1 /* 2 * This file and its contents are supplied under the terms of the 3 * Common Development and Distribution License ("CDDL"), version 1.0. 4 * You may only use this file in accordance with the terms of version 5 * 1.0 of the CDDL. 6 * 7 * A full copy of the text of the CDDL should have accompanied this 8 * source. A copy of the CDDL is also available via the Internet at 9 * http://www.illumos.org/license/CDDL. 10 */ 11 12 /* 13 * Copyright 2019, Joyent, Inc. 14 */ 15 16 /* 17 * USB CCID class driver 18 * 19 * Slot Detection 20 * -------------- 21 * 22 * A CCID reader has one or more slots, each of which may or may not have a ICC 23 * (integrated circuit card) present. Some readers actually have a card that's 24 * permanently plugged in while other readers allow for cards to be inserted and 25 * removed. We model all CCID readers that don't have removable cards as ones 26 * that are removable, but never fire any events. Readers with removable cards 27 * are required to have an Interrupt-IN pipe. 28 * 29 * Each slot starts in an unknown state. After attaching we always kick off a 30 * discovery. When a change event comes in, that causes us to kick off a 31 * discovery again, though we focus it only on those endpoints that have noted a 32 * change. At attach time we logically mark that every endpoint has changed, 33 * allowing us to figure out what its actual state is. We don't rely on any 34 * initial Interrupt-IN polling to allow for the case where either the hardware 35 * doesn't report it or to better handle the devices without an Interrupt-IN 36 * entry. Just because we open up the Interrupt-IN pipe, hardware is not 37 * obligated to tell us, as the detaching and reattaching of a driver will not 38 * cause a power cycle. 39 * 40 * The Interrupt-IN exception callback may need to restart polling. In addition, 41 * we may fail to start or restart polling due to a transient issue. In cases 42 * where the attempt to start polling has failed, we try again in one second 43 * with a timeout. 44 * 45 * Discovery is run through a taskq. The various slots are checked serially. If 46 * a discovery is running when another change event comes in, we flag ourselves 47 * for a follow up run. This means that it's possible that we end up processing 48 * items early and that the follow up run is ignored. 49 * 50 * Two state flags are used to keep track of this dance: CCID_F_WORKER_REQUESTED 51 * and CCID_F_WORKER_RUNNING. The first is used to indicate that discovery is 52 * desired. The second is to indicate that it is actively running. When 53 * discovery is requested, the caller first checks the current flags. If neither 54 * flag is set, then it knows that it can kick off discovery. Regardless if it 55 * can kick off the taskq, it always sets requested. Once the taskq entry 56 * starts, it removes any DISCOVER_REQUESTED flags and sets DISCOVER_RUNNING. If 57 * at the end of discovery, we find that another request has been made, the 58 * discovery function will kick off another entry in the taskq. 59 * 60 * The one possible problem with this model is that it means that we aren't 61 * throttling the set of incoming requests with respect to taskq dispatches. 62 * However, because these are only driven by an Interrupt-IN pipe, it is hoped 63 * that the frequency will be rather reduced. If it turns out that that's not 64 * the case, we may need to use a timeout or another trick to ensure that only 65 * one discovery per tick or so is initialized. The main reason we don't just do 66 * that off the bat and add a delay is because of contactless cards which may 67 * need to be acted upon in a soft real-time fashion. 68 * 69 * Command Handling 70 * ---------------- 71 * 72 * Commands are issued to a CCID reader on a Bulk-OUT pipe. Responses are 73 * generated as a series of one or more messages on a Bulk-IN pipe. To correlate 74 * these commands a sequence number is used. This sequence number is one byte 75 * and can be in the range [ CCID_SEQ_MIN, CCID_SEQ_MAX ]. To keep track of the 76 * allocated IDs we leverage an ID space. 77 * 78 * A CCID reader contains a number of slots. Each slot can be addressed 79 * separately as each slot represents a separate place that a card may be 80 * inserted or not. A given slot may only have a single outstanding command. A 81 * given CCID reader may only have a number of commands outstanding to the CCID 82 * device as a whole based on a value in the class descriptor (see the 83 * ccd_bMacCCIDBusySlots member of the ccid_class_descr_t). 84 * 85 * To simplify the driver, we only support issuing a single command to a CCID 86 * reader at any given time. All commands that are outstanding are queued in a 87 * per-device list ccid_command_queue. The head of the queue is the current 88 * command that we believe is outstanding to the reader or will be shortly. The 89 * command is issued by sending a Bulk-OUT request with a CCID header. Once we 90 * have the Bulk-OUT request acknowledged, we begin sending Bulk-IN messages to 91 * the controller. Once the Bulk-IN message is acknowledged, then we complete 92 * the command and proceed to the next command. This is summarized in the 93 * following state machine: 94 * 95 * +-----------------------------------------------------+ 96 * | | 97 * | ccid_command_queue | 98 * | +---+---+---------+---+---+ | 99 * v | h | | | | t | | 100 * +-------------------------+ | e | | | | a | | 101 * | ccid_command_dispatch() |<-----| a | | ... | | i | | 102 * +-----------+-------------+ | d | | | | l | | 103 * | +---+---+---------+---+---+ | 104 * v | 105 * +-------------------------+ +-------------------------+ | 106 * | usb_pipe_bulk_xfer() |----->| ccid_dispatch_bulk_cb() | | 107 * | ccid_bulkout_pipe | +------------+------------+ | 108 * +-------------------------+ | | 109 * | | 110 * | v | 111 * | +-------------------------+ | 112 * | | ccid_bulkin_schedule() | | 113 * v +------------+------------+ | 114 * | | 115 * /--------------------\ | | 116 * / \ v | 117 * | ### CCID HW | +-------------------------+ | 118 * | ### | | usb_pipe_bulk_xfer() | | 119 * | | ----> | ccid_bulkin_pipe | | 120 * | | +------------+------------+ | 121 * \ / | | 122 * \--------------------/ | | 123 * v | 124 * +-------------------------+ | 125 * | ccid_reply_bulk_cb() | | 126 * +------------+------------+ | 127 * | | 128 * | | 129 * v | 130 * +-------------------------+ | 131 * | ccid_command_complete() +------+ 132 * +-------------------------+ 133 * 134 * 135 * APDU and TPDU Processing and Parameter Selection 136 * ------------------------------------------------ 137 * 138 * Readers provide four different modes for us to be able to transmit data to 139 * and from the card. These are: 140 * 141 * 1. Character Mode 142 * 2. TPDU Mode 143 * 3. Short APDU Mode 144 * 4. Extended APDU Mode 145 * 146 * Readers either support mode 1, mode 2, mode 3, or mode 3 and 4. All readers 147 * that support extended APDUs support short APDUs. At this time, we do not 148 * support character mode or TPDU mode, and we use only short APDUs even for 149 * readers that support extended APDUs. 150 * 151 * The ICC and the reader need to be in agreement in order for them to be able 152 * to exchange information. The ICC indicates what it supports by replying to a 153 * power on command with an ATR (answer to reset). This data can be parsed to 154 * indicate which of two protocols the ICC supports. These protocols are 155 * referred to as: 156 * 157 * o T=0 158 * o T=1 159 * 160 * These protocols are defined in the ISO/IEC 7816-3:2006 specification. When a 161 * reader supports an APDU mode, then the driver does not have to worry about 162 * the underlying protocol and can just send an application data unit (APDU). 163 * Otherwise, the driver must take the application data (APDU) and transform it 164 * into the form required by the corresponding protocol. 165 * 166 * There are several parameters that need to be negotiated to ensure that the 167 * protocols work correctly. To negotiate these parameters and to select a 168 * protocol, the driver must construct a PPS (protocol and parameters structure) 169 * request and exchange that with the ICC. A reader may optionally take care of 170 * performing this and indicates its support for this in dwFeatures member of 171 * the USB class descriptor. 172 * 173 * In addition, the reader itself must often be told of these configuration 174 * changes through the means of a CCID_REQUEST_SET_PARAMS command. Once both of 175 * these have been performed, the reader and ICC can communicate to their hearts 176 * desire. 177 * 178 * Both the negotiation and the setting of the parameters can be performed 179 * automatically by the CCID reader. When the reader supports APDU exchanges, 180 * then it must support some aspects of this negotiation. Because of that, we 181 * never consider performing this and only support readers that offer this kind 182 * of automation. 183 * 184 * User I/O Basics 185 * --------------- 186 * 187 * A user performs I/O by writing APDUs (Application Protocol Data Units). A 188 * user issues a system call that ends up in write(9E) (write(2), writev(2), 189 * pwrite(2), pwritev(2), etc.). The user data is consumed by the CCID driver 190 * and a series of commands will then be issued to the device, depending on the 191 * protocol mode. The write(9E) call does not block for this to finish. Once 192 * write(9E) has returned, the user may block in a read(2) related system call 193 * or poll for POLLIN. 194 * 195 * A thread may not call read(9E) without having called write(9E). This model is 196 * due to the limited capability of hardware. Only a single command can be going 197 * on a given slot and due to the fact that many commands change the hardware 198 * state, we do not try to multiplex multiple calls to write() or read(). 199 * 200 * 201 * User I/O, Transaction Ends, ICC removals, and Reader Removals 202 * ------------------------------------------------------------- 203 * 204 * While the I/O model given to user land is somewhat simple, there are a lot of 205 * tricky pieces to get right because we are in a multi-threaded pre-emptible 206 * system. In general, there are four different levels of state that we need to 207 * keep track of: 208 * 209 * 1. User threads in I/O 210 * 2. Kernel protocol level support (T=1, apdu, etc.). 