1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * The NFC Controller Interface is the communication protocol between an
4 * NFC Controller (NFCC) and a Device Host (DH).
5 *
6 * Copyright (C) 2011 Texas Instruments, Inc.
7 *
8 * Written by Ilan Elias <ilane@ti.com>
9 *
10 * Acknowledgements:
11 * This file is based on hci_event.c, which was written
12 * by Maxim Krasnyansky.
13 */
14
15 #define pr_fmt(fmt) KBUILD_MODNAME ": %s: " fmt, __func__
16
17 #include <linux/types.h>
18 #include <linux/interrupt.h>
19 #include <linux/bitops.h>
20 #include <linux/skbuff.h>
21
22 #include "../nfc.h"
23 #include <net/nfc/nci.h>
24 #include <net/nfc/nci_core.h>
25
26 /* Handle NCI Response packets */
27
nci_core_reset_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)28 static void nci_core_reset_rsp_packet(struct nci_dev *ndev,
29 const struct sk_buff *skb)
30 {
31 const struct nci_core_reset_rsp *rsp = (void *)skb->data;
32
33 pr_debug("status 0x%x\n", rsp->status);
34
35 /* Handle NCI 1.x ver */
36 if (skb->len != 1) {
37 if (rsp->status == NCI_STATUS_OK) {
38 ndev->nci_ver = rsp->nci_ver;
39 pr_debug("nci_ver 0x%x, config_status 0x%x\n",
40 rsp->nci_ver, rsp->config_status);
41 }
42
43 nci_req_complete(ndev, rsp->status);
44 }
45 }
46
nci_core_init_rsp_packet_v1(struct nci_dev * ndev,const struct sk_buff * skb)47 static u8 nci_core_init_rsp_packet_v1(struct nci_dev *ndev,
48 const struct sk_buff *skb)
49 {
50 const struct nci_core_init_rsp_1 *rsp_1 = (void *)skb->data;
51 const struct nci_core_init_rsp_2 *rsp_2;
52
53 /* Ensure that the status field can be accessed. */
54 if (skb_headlen(skb) < 1)
55 return NCI_STATUS_SYNTAX_ERROR;
56
57 pr_debug("status 0x%x\n", rsp_1->status);
58
59 if (rsp_1->status != NCI_STATUS_OK)
60 return rsp_1->status;
61
62 /* Success response must contain the full fixed-size header */
63 if (skb_headlen(skb) < sizeof(*rsp_1))
64 return NCI_STATUS_SYNTAX_ERROR;
65
66 /* Ensure the variable-length rf_interfaces array and trailing
67 * rsp_2 structure are fully contained within the skb.
68 */
69 if (skb_headlen(skb) < sizeof(*rsp_1) +
70 rsp_1->num_supported_rf_interfaces +
71 sizeof(*rsp_2))
72 return NCI_STATUS_SYNTAX_ERROR;
73
74 ndev->nfcc_features = __le32_to_cpu(rsp_1->nfcc_features);
75 ndev->num_supported_rf_interfaces = rsp_1->num_supported_rf_interfaces;
76
77 ndev->num_supported_rf_interfaces =
78 min((int)ndev->num_supported_rf_interfaces,
79 NCI_MAX_SUPPORTED_RF_INTERFACES);
80
81 memcpy(ndev->supported_rf_interfaces,
82 rsp_1->supported_rf_interfaces,
83 ndev->num_supported_rf_interfaces);
84
85 rsp_2 = (void *) (skb->data + 6 + rsp_1->num_supported_rf_interfaces);
86
87 ndev->max_logical_connections = rsp_2->max_logical_connections;
88 ndev->max_routing_table_size =
89 __le16_to_cpu(rsp_2->max_routing_table_size);
90 ndev->max_ctrl_pkt_payload_len =
91 rsp_2->max_ctrl_pkt_payload_len;
92 ndev->max_size_for_large_params =
93 __le16_to_cpu(rsp_2->max_size_for_large_params);
94 ndev->manufact_id =
95 rsp_2->manufact_id;
96 ndev->manufact_specific_info =
97 __le32_to_cpu(rsp_2->manufact_specific_info);
98
99 return NCI_STATUS_OK;
100 }
101
nci_core_init_rsp_packet_v2(struct nci_dev * ndev,const struct sk_buff * skb)102 static u8 nci_core_init_rsp_packet_v2(struct nci_dev *ndev,
103 const struct sk_buff *skb)
104 {
105 const struct nci_core_init_rsp_nci_ver2 *rsp = (void *)skb->data;
106 const u8 *supported_rf_interface;
107 u8 rf_interface_idx = 0;
108 u8 rf_extension_cnt = 0;
109
110 /* Ensure that the status field can be accessed. */
111 if (skb_headlen(skb) < 1)
112 return NCI_STATUS_SYNTAX_ERROR;
113
