EMBEDDED);
 178                 se_count++;
 179         }
 180
 181         return !se_count;
 182 }
 183 EXPORT_SYMBOL(st21nfca_hci_discover_se);
 184
 185 int st21nfca_hci_enable_se(struct nfc_hci_dev *hdev, u32 se_idx)
 186 {
 187         int r;
 188
 189         /*
 190          * According to upper layer, se_idx == NFC_SE_UICC when
 191          * info->se_status->is_uicc_enable is true should never happen.
 192          * Same for eSE.
 193          */
 194         r = st21nfca_hci_control_se(hdev, se_idx, ST21NFCA_SE_MODE_ON);
 195         if (r == ST21NFCA_ESE_HOST_ID) {
 196                 st21nfca_se_get_atr(hdev);
 197                 r = nfc_hci_send_event(hdev, ST21NFCA_APDU_READER_GATE,
 198                                 ST21NFCA_EVT_SE_SOFT_RESET, NULL, 0);
 199                 if (r < 0)
 200                         return r;
 201         } else if (r < 0) {
 202                 /*
 203                  * The activation tentative failed, the secure element
 204                  * is not connected. Remove from the list.
 205                  */
 206                 nfc_remove_se(hdev->ndev, se_idx);
 207                 return r;
 208         }
 209
 210         return 0;
 211 }
 212 EXPORT_SYMBOL(st21nfca_hci_enable_se);
 213
 214 int st21nfca_hci_disable_se(struct nfc_hci_dev *hdev, u32 se_idx)
 215 {
 216         int r;
 217
 218         /*
 219          * According to upper layer, se_idx == NFC_SE_UICC when
 220          * info->se_status->is_uicc_enable is true should never happen
 221          * Same for eSE.
 222          */
 223         r = st21nfca_hci_control_se(hdev, se_idx, ST21NFCA_SE_MODE_OFF);
 224         if (r < 0)
 225                 return r;
 226
 227         return 0;
 228 }
 229 EXPORT_SYMBOL(st21nfca_hci_disable_se);
 230
 231 int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx,
 232                         u8 *apdu, size_t apdu_length,
 233                         se_io_cb_t cb, void *cb_context)
 234 {
 235         struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
 236
 237         pr_debug("se_io %x\n", se_idx);
 238
 239         switch (se_idx) {
 240         case ST21NFCA_ESE_HOST_ID:
 241                 info->se_info.cb = cb;
 242                 info->se_info.cb_context = cb_context;
 243                 mod_timer(&info->se_info.bwi_timer, jiffies +
 244                           msecs_to_jiffies(info->se_info.wt_timeout));
 245                 info->se_info.bwi_active = true;
 246                 return nfc_hci_send_event(hdev, ST21NFCA_APDU_READER_GATE,
 247                                         ST21NFCA_EVT_TRANSMIT_DATA,
 248                                         apdu, apdu_length);
 249         default:
 250                 /* Need to free cb_context here as at the moment we can't
 251                  * clearly indicate to the caller if the callback function
 252                  * would be called (and free it) or not. In both cases a
 253                  * negative value may be returned to the caller.
 254                  */
 255                 kfree(cb_context);
 256                 return -ENODEV;
 257         }
 258 }
 259 EXPORT_SYMBOL(st21nfca_hci_se_io);
 260
 261 static void st21nfca_se_wt_work(struct work_struct *work)
 262 {
 263         /*
 264          * No answer from the secure element
 265          * within the defined timeout.
 266          * Let's send a reset request as recovery procedure.
 267          * According to the situation, we first try to send a software reset
 268          * to the secure element. If the next command is still not
 269          * answering in time, we send to the CLF a secure element hardware
 270          * reset request.
 271          */
 272         /* hardware reset managed through VCC_UICC_OUT power supply */
 273         u8 param = 0x01;
 274         struct st21nfca_hci_info *info = container_of(work,
 275                                                 struct st21nfca_hci_info,
 276                                                 se_info.timeout_work);
 277
 278         pr_debug("\n");
 279
 280         info->se_info.bwi_active = false;
 281
 282         if (!info->se_info.xch_error) {
 283                 info->se_info.xch_error = true;
 284                 nfc_hci_send_event(info->hdev, ST21NFCA_APDU_READER_GATE,
 285                                 ST21NFCA_EVT_SE_SOFT_RESET, NULL, 0);
 286         } else {
 287                 info->se_info.xch_error = false;
 288                 nfc_hci_send_event(info->hdev, ST21NFCA_DEVICE_MGNT_GATE,
 289                                 ST21NFCA_EVT_SE_HARD_RESET, &param, 1);
 290         }
 291         info->se_info.cb(info->se_info.cb_context, NULL, 0, -ETIME);
 292 }
 293
 294 static void st21nfca_se_wt_timeout(struct timer_list *t)
 295 {
 296         struct st21nfca_hci_info *info = from_timer(info, t, se_info.bwi_timer);
 297
 298         schedule_work(&info->se_info.timeout_work);
 299 }
 300
 301 static void st21nfca_se_activation_timeout(struct timer_list *t)
 302 {
 303         struct st21nfca_hci_info *info = from_timer(info, t,
 304                                                     se_info.se_active_timer);
 305
 306         pr_debug("\n");
 307
 308         info->se_info.se_active = false;
 309
 310         complete(&info->se_info.req_completion);
 311 }
 312
 313 /*
 314  * Returns:
 315  * <= 0: driver handled the event, skb consumed
 316  *    1: driver does not handle the event, please do standard processing
 317  */
 318 int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
 319                                 u8 event, struct sk_buff *skb)
 320 {
 321         int r = 0;
 322         struct device *dev = &hdev->ndev->dev;
 323         struct nfc_evt_transaction *transaction;