211 * 3. Slot/ICC state 212 * 4. CCID Reader state 213 * 214 * Of course, each level cares about the state above it. The kernel protocol 215 * level state (2) cares about the User threads in I/O (1). The same is true 216 * with the other levels caring about the levels above it. With this in mind 217 * there are three non-data path things that can go wrong: 218 * 219 * A. The user can end a transaction (whether through an ioctl or close(9E)). 220 * B. The ICC can be removed 221 * C. The CCID device can be removed or reset at a USB level. 222 * 223 * Each of these has implications on the outstanding I/O and other states of 224 * the world. When events of type A occur, we need to clean up states 1 and 2. 225 * Then events of type B occur we need to clean up states 1-3. When events of 226 * type C occur we need to clean up states 1-4. The following discusses how we 227 * should clean up these different states: 228 * 229 * Cleaning up State 1: 230 * 231 * To clean up the User threads in I/O there are three different cases to 232 * consider. The first is cleaning up a thread that is in the middle of 233 * write(9E). The second is cleaning up thread that is blocked in read(9E). 234 * The third is dealing with threads that are stuck in chpoll(9E). 235 * 236 * To handle the write case, we have a series of flags that is on the CCID 237 * slot's I/O structure (ccid_io_t, cs_io on the ccid_slot_t). When a thread 238 * begins its I/O it will set the CCID_IO_F_PREPARING flag. This flag is used 239 * to indicate that there is a thread that is performing a write(9E), but it 240 * is not holding the ccid_mutex because of the operations that it is taking. 241 * Once it has finished, the thread will remove that flag and instead 242 * CCID_IO_F_IN_PROGRESS will be set. If we find that the CCID_IO_F_PREPARING 243 * flag is set, then we will need to wait for it to be removed before 244 * continuing. The fact that there is an outstanding physical I/O will be 245 * dealt with when we clean up state 2. 246 * 247 * To handle the read case, we have a flag on the ccid_minor_t which indicates 248 * that a thread is blocked on a condition variable (cm_read_cv), waiting for 249 * the I/O to complete. The way this gets cleaned up varies a bit on each of 250 * the different cases as each one will trigger a different error to the 251 * thread. In all cases, the condition variable will be signaled. Then, 252 * whenever the thread comes out of the condition variable it will always 253 * check the state to see if it has been woken up because the transaction is 254 * being closed, the ICC has been removed, or the reader is being 255 * disconnected. In all such cases, the thread in read will end up receiving 256 * an error (ECANCELED, ENXIO, and ENODEV respectively). 257 * 258 * If we have hit the case that this needs to be cleaned up, then the 259 * CCID_MINOR_F_READ_WAITING flag will be set on the ccid_minor_t's flags 260 * member (cm_flags). In this case, the broader system must change the 261 * corresponding system state flag for the appropriate condition, signal the 262 * read cv, and then wait on an additional cv in the minor, the 263 * ccid_iowait_cv). 264 * 265 * Cleaning up the poll state is somewhat simpler. If any of the conditions 266 * (A-C) occur, then we must flag POLLERR. In addition if B and C occur, then 267 * we will flag POLLHUP at the same time. This will guarantee that any threads 268 * in poll(9E) are woken up. 269 * 270 * Cleaning up State 2. 271 * 272 * While the user I/O thread is a somewhat straightforward, the kernel 273 * protocol level is a bit more complicated. The core problem is that when a 274 * user issues a logical I/O through an APDU, that may result in a series of 275 * one or more protocol level physical commands. The core crux of the issue 276 * with cleaning up this state is twofold: 277 * 278 * 1. We don't want to block a user thread while I/O is outstanding 279 * 2. We need to take one of several steps to clean up the aforementioned 280 * I/O 281 * 282 * To try and deal with that, there are a number of different things that we 283 * do. The first thing we do is that we clean up the user state based on the 284 * notes in cleaning up in State 1. Importantly we need to _block_ on this 285 * activity. 286 * 287 * Once that is done, we need to proceed to step 2. Since we're doing only 288 * APDU processing, this is as simple as waiting for that command to complete 289 * and/or potentially issue an abort or reset. 290 * 291 * While this is ongoing an additional flag (CCID_SLOT_F_NEED_IO_TEARDOWN) 292 * will be set on the slot to make sure that we know that we can't issue new 293 * I/O or that we can't proceed to the next transaction until this phase is 294 * finished. 295 * 296 * Cleaning up State 3 297 * 298 * When the ICC is removed, this is not dissimilar to the previous states. To 299 * handle this we need to first make sure that state 1 and state 2 are 300 * finished being cleaned up. We will have to _block_ on this from the worker 301 * thread. The problem is that we have certain values such as the operations 302 * vector, the ATR data, etc. that we need to make sure are still valid while 303 * we're in the process of cleaning up state. Once all that is done and the 304 * worker thread proceeds we will consider processing a new ICC insertion. 305 * The one good side is that if the ICC was removed, then it should be simpler 306 * to handle all of the outstanding I/O. 307 * 308 * Cleaning up State 4 309 * 310 * When the reader is removed, then we need to clean up all the prior states. 311 * However, this is somewhat simpler than the other cases, as once this 312 * happens our detach endpoint will be called to clean up all of our 313 * resources. Therefore, before we call detach, we need to explicitly clean up 314 * state 1; however, we then at this time leave all the remaining state to be 315 * cleaned up during detach(9E) as part of normal tear down. 316 */ 317 318 #include <sys/modctl.h> 319 #include <sys/errno.h> 320 #include <sys/conf.h> 321 #include <sys/ddi.h> 322 #include <sys/sunddi.h> 323 #include <sys/cmn_err.h> 324 #include <sys/sysmacros.h> 325 #include <sys/stream.h> 326 #include <sys/strsun.h> 327 #include <sys/strsubr.h> 328 #include <sys/filio.h> 329 330 #define USBDRV_MAJOR_VER 2 331 #define USBDRV_MINOR_VER 0 332 #include <sys/usb/usba.h> 333 #include <sys/usb/usba/usbai_private.h> 334 #include <sys/usb/clients/ccid/ccid.h> 335 #include <sys/usb/clients/ccid/uccid.h> 336 337 #include <atr.h> 338 339 /* 340 * Set the amount of parallelism we'll want to have from kernel threads which 341 * are processing CCID requests. This is used to size the number of asynchronous 342 * requests in the pipe policy. A single command can only ever be outstanding to 343 * a single slot. However, multiple slots may potentially be able to be 344 * scheduled in parallel. However, we don't actually support this at all and 345 * we'll only ever issue a single command. This basically covers the ability to 346 * have some other asynchronous operation outstanding if needed. 347 */ 348 #define CCID_NUM_ASYNC_REQS 2 349 350 /* 351 * This is the number of Bulk-IN requests that we will have cached per CCID 352 * device. While many commands will generate a single response, the commands 353 * also have the ability to generate time extensions, which means that we'll 354 * want to be able to schedule another Bulk-IN request immediately. If we run 355 * out, we will attempt to refill said cache and will not fail commands 356 * needlessly. 357 */ 358 #define CCID_BULK_NALLOCED 16 359 360 /* 361 * This is a time in seconds for the bulk-out command to run and be submitted. 362 */ 363 #define CCID_BULK_OUT_TIMEOUT 5 364 #define CCID_BULK_IN_TIMEOUT 5 365 366 /* 367 * There are two different Interrupt-IN packets that we might receive. The 368 * first, RDR_to_PC_HardwareError, is a fixed four byte packet. However, the 369 * other one, RDR_to_PC_NotifySlotChange, varies in size as it has two bits per 370 * potential slot plus one byte that's always used. The maximum number of slots 371 * in a device is 256. This means there can be up to 64 bytes worth of data plus 372 * the extra byte, so 65 bytes. 373 */ 374 #define CCID_INTR_RESPONSE_SIZE 65 375 376 /* 377 * Minimum and maximum minor ids. We treat the maximum valid 32-bit minor as 378 * what we can use due to issues in some file systems and the minors that they 379 * can use. We reserved zero as an invalid minor number to make it easier to 380 * tell if things have been initialized or not. 381 */ 382 #define CCID_MINOR_MIN 1 383 #define CCID_MINOR_MAX MAXMIN32 384 #define CCID_MINOR_INVALID 0 385 386 /* 387 * This value represents the minimum size value that we require in the CCID 388 * class descriptor's dwMaxCCIDMessageLength member. We got to 64 bytes based on 389 * the required size of a bulk transfer packet size. Especially as many CCID 390 * devices are these class of speeds. The specification does require that the 391 * minimum size of the dwMaxCCIDMessageLength member is at least the size of its 392 * bulk endpoint packet size. 393 */ 394 #define CCID_MIN_MESSAGE_LENGTH 64 395 396 /* 397 * Required forward declarations. 