114 pr_debug("status %x\n", rsp->status);
115
116 if (rsp->status != NCI_STATUS_OK)
117 return rsp->status;
118
119 /* Success response must contain the full fixed-size header */
120 if (skb_headlen(skb) < sizeof(*rsp))
121 return NCI_STATUS_SYNTAX_ERROR;
122
123 supported_rf_interface = rsp->supported_rf_interfaces;
124
125 ndev->nfcc_features = __le32_to_cpu(rsp->nfcc_features);
126 ndev->num_supported_rf_interfaces = rsp->num_supported_rf_interfaces;
127
128 ndev->num_supported_rf_interfaces =
129 min((int)ndev->num_supported_rf_interfaces,
130 NCI_MAX_SUPPORTED_RF_INTERFACES);
131
132 while (rf_interface_idx < ndev->num_supported_rf_interfaces) {
133 /* Each entry: [rf_interface_type (1B)] [ext_count (1B)] [ext...] */
134 if (supported_rf_interface + 2 > skb_tail_pointer(skb))
135 break;
136 ndev->supported_rf_interfaces[rf_interface_idx] = *supported_rf_interface++;
137
138 rf_extension_cnt = *supported_rf_interface++;
139 if (supported_rf_interface + rf_extension_cnt > skb_tail_pointer(skb))
140 break;
141
142 /* Only count the entry after full validation */
143 rf_interface_idx++;
144 supported_rf_interface += rf_extension_cnt;
145 }
146
147 ndev->num_supported_rf_interfaces = rf_interface_idx;
148
149 ndev->max_logical_connections = rsp->max_logical_connections;
150 ndev->max_routing_table_size =
151 __le16_to_cpu(rsp->max_routing_table_size);
152 ndev->max_ctrl_pkt_payload_len =
153 rsp->max_ctrl_pkt_payload_len;
154 ndev->max_size_for_large_params = NCI_MAX_LARGE_PARAMS_NCI_v2;
155
156 return NCI_STATUS_OK;
157 }
158
nci_core_init_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)159 static void nci_core_init_rsp_packet(struct nci_dev *ndev, const struct sk_buff *skb)
160 {
161 u8 status = 0;
162
163 if (!(ndev->nci_ver & NCI_VER_2_MASK))
164 status = nci_core_init_rsp_packet_v1(ndev, skb);
165 else
166 status = nci_core_init_rsp_packet_v2(ndev, skb);
167
168 if (status != NCI_STATUS_OK)
169 goto exit;
170
171 pr_debug("nfcc_features 0x%x\n",
172 ndev->nfcc_features);
173 pr_debug("num_supported_rf_interfaces %d\n",
174 ndev->num_supported_rf_interfaces);
175 pr_debug("supported_rf_interfaces[0] 0x%x\n",
176 ndev->supported_rf_interfaces[0]);
177 pr_debug("supported_rf_interfaces[1] 0x%x\n",
178 ndev->supported_rf_interfaces[1]);
179 pr_debug("supported_rf_interfaces[2] 0x%x\n",
180 ndev->supported_rf_interfaces[2]);
181 pr_debug("supported_rf_interfaces[3] 0x%x\n",
182 ndev->supported_rf_interfaces[3]);
183 pr_debug("max_logical_connections %d\n",
184 ndev->max_logical_connections);
185 pr_debug("max_routing_table_size %d\n",
186 ndev->max_routing_table_size);
187 pr_debug("max_ctrl_pkt_payload_len %d\n",
188 ndev->max_ctrl_pkt_payload_len);
189 pr_debug("max_size_for_large_params %d\n",
190 ndev->max_size_for_large_params);
191 pr_debug("manufact_id 0x%x\n",
192 ndev->manufact_id);
193 pr_debug("manufact_specific_info 0x%x\n",
194 ndev->manufact_specific_info);
195
196 exit:
197 nci_req_complete(ndev, status);
198 }
199
nci_core_set_config_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)200 static void nci_core_set_config_rsp_packet(struct nci_dev *ndev,
201 const struct sk_buff *skb)
202 {
203 const struct nci_core_set_config_rsp *rsp = (void *)skb->data;
204
205 pr_debug("status 0x%x\n", rsp->status);
206
207 nci_req_complete(ndev, rsp->status);
208 }
209
nci_rf_disc_map_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)210 static void nci_rf_disc_map_rsp_packet(struct nci_dev *ndev,
211 const struct sk_buff *skb)
212 {
213 __u8 status = skb->data[0];
214
215 pr_debug("status 0x%x\n", status);
216
217 nci_req_complete(ndev, status);
218 }
219