 324
 325         pr_debug("connectivity gate event: %x\n", event);
 326
 327         switch (event) {
 328         case ST21NFCA_EVT_CONNECTIVITY:
 329                 r = nfc_se_connectivity(hdev->ndev, host);
 330         break;
 331         case ST21NFCA_EVT_TRANSACTION:
 332                 /*
 333                  * According to specification etsi 102 622
 334                  * 11.2.2.4 EVT_TRANSACTION Table 52
 335                  * Description  Tag     Length
 336                  * AID          81      5 to 16
 337                  * PARAMETERS   82      0 to 255
 338                  */
 339                 if (skb->len < NFC_MIN_AID_LENGTH + 2 ||
 340                     skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)
 341                         return -EPROTO;
 342
 343                 transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
 344                                                    skb->len - 2, GFP_KERNEL);
 345                 if (!transaction)
 346                         return -ENOMEM;
 347
 348                 transaction->aid_len = skb->data[1];
 349
 350                 /* Checking if the length of the AID is valid */
 351                 if (transaction->aid_len > sizeof(transaction->aid)) {
 352                         devm_kfree(dev, transaction);
 353                         return -EINVAL;
 354                 }
 355
 356                 memcpy(transaction->aid, &skb->data[2],
 357                        transaction->aid_len);
 358
 359                 /* Check next byte is PARAMETERS tag (82) */
 360                 if (skb->data[transaction->aid_len + 2] !=
 361                     NFC_EVT_TRANSACTION_PARAMS_TAG) {
 362                         devm_kfree(dev, transaction);
 363                         return -EPROTO;
 364                 }
 365
 366                 transaction->params_len = skb->data[transaction->aid_len + 3];
 367
 368                 /* Total size is allocated (skb->len - 2) minus fixed array members */
 369                 if (transaction->params_len > ((skb->len - 2) -
 370                     sizeof(struct nfc_evt_transaction))) {
 371                         devm_kfree(dev, transaction);
 372                         return -EINVAL;
 373                 }
 374
 375                 memcpy(transaction->params, skb->data +
 376                        transaction->aid_len + 4, transaction->params_len);
 377
 378                 r = nfc_se_transaction(hdev->ndev, host, transaction);
 379         break;
 380         default:
 381                 nfc_err(&hdev->ndev->dev, "Unexpected event on connectivity gate\n");
 382                 return 1;
 383         }
 384         kfree_skb(skb);
 385         return r;
 386 }
 387 EXPORT_SYMBOL(st21nfca_connectivity_event_received);
 388
 389 int st21nfca_apdu_reader_event_received(struct nfc_hci_dev *hdev,
 390                                         u8 event, struct sk_buff *skb)
 391 {
 392         int r = 0;
 393         struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
 394
 395         pr_debug("apdu reader gate event: %x\n", event);
 396
 397         switch (event) {
 398         case ST21NFCA_EVT_TRANSMIT_DATA:
 399                 del_timer_sync(&info->se_info.bwi_timer);
 400                 cancel_work_sync(&info->se_info.timeout_work);
 401                 info->se_info.bwi_active = false;
 402                 r = nfc_hci_send_event(hdev, ST21NFCA_DEVICE_MGNT_GATE,
 403                                 ST21NFCA_EVT_SE_END_OF_APDU_TRANSFER, NULL, 0);
 404                 if (r < 0)
 405                         goto exit;
 406
 407                 info->se_info.cb(info->se_info.cb_context,
 408                         skb->data, skb->len, 0);
 409                 break;
 410         case ST21NFCA_EVT_WTX_REQUEST:
 411                 mod_timer(&info->se_info.bwi_timer, jiffies +
 412                                 msecs_to_jiffies(info->se_info.wt_timeout));
 413                 break;
 414         default:
 415                 nfc_err(&hdev->ndev->dev, "Unexpected event on apdu reader gate\n");
 416                 return 1;
 417         }
 418
 419 exit:
 420         kfree_skb(skb);
 421         return r;
 422 }
 423 EXPORT_SYMBOL(st21nfca_apdu_reader_event_received);
 424
 425 void st21nfca_se_init(struct nfc_hci_dev *hdev)
 426 {
 427         struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
 428
 429         init_completion(&info->se_info.req_completion);
 430         INIT_WORK(&info->se_info.timeout_work, st21nfca_se_wt_work);
 431         /* initialize timers */
 432         timer_setup(&info->se_info.bwi_timer, st21nfca_se_wt_timeout, 0);
 433         info->se_info.bwi_active = false;
 434
 435         timer_setup(&info->se_info.se_active_timer,
 436                     st21nfca_se_activation_timeout, 0);
 437         info->se_info.se_active = false;
 438
 439         info->se_info.count_pipes = 0;
 440         info->se_info.expected_pipes = 0;
 441
 442         info->se_info.xch_error = false;
 443
 444         info->se_info.wt_timeout =
 445                         ST21NFCA_BWI_TO_TIMEOUT(ST21NFCA_ATR_DEFAULT_BWI);
 446 }
 447 EXPORT_SYMBOL(st21nfca_se_init);
 448
 449 void st21nfca_se_deinit(struct nfc_hci_dev *hdev)
 450 {
 451         struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
 452
 453         if (info->se_info.bwi_active)
 454                 del_timer_sync(&info->se_info.bwi_timer);
 455         if (info->se_info.se_active)
 456                 del_timer_sync(&info->se_info.se_active_timer);
 457
 458         cancel_work_sync(&info->se_info.timeout_work);
 459         info->se_info.bwi_active = false;
 460         info->se_info.se_active = false;
 461 }
 462 EXPORT_SYMBOL(st21nfca_se_deinit);