398 */ 399 struct ccid; 400 struct ccid_slot; 401 struct ccid_minor; 402 struct ccid_command; 403 404 /* 405 * This structure is used to map between the global set of minor numbers and the 406 * things represented by them. 407 * 408 * We have two different kinds of minor nodes. The first are CCID slots. The 409 * second are cloned opens of those slots. Each of these items has a 410 * ccid_minor_idx_t embedded in them that is used to index them in an AVL tree. 411 * Given that the number of entries that should be present here is unlikely to 412 * be terribly large at any given time, it is hoped that an AVL tree will 413 * suffice for now. 414 */ 415 typedef struct ccid_minor_idx { 416 id_t cmi_minor; 417 avl_node_t cmi_avl; 418 boolean_t cmi_isslot; 419 union { 420 struct ccid_slot *cmi_slot; 421 struct ccid_minor *cmi_user; 422 } cmi_data; 423 } ccid_minor_idx_t; 424 425 typedef enum ccid_minor_flags { 426 CCID_MINOR_F_WAITING = 1 << 0, 427 CCID_MINOR_F_HAS_EXCL = 1 << 1, 428 CCID_MINOR_F_TXN_RESET = 1 << 2, 429 CCID_MINOR_F_READ_WAITING = 1 << 3, 430 CCID_MINOR_F_WRITABLE = 1 << 4, 431 } ccid_minor_flags_t; 432 433 typedef struct ccid_minor { 434 ccid_minor_idx_t cm_idx; /* write-once */ 435 cred_t *cm_opener; /* write-once */ 436 struct ccid_slot *cm_slot; /* write-once */ 437 list_node_t cm_minor_list; 438 list_node_t cm_excl_list; 439 kcondvar_t cm_read_cv; 440 kcondvar_t cm_iowait_cv; 441 kcondvar_t cm_excl_cv; 442 ccid_minor_flags_t cm_flags; 443 struct pollhead cm_pollhead; 444 } ccid_minor_t; 445 446 typedef enum ccid_slot_flags { 447 CCID_SLOT_F_CHANGED = 1 << 0, 448 CCID_SLOT_F_INTR_GONE = 1 << 1, 449 CCID_SLOT_F_INTR_ADD = 1 << 2, 450 CCID_SLOT_F_PRESENT = 1 << 3, 451 CCID_SLOT_F_ACTIVE = 1 << 4, 452 CCID_SLOT_F_NEED_TXN_RESET = 1 << 5, 453 CCID_SLOT_F_NEED_IO_TEARDOWN = 1 << 6, 454 CCID_SLOT_F_INTR_OVERCURRENT = 1 << 7, 455 } ccid_slot_flags_t; 456 457 #define CCID_SLOT_F_INTR_MASK (CCID_SLOT_F_CHANGED | CCID_SLOT_F_INTR_GONE | \ 458 CCID_SLOT_F_INTR_ADD) 459 #define CCID_SLOT_F_WORK_MASK (CCID_SLOT_F_INTR_MASK | \ 460 CCID_SLOT_F_NEED_TXN_RESET | CCID_SLOT_F_INTR_OVERCURRENT) 461 #define CCID_SLOT_F_NOEXCL_MASK (CCID_SLOT_F_NEED_TXN_RESET | \ 462 CCID_SLOT_F_NEED_IO_TEARDOWN) 463 464 typedef void (*icc_init_func_t)(struct ccid *, struct ccid_slot *); 465 typedef int (*icc_transmit_func_t)(struct ccid *, struct ccid_slot *); 466 typedef void (*icc_complete_func_t)(struct ccid *, struct ccid_slot *, 467 struct ccid_command *); 468 typedef void (*icc_teardown_func_t)(struct ccid *, struct ccid_slot *, int); 469 typedef void (*icc_fini_func_t)(struct ccid *, struct ccid_slot *); 470 471 typedef struct ccid_icc { 472 atr_data_t *icc_atr_data; 473 atr_protocol_t icc_protocols; 474 atr_protocol_t icc_cur_protocol; 475 ccid_params_t icc_params; 476 icc_init_func_t icc_init; 477 icc_transmit_func_t icc_tx; 478 icc_complete_func_t icc_complete; 479 icc_teardown_func_t icc_teardown; 480 icc_fini_func_t icc_fini; 481 } ccid_icc_t; 482 483 /* 484 * Structure used to take care of and map I/O requests and things. This may not 485 * make sense as we develop the T=0 and T=1 code. 486 */ 487 typedef enum ccid_io_flags { 488 /* 489 * This flag is used during the period that a thread has started calling 490 * into ccid_write(9E), but before it has finished queuing up the write. 491 * This blocks pollout or another thread in write. 492 */ 493 CCID_IO_F_PREPARING = 1 << 0, 494 /* 495 * This flag is used once a ccid_write() ICC tx function has 496 * successfully completed. While this is set, the device is not 497 * writable; however, it is legal to call ccid_read() and block. This 498 * flag will remain set until the actual write is done. This indicates 499 * that the transmission protocol has finished. 500 */ 501 CCID_IO_F_IN_PROGRESS = 1 << 1, 502 /* 503 * This flag is used to indicate that the logical I/O has completed in 504 * one way or the other and that a reader can consume data. When this 505 * flag is set, then POLLIN | POLLRDNORM should be signaled. Until the 506 * I/O is consumed via ccid_read(), calls to ccid_write() will fail with 507 * EBUSY. When this flag is set, the kernel protocol level should be 508 * idle and it should be safe to tear down. 509 */ 510 CCID_IO_F_DONE = 1 << 2, 511 } ccid_io_flags_t; 512 513 /* 514 * If any of the flags in the POLLOUT group are set, then the device is not 515 * writeable. The same distinction isn't true for POLLIN. We are only readable 516 * if CCID_IO_F_DONE is set. However, you are allowed to call read as soon as 517 * CCID_IO_F_IN_PROGRESS is set. 518 */ 519 #define CCID_IO_F_POLLOUT_FLAGS (CCID_IO_F_PREPARING | CCID_IO_F_IN_PROGRESS | \ 520 CCID_IO_F_DONE) 521 #define CCID_IO_F_ALL_FLAGS (CCID_IO_F_PREPARING | CCID_IO_F_IN_PROGRESS | \ 522 CCID_IO_F_DONE | CCID_IO_F_ABANDONED) 523 524 typedef struct ccid_io { 525 ccid_io_flags_t ci_flags; 526 size_t ci_ilen; 527 uint8_t ci_ibuf[CCID_APDU_LEN_MAX]; 528 mblk_t *ci_omp; 529 kcondvar_t ci_cv; 530 struct ccid_command *ci_command; 531 int ci_errno; 532 mblk_t *ci_data; 533 } ccid_io_t; 534 535 typedef struct ccid_slot { 536 ccid_minor_idx_t cs_idx; /* WO */ 537 uint_t cs_slotno; /* WO */ 538 struct ccid *cs_ccid; /* WO */ 539 ccid_slot_flags_t cs_flags; 540 ccid_class_voltage_t cs_voltage; 541 mblk_t *cs_atr; 542 struct ccid_command *cs_command; 543 ccid_minor_t *cs_excl_minor; 544 list_t cs_excl_waiters; 545 list_t cs_minors; 546 ccid_icc_t cs_icc; 547 ccid_io_t cs_io; 548 } ccid_slot_t; 549 550 typedef enum ccid_attach_state { 551 CCID_ATTACH_USB_CLIENT = 1 << 0, 552 CCID_ATTACH_MUTEX_INIT = 1 << 1, 553 CCID_ATTACH_TASKQ = 1 << 2, 554 CCID_ATTACH_CMD_LIST = 1 << 3, 555 CCID_ATTACH_OPEN_PIPES = 1 << 4, 556 CCID_ATTACH_SEQ_IDS = 1 << 5, 557 CCID_ATTACH_SLOTS = 1 << 6, 558 CCID_ATTACH_HOTPLUG_CB = 1 << 7, 559 CCID_ATTACH_INTR_ACTIVE = 1 << 8, 560 CCID_ATTACH_MINORS = 1 << 9, 561 } ccid_attach_state_t; 562 563 typedef enum ccid_flags { 564 CCID_F_HAS_INTR = 1 << 0, 565 CCID_F_NEEDS_PPS = 1 << 1, 566 CCID_F_NEEDS_PARAMS = 1 << 2, 567 CCID_F_NEEDS_DATAFREQ = 1 << 3, 568 CCID_F_DETACHING = 1 << 5, 569 CCID_F_WORKER_REQUESTED = 1 << 6, 570 CCID_F_WORKER_RUNNING = 1 << 7, 571 CCID_F_DISCONNECTED = 1 << 8 572 } ccid_flags_t; 573 574 #define CCID_F_DEV_GONE_MASK (CCID_F_DETACHING | CCID_F_DISCONNECTED) 575 #define CCID_F_WORKER_MASK (CCID_F_WORKER_REQUESTED | \ 576 CCID_F_WORKER_RUNNING) 577 578 typedef struct ccid_stats { 579 uint64_t cst_intr_errs; 580 uint64_t cst_intr_restart; 581 uint64_t cst_intr_unknown; 582 uint64_t cst_intr_slot_change; 583 uint64_t cst_intr_hwerr; 584 uint64_t cst_intr_inval; 585 uint64_t cst_ndiscover; 586 hrtime_t cst_lastdiscover; 587 } ccid_stats_t; 588 589 typedef struct ccid { 590 dev_info_t *ccid_dip; 591 kmutex_t ccid_mutex; 592 ccid_attach_state_t ccid_attach; 593 ccid_flags_t ccid_flags; 594 id_space_t *ccid_seqs; 595 ddi_taskq_t *ccid_taskq; 596 usb_client_dev_data_t *ccid_dev_data; 597 ccid_class_descr_t ccid_class; /* WO */ 598 usb_ep_xdescr_t ccid_bulkin_xdesc; /* WO */ 599 usb_pipe_handle_t ccid_bulkin_pipe; /* WO */ 600 usb_ep_xdescr_t ccid_bulkout_xdesc; /* WO */ 601 usb_pipe_handle_t ccid_bulkout_pipe; /* WO */ 602 usb_ep_xdescr_t ccid_intrin_xdesc; /* WO */ 603 usb_pipe_handle_t ccid_intrin_pipe; /* WO */ 604 usb_pipe_handle_t ccid_control_pipe; /* WO */ 605 uint_t ccid_nslots; /* WO */ 606 size_t ccid_bufsize; /* WO */ 607 ccid_slot_t *ccid_slots; 608 timeout_id_t ccid_poll_timeout; 609 ccid_stats_t ccid_stats; 610 list_t ccid_command_queue; 611 list_t ccid_complete_queue; 612 usb_bulk_req_t *ccid_bulkin_cache[CCID_BULK_NALLOCED]; 613 uint_t ccid_bulkin_alloced; 614 usb_bulk_req_t *ccid_bulkin_dispatched; 615 } ccid_t; 616 617 /* 618 * Command structure for an individual CCID command that we issue to a 619 * controller. Note that the command caches a copy of some of the data that's 620 * normally inside the CCID header in host-endian fashion. 621 */ 622 typedef enum ccid_command_state { 623 CCID_COMMAND_ALLOCATED = 0x0, 624 CCID_COMMAND_QUEUED, 625 CCID_COMMAND_DISPATCHED, 626 CCID_COMMAND_REPLYING, 627 CCID_COMMAND_COMPLETE, 628 CCID_COMMAND_TRANSPORT_ERROR, 629 CCID_COMMAND_CCID_ABORTED 630 } ccid_command_state_t; 631 632 typedef enum ccid_command_flags { 633 CCID_COMMAND_F_USER = 1 << 0, 634 } ccid_command_flags_t; 635 636 typedef struct ccid_command { 637 list_node_t cc_list_node; 638 kcondvar_t cc_cv; 639 uint8_t cc_mtype; 640 ccid_response_code_t cc_rtype; 641 uint8_t cc_slot; 642 ccid_command_state_t cc_state; 643 ccid_command_flags_t cc_flags; 644 int cc_usb; 645 usb_cr_t cc_usbcr; 646 size_t cc_reqlen; 647 id_t cc_seq; 648 usb_bulk_req_t *cc_ubrp; 649 ccid_t *cc_ccid; 650 hrtime_t cc_queue_time; 651 hrtime_t cc_dispatch_time; 652 hrtime_t cc_dispatch_cb_time; 653 hrtime_t cc_response_time; 654 hrtime_t cc_completion_time; 655 mblk_t *cc_response; 656 } ccid_command_t; 657 658 /* 659 * ddi_soft_state(9F) pointer. This is used for instances of a CCID controller. 660 */ 661 static void *ccid_softstate; 662 663 /* 664 * This is used to keep track of our minor nodes. 665 */ 666 static kmutex_t ccid_idxlock; 667 static avl_tree_t ccid_idx; 668 static id_space_t *ccid_minors; 669 670 /* 671 * Required Forwards 672 */ 673 static void ccid_intr_poll_init(ccid_t *); 674 static void ccid_worker_request(ccid_t *); 675 static void ccid_command_dispatch(ccid_t *); 676 static void ccid_command_free(ccid_command_t *); 677 static int ccid_bulkin_schedule(ccid_t *); 678 static void ccid_command_bcopy(ccid_command_t *, const void *, size_t); 679 680 static int ccid_write_apdu(ccid_t *, ccid_slot_t *); 681 static void ccid_complete_apdu(ccid_t *, ccid_slot_t *, ccid_command_t *); 682 static void ccid_teardown_apdu(ccid_t *, ccid_slot_t *, int); 683 684 685 static int 686 ccid_idx_comparator(const void *l, const void *r) 687 { 688 const ccid_minor_idx_t *lc = l, *rc = r; 689 690 if (lc->cmi_minor > rc->cmi_minor) 691 return (1); 692 if (lc->cmi_minor < rc->cmi_minor) 693 return (-1); 694 return (0); 695 } 696 697 static void 698 ccid_error(ccid_t *ccid, const char *fmt, ...) 699 { 700 va_list ap; 701 702 va_start(ap, fmt); 703 if (ccid != NULL) { 704 vdev_err(ccid->ccid_dip, CE_WARN, fmt, ap); 705 } else { 706 vcmn_err(CE_WARN, fmt, ap); 707 } 708 va_end(ap); 709 } 710 711 static void 712 ccid_minor_idx_free(ccid_minor_idx_t *idx) 713 { 714 ccid_minor_idx_t *ip; 715 716 VERIFY3S(idx->cmi_minor, !