nci_rf_disc_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)220 static void nci_rf_disc_rsp_packet(struct nci_dev *ndev,
221 const struct sk_buff *skb)
222 {
223 struct nci_conn_info *conn_info;
224 __u8 status = skb->data[0];
225
226 pr_debug("status 0x%x\n", status);
227
228 if (status == NCI_STATUS_OK) {
229 atomic_set(&ndev->state, NCI_DISCOVERY);
230
231 conn_info = ndev->rf_conn_info;
232 if (!conn_info) {
233 conn_info = devm_kzalloc(&ndev->nfc_dev->dev,
234 sizeof(struct nci_conn_info),
235 GFP_KERNEL);
236 if (!conn_info) {
237 status = NCI_STATUS_REJECTED;
238 goto exit;
239 }
240 conn_info->conn_id = NCI_STATIC_RF_CONN_ID;
241 INIT_LIST_HEAD(&conn_info->list);
242 list_add(&conn_info->list, &ndev->conn_info_list);
243 ndev->rf_conn_info = conn_info;
244 }
245 }
246
247 exit:
248 nci_req_complete(ndev, status);
249 }
250
nci_rf_disc_select_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)251 static void nci_rf_disc_select_rsp_packet(struct nci_dev *ndev,
252 const struct sk_buff *skb)
253 {
254 __u8 status = skb->data[0];
255
256 pr_debug("status 0x%x\n", status);
257
258 /* Complete the request on intf_activated_ntf or generic_error_ntf */
259 if (status != NCI_STATUS_OK)
260 nci_req_complete(ndev, status);
261 }
262
nci_rf_deactivate_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)263 static void nci_rf_deactivate_rsp_packet(struct nci_dev *ndev,
264 const struct sk_buff *skb)
265 {
266 __u8 status = skb->data[0];
267
268 pr_debug("status 0x%x\n", status);
269
270 /* If target was active, complete the request only in deactivate_ntf */
271 if ((status != NCI_STATUS_OK) ||
272 (atomic_read(&ndev->state) != NCI_POLL_ACTIVE)) {
273 nci_clear_target_list(ndev);
274 atomic_set(&ndev->state, NCI_IDLE);
275 nci_req_complete(ndev, status);
276 }
277 }
278
nci_nfcee_discover_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)279 static void nci_nfcee_discover_rsp_packet(struct nci_dev *ndev,
280 const struct sk_buff *skb)
281 {
282 const struct nci_nfcee_discover_rsp *discover_rsp;
283
284 if (skb->len != 2) {
285 nci_req_complete(ndev, NCI_STATUS_NFCEE_PROTOCOL_ERROR);
286 return;
287 }
288
289 discover_rsp = (struct nci_nfcee_discover_rsp *)skb->data;
290
291 if (discover_rsp->status != NCI_STATUS_OK ||
292 discover_rsp->num_nfcee == 0)
293 nci_req_complete(ndev, discover_rsp->status);
294 }
295
nci_nfcee_mode_set_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)296 static void nci_nfcee_mode_set_rsp_packet(struct nci_dev *ndev,
297 const struct sk_buff *skb)
298 {
299 __u8 status = skb->data[0];
300
301 pr_debug("status 0x%x\n", status);
302 nci_req_complete(ndev, status);
303 }
304
nci_core_conn_create_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)305 static void nci_core_conn_create_rsp_packet(struct nci_dev *ndev,
306 const struct sk_buff *skb)
307 {
308 __u8 status = skb->data[0];
309 struct nci_conn_info *conn_info = NULL;
310 const struct nci_core_conn_create_rsp *rsp;
311
312 pr_debug("status 0x%x\n", status);
313
314 if (status == NCI_STATUS_OK) {
315 rsp = (struct nci_core_conn_create_rsp *)skb->data;
316
317 conn_info = devm_kzalloc(&ndev->nfc_dev->dev,
318 sizeof(*conn_info), GFP_KERNEL);
319 if (!conn_info) {
320 status = NCI_STATUS_REJECTED;
321 goto exit;
322 }
323
324 conn_info->dest_params = devm_kzalloc(&ndev->nfc_dev->dev,
325 sizeof(struct dest_spec_params),
326 GFP_KERNEL);
327 if (!conn_info->dest_params) {
328 status = NCI_STATUS_REJECTED;
329 goto free_conn_info;
330 }
331
332 conn_info->dest_type = ndev->cur_dest_type;
333 conn_info->dest_params->id = ndev->cur_params.id;