=, CCID_MINOR_INVALID); 717 mutex_enter(&ccid_idxlock); 718 ip = avl_find(&ccid_idx, idx, NULL); 719 VERIFY3P(idx, ==, ip); 720 avl_remove(&ccid_idx, idx); 721 id_free(ccid_minors, idx->cmi_minor); 722 idx->cmi_minor = CCID_MINOR_INVALID; 723 mutex_exit(&ccid_idxlock); 724 } 725 726 static boolean_t 727 ccid_minor_idx_alloc(ccid_minor_idx_t *idx, boolean_t sleep) 728 { 729 id_t id; 730 731 mutex_enter(&ccid_idxlock); 732 if (sleep) { 733 id = id_alloc(ccid_minors); 734 } else { 735 id = id_alloc_nosleep(ccid_minors); 736 } 737 if (id == -1) { 738 mutex_exit(&ccid_idxlock); 739 return (B_FALSE); 740 } 741 idx->cmi_minor = id; 742 avl_add(&ccid_idx, idx); 743 mutex_exit(&ccid_idxlock); 744 745 return (B_TRUE); 746 } 747 748 static ccid_minor_idx_t * 749 ccid_minor_find(minor_t m) 750 { 751 ccid_minor_idx_t i = { 0 }; 752 ccid_minor_idx_t *ret; 753 754 i.cmi_minor = m; 755 mutex_enter(&ccid_idxlock); 756 ret = avl_find(&ccid_idx, &i, NULL); 757 mutex_exit(&ccid_idxlock); 758 759 return (ret); 760 } 761 762 static ccid_minor_idx_t * 763 ccid_minor_find_user(minor_t m) 764 { 765 ccid_minor_idx_t *idx; 766 767 idx = ccid_minor_find(m); 768 if (idx == NULL) { 769 return (NULL); 770 } 771 VERIFY0(idx->cmi_isslot); 772 return (idx); 773 } 774 775 static void 776 ccid_clear_io(ccid_io_t *io) 777 { 778 freemsg(io->ci_data); 779 io->ci_data = NULL; 780 io->ci_errno = 0; 781 io->ci_flags &= ~CCID_IO_F_DONE; 782 io->ci_ilen = 0; 783 bzero(io->ci_ibuf, sizeof (io->ci_ibuf)); 784 } 785 786 /* 787 * Check if the conditions are met to signal the next exclusive holder. For this 788 * to be true, there should be no one holding it. In addition, there must be 789 * someone in the queue waiting. Finally, we want to make sure that the ICC, if 790 * present, is in a state where it could handle these kinds of issues. That 791 * means that we shouldn't have an outstanding I/O question or warm reset 792 * ongoing. However, we must not block this on the condition of an ICC being 793 * present. But, if the reader has been disconnected, don't signal anyone. 794 */ 795 static void 796 ccid_slot_excl_maybe_signal(ccid_slot_t *slot) 797 { 798 ccid_minor_t *cmp; 799 800 VERIFY(MUTEX_HELD(&slot->cs_ccid->ccid_mutex)); 801 802 if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) 803 return; 804 if (slot->cs_excl_minor != NULL) 805 return; 806 if ((slot->cs_flags & CCID_SLOT_F_NOEXCL_MASK) != 0) 807 return; 808 cmp = list_head(&slot->cs_excl_waiters); 809 if (cmp == NULL) 810 return; 811 cv_signal(&cmp->cm_excl_cv); 812 } 813 814 static void 815 ccid_slot_excl_rele(ccid_slot_t *slot) 816 { 817 ccid_minor_t *cmp; 818 ccid_t *ccid = slot->cs_ccid; 819 820 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 821 VERIFY3P(slot->cs_excl_minor, !=, NULL); 822 823 cmp = slot->cs_excl_minor; 824 825 /* 826 * If we have an outstanding command left by the user when they've 827 * closed the slot, we need to clean up this command. We need to call 828 * the protocol specific handler here to determine what to do. If the 829 * command has completed, but the user has never called read, then it 830 * will simply clean it up. Otherwise it will indicate that there is 831 * some amount of external state still ongoing to take care of and clean 832 * up later. 833 */ 834 if (slot->cs_icc.icc_teardown != NULL) { 835 slot->cs_icc.icc_teardown(ccid, slot, ECANCELED); 836 } 837 838 /* 839 * There may either be a thread blocked in read or in the process of 840 * preparing a write. In either case, we need to make sure that they're 841 * woken up or finish, before we finish tear down. 842 */ 843 while ((cmp->cm_flags & CCID_MINOR_F_READ_WAITING) != 0 || 844 (slot->cs_io.ci_flags & CCID_IO_F_PREPARING) != 0) { 845 cv_wait(&cmp->cm_iowait_cv, &ccid->ccid_mutex); 846 } 847 848 /* 849 * At this point, we hold the lock and there should be no other threads 850 * that are past the basic sanity checks. So at this point, note that 851 * this minor no longer has exclusive access (causing other read/write 852 * calls to fail) and start the process of cleaning up the outstanding 853 * I/O on the slot. It is OK that at this point the thread may try to 854 * obtain exclusive access again. It will end up blocking on everything 855 * else. 856 */ 857 cmp->cm_flags &= ~CCID_MINOR_F_HAS_EXCL; 858 slot->cs_excl_minor = NULL; 859 860 /* 861 * If at this point, we have an I/O that's noted as being done, but no 862 * one blocked in read, then we need to clean that up. The ICC teardown 863 * function is only designed to take care of in-flight I/Os. 864 */ 865 if ((slot->cs_io.ci_flags & CCID_IO_F_DONE) != 0) 866 ccid_clear_io(&slot->cs_io); 867 868 /* 869 * Regardless of when we're polling, we need to go through and error 870 * out. 871 */ 872 pollwakeup(&cmp->cm_pollhead, POLLERR); 873 874 /* 875 * If we've been asked to reset the card before handing it off, schedule 876 * that. Otherwise, allow the next entry in the queue to get woken up 877 * and given access to the card. 878 */ 879 if ((cmp->cm_flags & CCID_MINOR_F_TXN_RESET) != 0) { 880 slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET; 881 ccid_worker_request(ccid); 882 cmp->cm_flags &= ~CCID_MINOR_F_TXN_RESET; 883 } else { 884 ccid_slot_excl_maybe_signal(slot); 885 } 886 } 887 888 static int 889 ccid_slot_excl_req(ccid_slot_t *slot, ccid_minor_t *cmp, boolean_t nosleep) 890 { 891 VERIFY(MUTEX_HELD(&slot->cs_ccid->ccid_mutex)); 892 893 if (slot->cs_excl_minor == cmp) { 894 VERIFY((cmp->cm_flags & CCID_MINOR_F_HAS_EXCL) != 0); 895 return (EEXIST); 896 } 897 898 if ((cmp->cm_flags & CCID_MINOR_F_WAITING) != 0) { 899 return (EINPROGRESS); 900 } 901 902 /* 903 * If we were asked to try and fail quickly, do that before the main 904 * loop. 905 */ 906 if (nosleep && slot->cs_excl_minor != NULL && 907 (slot->cs_flags & CCID_SLOT_F_NOEXCL_MASK) == 0) { 908 return (EBUSY); 909 } 910 911 /* 912 * Mark that we're waiting in case we race with another thread trying to 913 * claim exclusive access for this. Insert ourselves on the wait list. 914 * If for some reason we get a signal, then we can't know for certain if 915 * we had a signal / cv race. In such a case, we always wake up the 916 * next person in the queue (potentially spuriously). 917 */ 918 cmp->cm_flags |= CCID_MINOR_F_WAITING; 919 list_insert_tail(&slot->cs_excl_waiters, cmp); 920 while (slot->cs_excl_minor != NULL || 921 (slot->cs_flags & CCID_SLOT_F_NOEXCL_MASK) != 0) { 922 if (cv_wait_sig(&cmp->cm_excl_cv, &slot->cs_ccid->ccid_mutex) == 923 0) { 924 /* 925 * Remove ourselves from the list and try to signal the 926 * next thread. 927 */ 928 list_remove(&slot->cs_excl_waiters, cmp); 929 cmp->cm_flags &= ~CCID_MINOR_F_WAITING; 930 ccid_slot_excl_maybe_signal(slot); 931 return (EINTR); 932 } 933 934 /* 935 * Check if the reader is going away. If so, then we're done 936 * here. 937 */ 938 if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 939 list_remove(&slot->cs_excl_waiters, cmp); 940 cmp->cm_flags &= ~CCID_MINOR_F_WAITING; 941 return (ENODEV); 942 } 943 } 944 945 VERIFY0(slot->cs_flags & CCID_SLOT_F_NOEXCL_MASK); 946 list_remove(&slot->cs_excl_waiters, cmp); 947 948 cmp->cm_flags &= ~CCID_MINOR_F_WAITING; 949 cmp->cm_flags |= CCID_MINOR_F_HAS_EXCL; 950 slot->cs_excl_minor = cmp; 951 return (0); 952 } 953 954 /* 955 * Check whether or not we're in a state that we can signal a POLLIN. To be able 956 * to signal a POLLIN (meaning that we can read) the following must be true: 957 * 958 * o There is a client that has an exclusive hold open 959 * o There is a data which is readable by the client (an I/O is done). 960 * 961 * Unlike with pollout, we don't care about the state of the ICC. 962 */ 963 static void 964 ccid_slot_pollin_signal(ccid_slot_t *slot) 965 { 966 ccid_t *ccid = slot->cs_ccid; 967 ccid_minor_t *cmp = slot->cs_excl_minor; 968 969 if (cmp == NULL) 970 return; 971 972 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 973 974 if ((slot->cs_io.ci_flags & CCID_IO_F_DONE) == 0) 975 return; 976 977 pollwakeup(&cmp->cm_pollhead, POLLIN | POLLRDNORM); 978 } 979 980 /* 981 * Check whether or not we're in a state that we can signal a POLLOUT. To be 982 * able to signal a POLLOUT (meaning that we can write) the following must be 983 * true: 984 * 985 * o There is a minor which has an exclusive hold on the device 986 * o There is no outstanding I/O activity going on, meaning that there is no 987 * operation in progress and any write data has been consumed. 988 * o There is an ICC present 989 * o There is no outstanding I/O cleanup being done, whether a T=1 abort, a 990 * warm reset, or something else. 991 */ 992 static void 993 ccid_slot_pollout_signal(ccid_slot_t *slot) 994 { 995 ccid_t *ccid = slot->cs_ccid; 996 ccid_minor_t *cmp = slot->cs_excl_minor; 997 998 if (cmp == NULL) 999 return; 1000 1001 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 1002 1003 if ((slot->cs_io.ci_flags & CCID_IO_F_POLLOUT_FLAGS) != 0 || 1004 (slot->cs_flags & CCID_SLOT_F_ACTIVE) == 0 || 1005 (ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0 || 1006 (slot->cs_flags & CCID_SLOT_F_NEED_IO_TEARDOWN) != 0) 1007 return; 1008 1009 pollwakeup(&cmp->cm_pollhead, POLLOUT); 1010 } 1011 1012 static void 1013 ccid_slot_io_teardown_done(ccid_slot_t *slot) 1014 { 1015 ccid_t *ccid = slot->cs_ccid; 1016 1017 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 1018 slot->cs_flags &= ~CCID_SLOT_F_NEED_IO_TEARDOWN; 1019 cv_broadcast(&slot->cs_io.ci_cv); 1020 1021 ccid_slot_pollout_signal(slot); 1022 } 1023 1024 /* 1025 * This will probably need to change when we start doing TPDU processing. 1026 */ 1027 static size_t 1028 ccid_command_resp_length(ccid_command_t *cc) 1029 { 1030 uint32_t len; 1031 const ccid_header_t *cch; 1032 1033 VERIFY3P(cc, !=, NULL); 1034 VERIFY3P(cc->cc_response, !=, NULL); 1035 1036 /* 1037 * Fetch out an arbitrarily aligned LE uint32_t value from the header. 1038 */ 1039 cch = (ccid_header_t *)cc->cc_response->b_rptr; 1040 bcopy(&cch->ch_length, &len, sizeof (len)); 1041 len = LE_32(len); 1042 return (len); 1043 } 1044 1045 static uint8_t 1046 ccid_command_resp_param2(ccid_command_t *cc) 1047 { 1048 const ccid_header_t *cch; 1049 uint8_t val; 1050 1051 VERIFY3P(cc, !=, NULL); 1052 VERIFY3P(cc->cc_response, !=, NULL); 1053 1054 cch = (ccid_header_t *)cc->cc_response->b_rptr; 1055 bcopy(&cch->ch_param2, &val, sizeof (val)); 1056 return (val); 1057 } 1058 1059 /* 1060 * Complete a single command. The way that a command completes depends on the 1061 * kind of command that occurs. If this command is flagged as a user command, 1062 * that implies that it must be handled in a different way from administrative 1063 * commands. User commands are placed into the minor to consume via a read(9E). 1064 * Non-user commands are placed into a completion queue and must be picked up 1065 * via the ccid_command_poll() interface. 1066 */ 1067 static void 1068 ccid_command_complete(ccid_command_t *cc) 1069 { 1070 ccid_t *ccid = cc->cc_ccid; 1071 1072 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 1073 cc->cc_completion_time = gethrtime(); 1074 list_remove(&ccid->ccid_command_queue, cc); 1075 1076 if (cc->cc_flags & CCID_COMMAND_F_USER) { 1077 ccid_slot_t *slot; 1078 1079 slot = &ccid->ccid_slots[cc->cc_slot]; 1080 ASSERT3P(slot->cs_icc.icc_complete, !=, NULL); 1081 slot->cs_icc.icc_complete(ccid, slot, cc); 1082 } else { 1083 list_insert_tail(&ccid->ccid_complete_queue, cc); 1084 cv_broadcast(&cc->cc_cv); 1085 } 1086 1087 /* 1088 * Finally, we also need to kick off the next command. 1089 */ 1090 ccid_command_dispatch(ccid); 1091 } 1092 1093 static void 1094 ccid_command_state_transition(ccid_command_t *cc, ccid_command_state_t state) 1095 { 1096 VERIFY(MUTEX_HELD(&cc->cc_ccid->ccid_mutex)); 1097 1098 cc->cc_state = state; 1099 cv_broadcast(&cc->cc_cv); 1100 } 1101 1102 static void 1103 ccid_command_transport_error(ccid_command_t *cc, int usb_status, usb_cr_t cr) 1104 { 1105 VERIFY(MUTEX_HELD(&cc->cc_ccid->ccid_mutex)); 1106 1107 ccid_command_state_transition(cc, CCID_COMMAND_TRANSPORT_ERROR); 1108 cc->cc_usb = usb_status; 1109 cc->cc_usbcr = cr; 1110 cc->cc_response = NULL; 1111 1112 ccid_command_complete(cc); 1113 } 1114 1115 static void 1116 ccid_command_status_decode(ccid_command_t *cc, 1117 ccid_reply_command_status_t *comp, ccid_reply_icc_status_t *iccp, 1118 ccid_command_err_t *errp) 1119 { 1120 ccid_header_t cch; 1121 size_t mblen; 1122 1123 VERIFY3S(cc->cc_state, ==, CCID_COMMAND_COMPLETE); 1124 VERIFY3P(cc->cc_response, !=, NULL); 1125 mblen = msgsize(cc->cc_response); 1126 VERIFY3U(mblen, >=, sizeof (cch)); 1127 1128 bcopy(cc->cc_response->b_rptr, &cch, sizeof (cch)); 1129 if (comp != NULL) { 1130 *comp = CCID_REPLY_STATUS(cch.ch_param0); 1131 } 1132 1133 if (iccp != NULL) { 1134 *iccp = CCID_REPLY_ICC(cch.ch_param0); 1135 } 1136 1137 if (errp != NULL) { 1138 *errp = cch.ch_param1; 1139 } 1140 } 1141 1142 static void 1143 ccid_reply_bulk_cb(usb_pipe_handle_t ph, usb_bulk_req_t *ubrp) 1144 { 1145 size_t mlen; 1146 ccid_t *ccid; 1147 ccid_slot_t *slot; 1148 ccid_header_t cch; 1149 ccid_command_t *cc; 1150 1151 boolean_t header_valid = B_FALSE; 1152 1153 VERIFY(ubrp->bulk_data != NULL); 1154 mlen = msgsize(ubrp->bulk_data); 1155 ccid = (ccid_t *)ubrp->bulk_client_private; 1156 mutex_enter(&ccid->ccid_mutex); 1157 1158 /* 1159 * Before we do anything else, we should mark that this Bulk-IN request 1160 * is no longer being dispatched. 1161 */ 1162 VERIFY3P(ubrp, ==, ccid->ccid_bulkin_dispatched); 1163 ccid->ccid_bulkin_dispatched = NULL; 1164 1165 if ((cc = list_head(&ccid->ccid_command_queue)) == NULL) { 1166 /* 1167 * This is certainly an odd case. This means that we got some 1168 * response but there are no entries in the queue. Go ahead and 1169 * free this. We're done here. 1170 */ 1171 mutex_exit(&ccid->ccid_mutex); 1172 usb_free_bulk_req(ubrp); 1173 return; 1174 } 1175 1176 if (mlen >= sizeof (ccid_header_t)) { 1177 bcopy(ubrp->bulk_data->b_rptr, &cch, sizeof (cch)); 1178 header_valid = B_TRUE; 1179 } 1180 1181 /* 1182 * If the current command isn't in the replying state, then something is 1183 * clearly wrong and this probably isn't intended for the current 1184 * command. That said, if we have enough bytes, let's check the sequence 1185 * number as that might be indicative of a bug otherwise. 1186 */ 1187 if (cc->cc_state != CCID_COMMAND_REPLYING) { 1188 if (header_valid) { 1189 VERIFY3S(cch.ch_seq, !=, cc->cc_seq); 1190 } 1191 mutex_exit(&ccid->ccid_mutex); 1192 usb_free_bulk_req(ubrp); 1193 return; 1194 } 1195 1196 /* 1197 * CCID section 6.2.7 says that if we get a short or zero length packet, 1198 * then we need to treat that as though the running command was aborted 1199 * for some reason. However, section 3.1.3 talks about sending zero 1200 * length packets on general principle. To further complicate things, 1201 * we don't have the sequence number. 1202 * 1203 * If we have an outstanding command still, then we opt to treat the 1204 * zero length packet as an abort. 1205 */ 1206 if (!header_valid) { 1207 ccid_command_state_transition(cc, CCID_COMMAND_CCID_ABORTED); 1208 ccid_command_complete(cc); 1209 mutex_exit(&ccid->ccid_mutex); 1210 usb_free_bulk_req(ubrp); 1211 return; 1212 } 1213 1214 slot = &ccid->ccid_slots[cc->cc_slot]; 1215 1216 /* 1217 * If the sequence or slot number don't match the head of the list or 1218 * the response type is unexpected for this command then we should be 1219 * very suspect of the hardware at this point. At a minimum we should 1220 * fail this command and issue a reset. 1221 */ 1222 if (cch.ch_seq != cc->cc_seq || 1223 cch.ch_slot != cc->cc_slot || 1224 cch.ch_mtype != cc->cc_rtype) { 1225 ccid_command_state_transition(cc, CCID_COMMAND_CCID_ABORTED); 1226 ccid_command_complete(cc); 1227 slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET; 1228 ccid_worker_request(ccid); 1229 mutex_exit(&ccid->ccid_mutex); 1230 usb_free_bulk_req(ubrp); 1231 return; 1232 } 1233 1234 /* 1235 * Check that we have all the bytes that we were told we'd have. If we 1236 * don't, simulate this as an aborted command and issue a reset. 1237 */ 1238 if (LE_32(cch.ch_length) + sizeof (ccid_header_t) > mlen) { 1239 ccid_command_state_transition(cc, CCID_COMMAND_CCID_ABORTED); 1240 ccid_command_complete(cc); 1241 slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET; 1242 ccid_worker_request(ccid); 1243 mutex_exit(&ccid->ccid_mutex); 1244 usb_free_bulk_req(ubrp); 1245 return; 1246 } 1247 1248 /* 1249 * This response is for us. Before we complete the command check to see 1250 * what the state of the command is. If the command indicates that more 1251 * time has been requested, then we need to schedule a new Bulk-IN 1252 * request. 1253 */ 1254 if (CCID_REPLY_STATUS(cch.ch_param0) == CCID_REPLY_STATUS_MORE_TIME) { 1255 int ret; 1256 1257 ret = ccid_bulkin_schedule(ccid); 1258 if (ret != USB_SUCCESS) { 1259 ccid_command_transport_error(cc, ret, USB_CR_OK); 1260 slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET; 1261 ccid_worker_request(ccid); 1262 } 1263 mutex_exit(&ccid->ccid_mutex); 1264 usb_free_bulk_req(ubrp); 1265 return; 1266 } 1267 1268 /* 1269 * Take the message block from the Bulk-IN request and store it on the 1270 * command. We want this regardless if it succeeded, failed, or we have 1271 * some unexpected status value. 1272 */ 1273 cc->cc_response = ubrp->bulk_data; 1274 ubrp->bulk_data = NULL; 1275 ccid_command_state_transition(cc, CCID_COMMAND_COMPLETE); 1276 ccid_command_complete(cc); 1277 mutex_exit(&ccid->ccid_mutex); 1278 usb_free_bulk_req(ubrp); 1279 } 1280 1281 static void 1282 ccid_reply_bulk_exc_cb(usb_pipe_handle_t ph, usb_bulk_req_t *ubrp) 1283 { 1284 ccid_t *ccid; 1285 ccid_command_t *cc; 1286 1287 ccid = (ccid_t *)ubrp->bulk_client_private; 1288 mutex_enter(&ccid->ccid_mutex); 1289 1290 /* 1291 * Before we do anything else, we should mark that this Bulk-IN request 1292 * is no longer being dispatched. 1293 */ 1294 VERIFY3P(ubrp, ==, ccid->ccid_bulkin_dispatched); 1295 ccid->ccid_bulkin_dispatched = NULL; 1296 1297 /* 1298 * While there are many different reasons that the Bulk-IN request could 1299 * have failed, each of these are treated as a transport error. If we 1300 * have a dispatched command, then we treat this as corresponding to 1301 * that command. Otherwise, we drop this. 1302 */ 1303 if ((cc = list_head(&ccid->ccid_command_queue)) != NULL) { 1304 if (cc->cc_state == CCID_COMMAND_REPLYING) { 1305 ccid_command_transport_error(cc, USB_SUCCESS, 1306 ubrp->bulk_completion_reason); 1307 } 1308 } 1309 mutex_exit(&ccid->ccid_mutex); 1310 usb_free_bulk_req(ubrp); 1311 } 1312 1313 /* 1314 * Fill the Bulk-IN cache. If we do not entirely fill this, that's fine. If 1315 * there are no scheduled resources then we'll deal with that when we actually 1316 * get there. 1317 */ 1318 static void 1319 ccid_bulkin_cache_refresh(ccid_t *ccid) 1320 { 1321 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 1322 while (ccid->ccid_bulkin_alloced < CCID_BULK_NALLOCED) { 1323 usb_bulk_req_t *ubrp; 1324 1325 if ((ubrp = usb_alloc_bulk_req(ccid->ccid_dip, 1326 ccid->ccid_bufsize, 0)) == NULL) 1327 return; 1328 1329 ubrp->bulk_len = ccid->ccid_bufsize; 1330 ubrp->bulk_timeout = CCID_BULK_IN_TIMEOUT; 1331 ubrp->bulk_client_private = (usb_opaque_t)ccid; 1332 ubrp->bulk_attributes = USB_ATTRS_SHORT_XFER_OK | 1333 USB_ATTRS_AUTOCLEARING; 1334 ubrp->bulk_cb = ccid_reply_bulk_cb; 1335 ubrp->bulk_exc_cb = ccid_reply_bulk_exc_cb; 1336 1337 ccid->ccid_bulkin_cache[ccid->ccid_bulkin_alloced] = ubrp; 1338 ccid->ccid_bulkin_alloced++; 1339 } 1340 1341 } 1342 1343 static usb_bulk_req_t * 1344 ccid_bulkin_cache_get(ccid_t *ccid) 1345 { 1346 usb_bulk_req_t *ubrp; 1347 1348 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 1349 1350 if (ccid->ccid_bulkin_alloced == 0) { 1351 ccid_bulkin_cache_refresh(ccid); 1352 if (ccid->ccid_bulkin_alloced == 0) 1353 return (NULL); 1354 } 1355 1356 ccid->ccid_bulkin_alloced--; 1357 ubrp = ccid->ccid_bulkin_cache[ccid->ccid_bulkin_alloced]; 1358 VERIFY3P(ubrp, !=, NULL); 1359 ccid->ccid_bulkin_cache[ccid->ccid_bulkin_alloced] = NULL; 1360 1361 return (ubrp); 1362 } 1363 1364 /* 1365 * Attempt to schedule a Bulk-In request. Note that only one should ever be 1366 * scheduled at any time. 1367 */ 1368 static int 1369 ccid_bulkin_schedule(ccid_t *ccid) 1370 { 1371 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 1372 if (ccid->ccid_bulkin_dispatched == NULL) { 1373 usb_bulk_req_t *ubrp; 1374 int ret; 1375 1376 ubrp = ccid_bulkin_cache_get(ccid); 1377 if (ubrp == NULL) { 1378 return (USB_NO_RESOURCES); 1379 } 1380 1381 if ((ret = usb_pipe_bulk_xfer(ccid->ccid_bulkin_pipe, ubrp, 1382 0)) != USB_SUCCESS) { 1383 ccid_error(ccid, 1384 "!failed to schedule Bulk-In response: %d", ret); 1385 usb_free_bulk_req(ubrp); 1386 return (ret); 1387 } 1388 1389 ccid->ccid_bulkin_dispatched = ubrp; 1390 } 1391 1392 return (USB_SUCCESS); 1393 } 1394 1395 /* 1396 * Make sure that the head of the queue has been dispatched. If a dispatch to 1397 * the device fails, fail the command and try the next one. 1398 */ 1399 static void 1400 ccid_command_dispatch(ccid_t *ccid) 1401 { 1402 ccid_command_t *cc; 1403 1404 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 1405 while ((cc = list_head(&ccid->ccid_command_queue)) != NULL) { 1406 int ret; 1407 1408 if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) 1409 return; 1410 1411 /* 1412 * Head of the queue is already being processed. We're done 1413 * here. 1414 */ 1415 if (cc->cc_state > CCID_COMMAND_QUEUED) { 1416 return; 1417 } 1418 1419 /* 1420 * Mark the command as being dispatched to the device. This 1421 * prevents anyone else from getting in and confusing things. 