334 conn_info->dest_params->protocol = ndev->cur_params.protocol;
335 conn_info->conn_id = rsp->conn_id;
336
337 /* Note: data_exchange_cb and data_exchange_cb_context need to
338 * be specify out of nci_core_conn_create_rsp_packet
339 */
340
341 INIT_LIST_HEAD(&conn_info->list);
342 list_add(&conn_info->list, &ndev->conn_info_list);
343
344 if (ndev->cur_params.id == ndev->hci_dev->nfcee_id)
345 ndev->hci_dev->conn_info = conn_info;
346
347 conn_info->conn_id = rsp->conn_id;
348 conn_info->max_pkt_payload_len = rsp->max_ctrl_pkt_payload_len;
349 atomic_set(&conn_info->credits_cnt, rsp->credits_cnt);
350 }
351
352 free_conn_info:
353 if (status == NCI_STATUS_REJECTED)
354 devm_kfree(&ndev->nfc_dev->dev, conn_info);
355 exit:
356
357 nci_req_complete(ndev, status);
358 }
359
nci_core_conn_close_rsp_packet(struct nci_dev * ndev,const struct sk_buff * skb)360 static void nci_core_conn_close_rsp_packet(struct nci_dev *ndev,
361 const struct sk_buff *skb)
362 {
363 struct nci_conn_info *conn_info;
364 __u8 status = skb->data[0];
365
366 pr_debug("status 0x%x\n", status);
367 if (status == NCI_STATUS_OK) {
368 conn_info = nci_get_conn_info_by_conn_id(ndev,
369 ndev->cur_conn_id);
370 if (conn_info) {
371 list_del(&conn_info->list);
372 if (conn_info == ndev->rf_conn_info)
373 ndev->rf_conn_info = NULL;
374 devm_kfree(&ndev->nfc_dev->dev, conn_info->dest_params);
375 devm_kfree(&ndev->nfc_dev->dev, conn_info);
376 }
377 }
378 nci_req_complete(ndev, status);
379 }
380
nci_rsp_packet(struct nci_dev * ndev,struct sk_buff * skb)381 void nci_rsp_packet(struct nci_dev *ndev, struct sk_buff *skb)
382 {
383 __u16 rsp_opcode = nci_opcode(skb->data);
384
385 /* we got a rsp, stop the cmd timer */
386 timer_delete(&ndev->cmd_timer);
387
388 pr_debug("NCI RX: MT=rsp, PBF=%d, GID=0x%x, OID=0x%x, plen=%d\n",
389 nci_pbf(skb->data),
390 nci_opcode_gid(rsp_opcode),
391 nci_opcode_oid(rsp_opcode),
392 nci_plen(skb->data));
393
394 /* strip the nci control header */
395 skb_pull(skb, NCI_CTRL_HDR_SIZE);
396
397 if (nci_opcode_gid(rsp_opcode) == NCI_GID_PROPRIETARY) {
398 if (nci_prop_rsp_packet(ndev, rsp_opcode, skb) == -ENOTSUPP) {
399 pr_err("unsupported rsp opcode 0x%x\n",
400 rsp_opcode);
401 }
402
403 goto end;
404 }
405
406 switch (rsp_opcode) {
407 case NCI_OP_CORE_RESET_RSP:
408 nci_core_reset_rsp_packet(ndev, skb);
409 break;
410
411 case NCI_OP_CORE_INIT_RSP:
412 nci_core_init_rsp_packet(ndev, skb);
413 break;
414
415 case NCI_OP_CORE_SET_CONFIG_RSP:
416 nci_core_set_config_rsp_packet(ndev, skb);
417 break;
418
419 case NCI_OP_CORE_CONN_CREATE_RSP:
420 nci_core_conn_create_rsp_packet(ndev, skb);
421 break;
422
423 case NCI_OP_CORE_CONN_CLOSE_RSP:
424 nci_core_conn_close_rsp_packet(ndev, skb);
425 break;
426
427 case NCI_OP_RF_DISCOVER_MAP_RSP:
428 nci_rf_disc_map_rsp_packet(ndev, skb);
429 break;
430
431 case NCI_OP_RF_DISCOVER_RSP:
432 nci_rf_disc_rsp_packet(ndev, skb);
433 break;
434
435 case NCI_OP_RF_DISCOVER_SELECT_RSP:
436 nci_rf_disc_select_rsp_packet(ndev, skb);
437 break;
438
439 case NCI_OP_RF_DEACTIVATE_RSP:
440 nci_rf_deactivate_rsp_packet(ndev, skb);
441 break;
442
443 case NCI_OP_NFCEE_DISCOVER_RSP:
444 nci_nfcee_discover_rsp_packet(ndev, skb);
445 break;
446
447 case NCI_OP_NFCEE_MODE_SET_RSP:
448 nci_nfcee_mode_set_rsp_packet(ndev, skb);
449 break;
450
451 default:
452 pr_err("unknown rsp opcode 0x%x\n", rsp_opcode);
453 break;
454 }
455
456 nci_core_rsp_packet(ndev, rsp_opcode, skb);
457 end:
458 kfree_skb(skb);
459
460 /* trigger the next cmd */
461 atomic_set(&ndev->cmd_cnt, 1);
462 if (!skb_queue_empty(&ndev->cmd_q))
463 queue_work(ndev->cmd_wq, &ndev->cmd_work);
464 }
465