1422 */ 1423 ccid_command_state_transition(cc, CCID_COMMAND_DISPATCHED); 1424 cc->cc_dispatch_time = gethrtime(); 1425 1426 /* 1427 * Drop the global lock while we schedule the USB I/O. 1428 */ 1429 mutex_exit(&ccid->ccid_mutex); 1430 1431 ret = usb_pipe_bulk_xfer(ccid->ccid_bulkout_pipe, cc->cc_ubrp, 1432 0); 1433 mutex_enter(&ccid->ccid_mutex); 1434 if (ret != USB_SUCCESS) { 1435 /* 1436 * We don't need to free the usb_bulk_req_t here as it 1437 * will be taken care of when the command itself is 1438 * freed. 1439 */ 1440 ccid_error(ccid, "!Bulk pipe dispatch failed: %d\n", 1441 ret); 1442 ccid_command_transport_error(cc, ret, USB_CR_OK); 1443 } 1444 } 1445 } 1446 1447 static int 1448 ccid_command_queue(ccid_t *ccid, ccid_command_t *cc) 1449 { 1450 id_t seq; 1451 ccid_header_t *cchead; 1452 1453 seq = id_alloc_nosleep(ccid->ccid_seqs); 1454 if (seq == -1) 1455 return (ENOMEM); 1456 cc->cc_seq = seq; 1457 VERIFY3U(seq, <=, UINT8_MAX); 1458 cchead = (void *)cc->cc_ubrp->bulk_data->b_rptr; 1459 cchead->ch_seq = (uint8_t)seq; 1460 1461 mutex_enter(&ccid->ccid_mutex); 1462 /* 1463 * Take a shot at filling up our reply cache while we're submitting this 1464 * command. 1465 */ 1466 ccid_bulkin_cache_refresh(ccid); 1467 list_insert_tail(&ccid->ccid_command_queue, cc); 1468 ccid_command_state_transition(cc, CCID_COMMAND_QUEUED); 1469 cc->cc_queue_time = gethrtime(); 1470 ccid_command_dispatch(ccid); 1471 mutex_exit(&ccid->ccid_mutex); 1472 1473 return (0); 1474 } 1475 1476 /* 1477 * Normal callback for Bulk-Out requests which represents commands issued to the 1478 * device. 1479 */ 1480 static void 1481 ccid_dispatch_bulk_cb(usb_pipe_handle_t ph, usb_bulk_req_t *ubrp) 1482 { 1483 int ret; 1484 ccid_command_t *cc = (void *)ubrp->bulk_client_private; 1485 ccid_t *ccid = cc->cc_ccid; 1486 1487 mutex_enter(&ccid->ccid_mutex); 1488 VERIFY3S(cc->cc_state, ==, CCID_COMMAND_DISPATCHED); 1489 ccid_command_state_transition(cc, CCID_COMMAND_REPLYING); 1490 cc->cc_dispatch_cb_time = gethrtime(); 1491 1492 /* 1493 * Since we have successfully sent the command, give it a Bulk-In 1494 * response to reply to us with. If that fails, we'll note a transport 1495 * error which will kick off the next command if needed. 1496 */ 1497 ret = ccid_bulkin_schedule(ccid); 1498 if (ret != USB_SUCCESS) { 1499 ccid_command_transport_error(cc, ret, USB_CR_OK); 1500 } 1501 mutex_exit(&ccid->ccid_mutex); 1502 } 1503 1504 /* 1505 * Exception callback for the Bulk-Out requests which represent commands issued 1506 * to the device. 1507 */ 1508 static void 1509 ccid_dispatch_bulk_exc_cb(usb_pipe_handle_t ph, usb_bulk_req_t *ubrp) 1510 { 1511 ccid_command_t *cc = (void *)ubrp->bulk_client_private; 1512 ccid_t *ccid = cc->cc_ccid; 1513 1514 mutex_enter(&ccid->ccid_mutex); 1515 ccid_command_transport_error(cc, USB_SUCCESS, 1516 ubrp->bulk_completion_reason); 1517 mutex_exit(&ccid->ccid_mutex); 1518 } 1519 1520 static void 1521 ccid_command_free(ccid_command_t *cc) 1522 { 1523 VERIFY0(list_link_active(&cc->cc_list_node)); 1524 VERIFY(cc->cc_state == CCID_COMMAND_ALLOCATED || 1525 cc->cc_state >= CCID_COMMAND_COMPLETE); 1526 1527 if (cc->cc_response != NULL) { 1528 freemsgchain(cc->cc_response); 1529 cc->cc_response = NULL; 1530 } 1531 1532 if (cc->cc_ubrp != NULL) { 1533 usb_free_bulk_req(cc->cc_ubrp); 1534 cc->cc_ubrp = NULL; 1535 } 1536 1537 if (cc->cc_seq != 0) { 1538 id_free(cc->cc_ccid->ccid_seqs, cc->cc_seq); 1539 cc->cc_seq = 0; 1540 } 1541 1542 cv_destroy(&cc->cc_cv); 1543 kmem_free(cc, sizeof (ccid_command_t)); 1544 } 1545 1546 /* 1547 * Copy len bytes of data from buf into the allocated message block. 1548 */ 1549 static void 1550 ccid_command_bcopy(ccid_command_t *cc, const void *buf, size_t len) 1551 { 1552 size_t mlen; 1553 1554 mlen = msgsize(cc->cc_ubrp->bulk_data); 1555 VERIFY3U(mlen + len, >=, len); 1556 VERIFY3U(mlen + len, >=, mlen); 1557 mlen += len; 1558 VERIFY3U(mlen, <=, cc->cc_ubrp->bulk_len); 1559 1560 bcopy(buf, cc->cc_ubrp->bulk_data->b_wptr, len); 1561 cc->cc_ubrp->bulk_data->b_wptr += len; 1562 } 1563 1564 /* 1565 * Allocate a command of a specific size and parameters. This will allocate a 1566 * USB bulk transfer that the caller will copy data to. 1567 */ 1568 static int 1569 ccid_command_alloc(ccid_t *ccid, ccid_slot_t *slot, boolean_t block, 1570 mblk_t *datamp, size_t datasz, uint8_t mtype, uint8_t param0, 1571 uint8_t param1, uint8_t param2, ccid_command_t **ccp) 1572 { 1573 size_t allocsz; 1574 int kmflag, usbflag; 1575 ccid_command_t *cc; 1576 ccid_header_t *cchead; 1577 ccid_response_code_t rtype; 1578 1579 switch (mtype) { 1580 case CCID_REQUEST_POWER_ON: 1581 case CCID_REQUEST_POWER_OFF: 1582 case CCID_REQUEST_SLOT_STATUS: 1583 case CCID_REQUEST_GET_PARAMS: 1584 case CCID_REQUEST_RESET_PARAMS: 1585 case CCID_REQUEST_ICC_CLOCK: 1586 case CCID_REQUEST_T0APDU: 1587 case CCID_REQUEST_MECHANICAL: 1588 case CCID_REQEUST_ABORT: 1589 if (datasz != 0) 1590 return (EINVAL); 1591 break; 1592 case CCID_REQUEST_TRANSFER_BLOCK: 1593 case CCID_REQUEST_ESCAPE: 1594 case CCID_REQUEST_SECURE: 1595 case CCID_REQUEST_SET_PARAMS: 1596 case CCID_REQUEST_DATA_CLOCK: 1597 break; 1598 default: 1599 return (EINVAL); 1600 } 1601 1602 switch (mtype) { 1603 case CCID_REQUEST_POWER_ON: 1604 case CCID_REQUEST_SECURE: 1605 case CCID_REQUEST_TRANSFER_BLOCK: 1606 rtype = CCID_RESPONSE_DATA_BLOCK; 1607 break; 1608 1609 case CCID_REQUEST_POWER_OFF: 1610 case CCID_REQUEST_SLOT_STATUS: 1611 case CCID_REQUEST_ICC_CLOCK: 1612 case CCID_REQUEST_T0APDU: 1613 case CCID_REQUEST_MECHANICAL: 1614 case CCID_REQEUST_ABORT: 1615 rtype = CCID_RESPONSE_SLOT_STATUS; 1616 break; 1617 1618 case CCID_REQUEST_GET_PARAMS: 1619 case CCID_REQUEST_RESET_PARAMS: 1620 case CCID_REQUEST_SET_PARAMS: 1621 rtype = CCID_RESPONSE_PARAMETERS; 1622 break; 1623 1624 case CCID_REQUEST_ESCAPE: 1625 rtype = CCID_RESPONSE_ESCAPE; 1626 break; 1627 1628 case CCID_REQUEST_DATA_CLOCK: 1629 rtype = CCID_RESPONSE_DATA_CLOCK; 1630 break; 1631 default: 1632 return (EINVAL); 1633 } 1634 1635 if (block) { 1636 kmflag = KM_SLEEP; 1637 usbflag = USB_FLAGS_SLEEP; 1638 } else { 1639 kmflag = KM_NOSLEEP | KM_NORMALPRI; 1640 usbflag = 0; 1641 } 1642 1643 if (datasz + sizeof (ccid_header_t) < datasz) 1644 return (EINVAL); 1645 if (datasz + sizeof (ccid_header_t) > ccid->ccid_bufsize) 1646 return (EINVAL); 1647 1648 cc = kmem_zalloc(sizeof (ccid_command_t), kmflag); 1649 if (cc == NULL) 1650 return (ENOMEM); 1651 1652 allocsz = datasz + sizeof (ccid_header_t); 1653 if (datamp == NULL) { 1654 cc->cc_ubrp = usb_alloc_bulk_req(ccid->ccid_dip, allocsz, 1655 usbflag); 1656 } else { 1657 cc->cc_ubrp = usb_alloc_bulk_req(ccid->ccid_dip, 0, usbflag); 1658 } 1659 if (cc->cc_ubrp == NULL) { 1660 kmem_free(cc, sizeof (ccid_command_t)); 1661 return (ENOMEM); 1662 } 1663 1664 list_link_init(&cc->cc_list_node); 1665 cv_init(&cc->cc_cv, NULL, CV_DRIVER, NULL); 1666 cc->cc_mtype = mtype; 1667 cc->cc_rtype = rtype; 1668 cc->cc_slot = slot->cs_slotno; 1669 cc->cc_reqlen = datasz; 1670 cc->cc_ccid = ccid; 1671 cc->cc_state = CCID_COMMAND_ALLOCATED; 1672 1673 /* 1674 * Fill in bulk request attributes. Note that short transfers out 1675 * are not OK. 1676 */ 1677 if (datamp != NULL) { 1678 cc->cc_ubrp->bulk_data = datamp; 1679 } 1680 cc->cc_ubrp->bulk_len = allocsz; 1681 cc->cc_ubrp->bulk_timeout = CCID_BULK_OUT_TIMEOUT; 1682 cc->cc_ubrp->bulk_client_private = (usb_opaque_t)cc; 1683 cc->cc_ubrp->bulk_attributes = USB_ATTRS_AUTOCLEARING; 1684 cc->cc_ubrp->bulk_cb = ccid_dispatch_bulk_cb; 1685 cc->cc_ubrp->bulk_exc_cb = ccid_dispatch_bulk_exc_cb; 1686 1687 /* 1688 * Fill in the command header. We fill in everything except the sequence 1689 * number, which is done by the actual dispatch code. 1690 */ 1691 cchead = (void *)cc->cc_ubrp->bulk_data->b_rptr; 1692 cchead->ch_mtype = mtype; 1693 cchead->ch_length = LE_32(datasz); 1694 cchead->ch_slot = slot->cs_slotno; 1695 cchead->ch_seq = 0; 1696 cchead->ch_param0 = param0; 1697 cchead->ch_param1 = param1; 1698 cchead->ch_param2 = param2; 1699 cc->cc_ubrp->bulk_data->b_wptr += sizeof (ccid_header_t); 1700 *ccp = cc; 1701 1702 return (0); 1703 } 1704 1705 /* 1706 * The rest of the stack is in charge of timing out commands and potentially 1707 * aborting them. At this point in time, there's no specific timeout aspect 1708 * here. 1709 */ 1710 static void 1711 ccid_command_poll(ccid_t *ccid, ccid_command_t *cc) 1712 { 1713 VERIFY0(cc->cc_flags & CCID_COMMAND_F_USER); 1714 1715 mutex_enter(&ccid->ccid_mutex); 1716 while ((cc->cc_state < CCID_COMMAND_COMPLETE) && 1717 (ccid->ccid_flags & CCID_F_DEV_GONE_MASK) == 0) { 1718 cv_wait(&cc->cc_cv, &ccid->ccid_mutex); 1719 } 1720 1721 /* 1722 * Treat this as a consumption and remove it from the completion list. 1723 */ 1724 #ifdef DEBUG 1725 ccid_command_t *check; 1726 for (check = list_head(&ccid->ccid_complete_queue); check != NULL; 1727 check = list_next(&ccid->ccid_complete_queue, check)) { 1728 if (cc == check) 1729 break; 1730 } 1731 ASSERT3P(check, !=, NULL); 1732 #endif 1733 VERIFY(list_link_active(&cc->cc_list_node)); 1734 list_remove(&ccid->ccid_complete_queue, cc); 1735 mutex_exit(&ccid->ccid_mutex); 1736 } 1737 1738 static int 1739 ccid_command_power_off(ccid_t *ccid, ccid_slot_t *cs) 1740 { 1741 int ret; 1742 ccid_command_t *cc; 1743 ccid_reply_icc_status_t cis; 1744 ccid_reply_command_status_t crs; 1745 1746 if ((ret = ccid_command_alloc(ccid, cs, B_TRUE, NULL, 0, 1747 CCID_REQUEST_POWER_OFF, 0, 0, 0, &cc)) != 0) { 1748 return (ret); 1749 } 1750 1751 if ((ret = ccid_command_queue(ccid, cc)) != 0) { 1752 ccid_command_free(cc); 1753 return (ret); 1754 } 1755 1756 ccid_command_poll(ccid, cc); 1757 1758 if (cc->cc_state != CCID_COMMAND_COMPLETE) { 1759 ret = EIO; 1760 goto done; 1761 } 1762 1763 ccid_command_status_decode(cc, &crs, &cis, NULL); 1764 if (crs == CCID_REPLY_STATUS_FAILED) { 1765 if (cis == CCID_REPLY_ICC_MISSING) { 1766 ret = ENXIO; 1767 } else { 1768 ret = EIO; 1769 } 1770 } else { 1771 ret = 0; 1772 } 1773 done: 1774 ccid_command_free(cc); 1775 return (ret); 1776 } 1777 1778 static int 1779 ccid_command_power_on(ccid_t *ccid, ccid_slot_t *cs, ccid_class_voltage_t volt, 1780 mblk_t **atrp) 1781 { 1782 int ret; 1783 ccid_command_t *cc; 1784 ccid_reply_command_status_t crs; 1785 ccid_reply_icc_status_t cis; 1786 ccid_command_err_t cce; 1787 1788 if (atrp == NULL) 1789 return (EINVAL); 1790 1791 *atrp = NULL; 1792 1793 switch (volt) { 1794 case CCID_CLASS_VOLT_AUTO: 1795 case CCID_CLASS_VOLT_5_0: 1796 case CCID_CLASS_VOLT_3_0: 1797 case CCID_CLASS_VOLT_1_8: 1798 break; 1799 default: 1800 return (EINVAL); 1801 } 1802 1803 if ((ret = ccid_command_alloc(ccid, cs, B_TRUE, NULL, 0, 1804 CCID_REQUEST_POWER_ON, volt, 0, 0, &cc)) != 0) { 1805 return (ret); 1806 } 1807 1808 if ((ret = ccid_command_queue(ccid, cc)) != 0) { 1809 ccid_command_free(cc); 1810 return (ret); 1811 } 1812 1813 ccid_command_poll(ccid, cc); 1814 1815 if (cc->cc_state != CCID_COMMAND_COMPLETE) { 1816 ret = EIO; 1817 goto done; 1818 } 1819 1820 /* 1821 * Look for a few specific errors here: 1822 * 1823 * - ICC_MUTE via a few potential ways 1824 * - Bad voltage 1825 */ 1826 ccid_command_status_decode(cc, &crs, &cis, &cce); 1827 if (crs == CCID_REPLY_STATUS_FAILED) { 1828 if (cis == CCID_REPLY_ICC_MISSING) { 1829 ret = ENXIO; 1830 } else if (cis == CCID_REPLY_ICC_INACTIVE && 1831 cce == 7) { 1832 /* 1833 * This means that byte 7 was invalid. In other words, 1834 * that the voltage wasn't correct. See Table 6.1-2 1835 * 'Errors' in the CCID r1.1.0 spec. 1836 */ 1837 ret = ENOTSUP; 1838 } else { 1839 ret = EIO; 1840 } 1841 } else { 1842 size_t len; 1843 1844 len = ccid_command_resp_length(cc); 1845 if (len == 0) { 1846 ret = EINVAL; 1847 goto done; 1848 } 1849 1850 #ifdef DEBUG 1851 /* 1852 * This should have already been checked by the response 1853 * framework, but sanity check this again. 1854 */ 1855 size_t mlen = msgsize(cc->cc_response); 1856 VERIFY3U(mlen, >=, len + sizeof (ccid_header_t)); 1857 #endif 1858 1859 /* 1860 * Munge the message block to have the ATR. We want to make sure 1861 * that the write pointer is set to the maximum length that we 1862 * got back from the driver (the message block could strictly 1863 * speaking be larger, because we got a larger transfer for some 1864 * reason). 1865 */ 1866 cc->cc_response->b_rptr += sizeof (ccid_header_t); 1867 cc->cc_response->b_wptr = cc->cc_response->b_rptr + len; 1868 *atrp = cc->cc_response; 1869 cc->cc_response = NULL; 1870 ret = 0; 1871 } 1872 1873 done: 1874 ccid_command_free(cc); 1875 return (ret); 1876 } 1877 1878 static int 1879 ccid_command_get_parameters(ccid_t *ccid, ccid_slot_t *slot, 1880 atr_protocol_t *protp, ccid_params_t *paramsp) 1881 { 1882 int ret; 1883 uint8_t prot; 1884 size_t mlen; 1885 ccid_command_t *cc; 1886 ccid_reply_command_status_t crs; 1887 ccid_reply_icc_status_t cis; 1888 const void *cpbuf; 1889 1890 if ((ret = ccid_command_alloc(ccid, slot, B_TRUE, NULL, 0, 1891 CCID_REQUEST_GET_PARAMS, 0, 0, 0, &cc)) != 0) { 1892 return (ret); 1893 } 1894 1895 if ((ret = ccid_command_queue(ccid, cc)) != 0) 1896 goto done; 1897 1898 ccid_command_poll(ccid, cc); 1899 1900 if (cc->cc_state != CCID_COMMAND_COMPLETE) { 1901 ret = EIO; 1902 goto done; 1903 } 1904 1905 ccid_command_status_decode(cc, &crs, &cis, NULL); 1906 if (crs != CCID_REPLY_STATUS_COMPLETE) { 1907 if (cis == CCID_REPLY_ICC_MISSING) { 1908 ret = ENXIO; 1909 } else { 1910 ret = EIO; 1911 } 1912 goto done; 1913 } 1914 1915 /* 1916 * The protocol is in ch_param2 of the header. 1917 */ 1918 prot = ccid_command_resp_param2(cc); 1919 mlen = ccid_command_resp_length(cc); 1920 cpbuf = cc->cc_response->b_rptr + sizeof (ccid_header_t); 1921 1922 ret = 0; 1923 switch (prot) { 1924 case 0: 1925 if (mlen < sizeof (ccid_params_t0_t)) { 1926 ret = EOVERFLOW; 1927 goto done; 1928 } 1929 *protp = ATR_P_T0; 1930 bcopy(cpbuf, ¶msp->ccp_t0, sizeof (ccid_params_t0_t)); 1931 break; 1932 case 1: 1933 if (mlen < sizeof (ccid_params_t1_t)) { 1934 ret = EOVERFLOW; 1935 goto done; 1936 } 1937 *protp = ATR_P_T1; 1938 bcopy(cpbuf, ¶msp->ccp_t1, sizeof (ccid_params_t1_t)); 1939 break; 1940 default: 1941 ret = ECHRNG; 1942 break; 1943 } 1944 1945 done: 1946 ccid_command_free(cc); 1947 return (ret); 1948 } 1949 1950 static void 1951 ccid_hw_error(ccid_t *ccid, ccid_intr_hwerr_t *hwerr) 1952 { 1953 ccid_slot_t *slot; 1954 1955 /* Make sure the slot number is within range. */ 1956 if (hwerr->cih_slot >= ccid->ccid_nslots) { 1957 ccid->ccid_stats.cst_intr_inval++; 1958 return; 1959 } 1960 1961 slot = &ccid->ccid_slots[hwerr->cih_slot]; 1962 1963 /* The only error condition defined by the spec is overcurrent. */ 1964 if (hwerr->cih_code != CCID_INTR_HWERR_OVERCURRENT) { 1965 ccid->ccid_stats.cst_intr_inval++; 1966 return; 1967 } 1968 1969 /* 1970 * The worker thread will take care of this situation. 1971 */ 1972 slot->cs_flags |= CCID_SLOT_F_INTR_OVERCURRENT; 1973 ccid_worker_request(ccid); 1974 } 1975 1976 static void 1977 ccid_intr_pipe_cb(usb_pipe_handle_t ph, usb_intr_req_t *uirp) 1978 { 1979 mblk_t *mp; 1980 size_t msglen, explen; 1981 uint_t i; 1982 boolean_t change; 1983 ccid_intr_hwerr_t ccid_hwerr; 1984 ccid_t *ccid = (ccid_t *)uirp->intr_client_private; 1985 1986 mp = uirp->intr_data; 1987 if (mp == NULL) 1988 goto done; 1989 1990 msglen = msgsize(mp); 1991 if (msglen == 0) 1992 goto done; 1993 1994 switch (mp->b_rptr[0]) { 1995 case CCID_INTR_CODE_SLOT_CHANGE: 1996 mutex_enter(&ccid->ccid_mutex); 1997 ccid->ccid_stats.cst_intr_slot_change++; 1998 1999 explen = 1 + ((2 * ccid->ccid_nslots + (NBBY-1)) / NBBY); 2000 if (msglen < explen) { 2001 ccid->ccid_stats.cst_intr_inval++; 2002 mutex_exit(&ccid->ccid_mutex); 2003 goto done; 2004 } 2005 2006 change = B_FALSE; 2007 for (i = 0; i < ccid->ccid_nslots; i++) { 2008 uint_t byte = (i * 2 / NBBY) + 1; 2009 uint_t shift = i * 2 % NBBY; 2010 uint_t present = 1 << shift; 2011 uint_t delta = 2 << shift; 2012 2013 if (mp->b_rptr[byte] & delta) { 2014 ccid_slot_t *slot = &ccid->ccid_slots[i]; 2015 2016 slot->cs_flags &= ~CCID_SLOT_F_INTR_MASK; 2017 slot->cs_flags |= CCID_SLOT_F_CHANGED; 2018 if (mp->b_rptr[byte] & present) { 2019 slot->cs_flags |= CCID_SLOT_F_INTR_ADD; 2020 } else { 2021 slot->cs_flags |= CCID_SLOT_F_INTR_GONE; 2022 } 2023 change = B_TRUE; 2024 } 2025 } 2026 2027 if (change) { 2028 ccid_worker_request(ccid); 2029 } 2030 mutex_exit(&ccid->ccid_mutex); 2031 break; 2032 case CCID_INTR_CODE_HW_ERROR: 2033 mutex_enter(&ccid->ccid_mutex); 2034 ccid->ccid_stats.cst_intr_hwerr++; 2035 2036 if (msglen < sizeof (ccid_intr_hwerr_t)) { 2037 ccid->ccid_stats.cst_intr_inval++; 2038 mutex_exit(&ccid->ccid_mutex); 2039 goto done; 2040 } 2041 2042 bcopy(mp->b_rptr, &ccid_hwerr, sizeof (ccid_intr_hwerr_t)); 2043 ccid_hw_error(ccid, &ccid_hwerr); 2044 2045 mutex_exit(&ccid->ccid_mutex); 2046 break; 2047 default: 2048 mutex_enter(&ccid->ccid_mutex); 2049 ccid->ccid_stats.cst_intr_unknown++; 2050 mutex_exit(&ccid->ccid_mutex); 2051 break; 2052 } 2053 2054 done: 2055 usb_free_intr_req(uirp); 2056 } 2057 2058 static void 2059 ccid_intr_pipe_except_cb(usb_pipe_handle_t ph, usb_intr_req_t *uirp) 2060 { 2061 ccid_t *ccid = (ccid_t *)uirp->intr_client_private; 2062 2063 ccid->ccid_stats.cst_intr_errs++; 2064 switch (uirp->intr_completion_reason) { 2065 case USB_CR_PIPE_RESET: 2066 case USB_CR_NO_RESOURCES: 2067 ccid->ccid_stats.cst_intr_restart++; 2068 ccid_intr_poll_init(ccid); 2069 break; 2070 default: 2071 break; 2072 } 2073 usb_free_intr_req(uirp); 2074 } 2075 2076 /* 2077 * Clean up all the state associated with this slot and its ICC. 2078 */ 2079 static void 2080 ccid_slot_teardown(ccid_t *ccid, ccid_slot_t *slot, boolean_t signal) 2081 { 2082 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2083 2084 if (slot->cs_icc.icc_fini != NULL) { 2085 slot->cs_icc.icc_fini(ccid, slot); 2086 } 2087 2088 atr_data_reset(slot->cs_icc.icc_atr_data); 2089 slot->cs_icc.icc_protocols = ATR_P_NONE; 2090 slot->cs_icc.icc_cur_protocol = ATR_P_NONE; 2091 slot->cs_icc.icc_init = NULL; 2092 slot->cs_icc.icc_tx = NULL; 2093 slot->cs_icc.icc_complete = NULL; 2094 slot->cs_icc.icc_teardown = NULL; 2095 slot->cs_icc.icc_fini = NULL; 2096 2097 slot->cs_voltage = 0; 2098 freemsgchain(slot->cs_atr); 2099 slot->cs_atr = NULL; 2100 2101 if (signal && slot->cs_excl_minor != NULL) { 2102 pollwakeup(&slot->cs_excl_minor->cm_pollhead, POLLHUP); 2103 } 2104 } 2105 2106 /* 2107 * Wait for teardown of outstanding user I/O. 2108 */ 2109 static void 2110 ccid_slot_io_teardown(ccid_t *ccid, ccid_slot_t *slot) 2111 { 2112 /* 2113 * If there is outstanding user I/O, then we need to go ahead and take 2114 * care of that. Once this function returns, the user I/O will have been 2115 * dealt with; however, before we can tear down things, we need to make 2116 * sure that the logical I/O has been completed. 2117 */ 2118 if (slot->cs_icc.icc_teardown != NULL) { 2119 slot->cs_icc.icc_teardown(ccid, slot, ENXIO); 2120 } 2121 2122 while ((slot->cs_flags & CCID_SLOT_F_NEED_IO_TEARDOWN) != 0) { 2123 cv_wait(&slot->cs_io.ci_cv, &ccid->ccid_mutex); 2124 } 2125 } 2126 2127 /* 2128 * The given CCID slot has been inactivated. Clean up. 2129 */ 2130 static void 2131 ccid_slot_inactive(ccid_t *ccid, ccid_slot_t *slot) 2132 { 2133 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2134 2135 slot->cs_flags &= ~CCID_SLOT_F_ACTIVE; 2136 2137 ccid_slot_io_teardown(ccid, slot); 2138 2139 /* 2140 * Now that we've finished completely waiting for the logical I/O to be 2141 * torn down, it's safe for us to proceed with the rest of the needed 2142 * tear down. 2143 */ 2144 ccid_slot_teardown(ccid, slot, B_TRUE); 2145 } 2146 2147 /* 2148 * The given CCID slot has been removed. Clean up. 2149 */ 2150 static void 2151 ccid_slot_removed(ccid_t *ccid, ccid_slot_t *slot, boolean_t notify) 2152 { 2153 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2154 if ((slot->cs_flags & CCID_SLOT_F_PRESENT) == 0) { 2155 VERIFY0(slot->cs_flags & CCID_SLOT_F_ACTIVE); 2156 return; 2157 } 2158 2159 /* 2160 * This slot is gone, mark the flags accordingly. 2161 */ 2162 slot->cs_flags &= ~CCID_SLOT_F_PRESENT; 2163 2164 ccid_slot_inactive(ccid, slot); 2165 } 2166 2167 static void 2168 ccid_slot_setup_functions(ccid_t *ccid, ccid_slot_t *slot) 2169 { 2170 uint_t bits = CCID_CLASS_F_SHORT_APDU_XCHG | CCID_CLASS_F_EXT_APDU_XCHG; 2171 2172 slot->cs_icc.icc_init = NULL; 2173 slot->cs_icc.icc_tx = NULL; 2174 slot->cs_icc.icc_complete = NULL; 2175 slot->cs_icc.icc_teardown = NULL; 2176 slot->cs_icc.icc_fini = NULL; 2177 2178 switch (ccid->ccid_class.ccd_dwFeatures & bits) { 2179 case CCID_CLASS_F_SHORT_APDU_XCHG: 2180 case CCID_CLASS_F_EXT_APDU_XCHG: 2181 /* 2182 * Readers with extended APDU support always also support 2183 * short APDUs. We only ever use short APDUs. 2184 */ 2185 slot->cs_icc.icc_tx = ccid_write_apdu; 2186 slot->cs_icc.icc_complete = ccid_complete_apdu; 2187 slot->cs_icc.icc_teardown = ccid_teardown_apdu; 2188 break; 2189 default: 2190 break; 2191 } 2192 2193 /* 2194 * When we don't have a supported tx function, we don't want to end 2195 * up blocking attach. It's important we attach so that users can try 2196 * and determine information about the ICC and reader. 2197 */ 2198 if (slot->cs_icc.icc_tx == NULL) { 2199 ccid_error(ccid, "!CCID does not support I/O transfers to ICC"); 2200 } 2201 } 2202 2203 /* 2204 * We have an ICC present in a slot. We require that the reader does all 2205 * protocol and parameter related initializations for us. Just parse the ATR 2206 * for our own use and use GET_PARAMS to query the parameters the reader set 2207 * up for us. 2208 */ 2209 static boolean_t 2210 ccid_slot_params_init(ccid_t *ccid, ccid_slot_t *slot, mblk_t *atr) 2211 { 2212 int ret; 2213 atr_parsecode_t p; 2214 atr_protocol_t prot; 2215 atr_data_t *data; 2216 2217 /* 2218 * Use the slot's atr data structure. This is only used when we're in 2219 * the worker context, so it should be safe to access in a lockless 2220 * fashion. 2221 */ 2222 data = slot->cs_icc.icc_atr_data; 2223 atr_data_reset(data); 2224 if ((p = atr_parse(atr->b_rptr, msgsize(atr), data)) != ATR_CODE_OK) { 2225 ccid_error(ccid, "!failed to parse ATR data from slot %d: %s", 2226 slot->cs_slotno, atr_strerror(p)); 2227 return (B_FALSE); 2228 } 2229 2230 if ((ret = ccid_command_get_parameters(ccid, slot, &prot, 2231 &slot->cs_icc.icc_params)) != 0) { 2232 ccid_error(ccid, "!failed to get parameters for slot %u: %d", 2233 slot->cs_slotno, ret); 2234 return (B_FALSE); 2235 } 2236 2237 slot->cs_icc.icc_protocols = atr_supported_protocols(data); 2238 slot->cs_icc.icc_cur_protocol = prot; 2239 2240 if ((ccid->ccid_flags & (CCID_F_NEEDS_PPS | CCID_F_NEEDS_PARAMS | 2241 CCID_F_NEEDS_DATAFREQ)) != 0) { 2242 ccid_error(ccid, "!CCID reader does not support required " 2243 "protocol/parameter setup automation"); 2244 return (B_FALSE); 2245 } 2246 2247 return (B_TRUE); 2248 } 2249 2250 /* 2251 * Set up the ICC function parameters and initialize the ICC engine. 2252 */ 2253 static boolean_t 2254 ccid_slot_prot_init(ccid_t *ccid, ccid_slot_t *slot) 2255 { 2256 ccid_slot_setup_functions(ccid, slot); 2257 2258 if (slot->cs_icc.icc_init != NULL) { 2259 slot->cs_icc.icc_init(ccid, slot); 2260 } 2261 2262 return (B_TRUE); 2263 } 2264 2265 static int 2266 ccid_slot_power_on(ccid_t *ccid, ccid_slot_t *slot, ccid_class_voltage_t volts, 2267 mblk_t **atr) 2268 { 2269 int ret; 2270 2271 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2272 2273 mutex_exit(&ccid->ccid_mutex); 2274 if ((ret = ccid_command_power_on(ccid, slot, volts, atr)) != 0) { 2275 /* 2276 * If we got ENXIO, then we know that there is no ICC 2277 * present. This could happen for a number of reasons. 2278 * For example, we could have just started up and no 2279 * card was plugged in (we default to assuming that one 2280 * is). Also, some readers won't really tell us that 2281 * nothing is there until after the power on fails, 2282 * hence why we don't bother with doing a status check 2283 * and just try to power on. 2284 */ 2285 if (ret == ENXIO) { 2286 mutex_enter(&ccid->ccid_mutex); 2287 slot->cs_flags &= ~CCID_SLOT_F_PRESENT; 2288 return (ret); 2289 } 2290 2291 /* 2292 * If we fail to power off the card, check to make sure 2293 * it hasn't been removed. 2294 */ 2295 if (ccid_command_power_off(ccid, slot) == ENXIO) { 2296 mutex_enter(&ccid->ccid_mutex); 2297 slot->cs_flags &= ~CCID_SLOT_F_PRESENT; 2298 return (ENXIO); 2299 } 2300 2301 mutex_enter(&ccid->ccid_mutex); 2302 return (ret); 2303 } 2304 2305 if (!ccid_slot_params_init(ccid, slot, *atr)) { 2306 ccid_error(ccid, "!failed to set slot paramters for ICC"); 2307 mutex_enter(&ccid->ccid_mutex); 2308 return (ENOTSUP); 2309 } 2310 2311 if (!ccid_slot_prot_init(ccid, slot)) { 2312 ccid_error(ccid, "!failed to setup protocol for ICC"); 2313 mutex_enter(&ccid->ccid_mutex); 2314 return (ENOTSUP); 2315 } 2316 2317 mutex_enter(&ccid->ccid_mutex); 2318 return (0); 2319 } 2320 2321 static int 2322 ccid_slot_power_off(ccid_t *ccid, ccid_slot_t *slot) 2323 { 2324 int ret; 2325 2326 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2327 2328 ccid_slot_io_teardown(ccid, slot); 2329 2330 /* 2331 * Now that we've finished completely waiting for the logical I/O to be 2332 * torn down, try and power off the ICC. 2333 */ 2334 mutex_exit(&ccid->ccid_mutex); 2335 ret = ccid_command_power_off(ccid, slot); 2336 mutex_enter(&ccid->ccid_mutex); 2337 2338 if (ret != 0) 2339 return (ret); 2340 2341 ccid_slot_inactive(ccid, slot); 2342 2343 return (ret); 2344 } 2345 2346 static int 2347 ccid_slot_inserted(ccid_t *ccid, ccid_slot_t *slot) 2348 { 2349 uint_t nvolts = 4; 2350 uint_t cvolt = 0; 2351 mblk_t *atr = NULL; 2352 ccid_class_voltage_t volts[4] = { CCID_CLASS_VOLT_AUTO, 2353 CCID_CLASS_VOLT_5_0, CCID_CLASS_VOLT_3_0, CCID_CLASS_VOLT_1_8 }; 2354 2355 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2356 if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) { 2357 return (0); 2358 } 2359 2360 if ((slot->cs_flags & CCID_SLOT_F_ACTIVE) != 0) { 2361 return (0); 2362 } 2363 2364 slot->cs_flags |= CCID_SLOT_F_PRESENT; 2365 2366 /* 2367 * Now, we need to activate this ccid device before we can do anything 2368 * with it. First, power on the device. There are two hardware features 2369 * which may be at play. There may be automatic voltage detection and 2370 * automatic activation on insertion. In theory, when either of those 2371 * are present, we should always try to use the auto voltage. 2372 * 2373 * What's less clear in the specification is if the Auto-Voltage 2374 * property is present is if we should try manual voltages or not. For 2375 * the moment we do. 2376 */ 2377 if ((ccid->ccid_class.ccd_dwFeatures & 2378 (CCID_CLASS_F_AUTO_ICC_ACTIVATE | CCID_CLASS_F_AUTO_ICC_VOLTAGE)) == 2379 0) { 2380 /* Skip auto-voltage */ 2381 cvolt++; 2382 } 2383 2384 for (; cvolt < nvolts; cvolt++) { 2385 int ret; 2386 2387 if (volts[cvolt] != CCID_CLASS_VOLT_AUTO && 2388 (ccid->ccid_class.ccd_bVoltageSupport & volts[cvolt]) == 2389 0) { 2390 continue; 2391 } 2392 2393 ret = ccid_slot_power_on(ccid, slot, volts[cvolt], &atr); 2394 if (ret != 0) { 2395 freemsg(atr); 2396 atr = NULL; 2397 continue; 2398 } 2399 2400 break; 2401 } 2402 2403 if (cvolt >= nvolts) { 2404 ccid_error(ccid, "!failed to activate and power on ICC, no " 2405 "supported voltages found"); 2406 goto notsup; 2407 } 2408 2409 slot->cs_voltage = volts[cvolt]; 2410 slot->cs_atr = atr; 2411 slot->cs_flags |= CCID_SLOT_F_ACTIVE; 2412 2413 ccid_slot_pollout_signal(slot); 2414 2415 return (0); 2416 2417 notsup: 2418 freemsg(atr); 2419 ccid_slot_teardown(ccid, slot, B_FALSE); 2420 return (ENOTSUP); 2421 } 2422 2423 static int 2424 ccid_slot_warm_reset(ccid_t *ccid, ccid_slot_t *slot) 2425 { 2426 int ret; 2427 mblk_t *atr; 2428 ccid_class_voltage_t voltage; 2429 2430 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2431 2432 ccid_slot_io_teardown(ccid, slot); 2433 2434 voltage = slot->cs_voltage; 2435 2436 ccid_slot_teardown(ccid, slot, B_FALSE); 2437 2438 ret = ccid_slot_power_on(ccid, slot, voltage, &atr); 2439 if (ret != 0) { 2440 freemsg(atr); 2441 return (ret); 2442 } 2443 2444 slot->cs_voltage = voltage; 2445 slot->cs_atr = atr; 2446 2447 return (ret); 2448 } 2449 2450 static boolean_t 2451 ccid_slot_reset(ccid_t *ccid, ccid_slot_t *slot) 2452 { 2453 int ret; 2454 2455 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2456 VERIFY(slot->cs_flags & CCID_SLOT_F_NEED_TXN_RESET); 2457 VERIFY(ccid->ccid_flags & CCID_F_WORKER_RUNNING); 2458 2459 if (ccid->ccid_flags & CCID_F_DEV_GONE_MASK) 2460 return (B_TRUE); 2461 2462 /* 2463 * Power off the ICC. This will wait for logical I/O if needed. 2464 */ 2465 ret = ccid_slot_power_off(ccid, slot); 2466 2467 /* 2468 * If we failed to power off the ICC because the ICC is removed, then 2469 * just return that we failed, so that we can let the next lap clean 2470 * things up by noting that the ICC has been removed. 2471 */ 2472 if (ret != 0 && ret == ENXIO) { 2473 return (B_FALSE); 2474 } 2475 2476 if (ret != 0) { 2477 ccid_error(ccid, "!failed to reset slot %d for next txn: %d; " 2478 "taking another lap", slot->cs_slotno, ret); 2479 return (B_FALSE); 2480 } 2481 2482 /* 2483 * Mimic a slot insertion to power this back on. Don't worry about 2484 * success or failure, because as far as we care for resetting it, we've 2485 * done our duty once we've powered it off successfully. 2486 */ 2487 (void) ccid_slot_inserted(ccid, slot); 2488 2489 return (B_TRUE); 2490 } 2491 2492 /* 2493 * We've been asked to perform some amount of work on the various slots that we 2494 * have. This may be because the slot needs to be reset due to the completion of 2495 * a transaction or it may be because an ICC inside of the slot has been 2496 * removed. 2497 */ 2498 static void 2499 ccid_worker(void *arg) 2500 { 2501 uint_t i; 2502 ccid_t *ccid = arg; 2503 2504 mutex_enter(&ccid->ccid_mutex); 2505 ccid->ccid_stats.cst_ndiscover++; 2506 ccid->ccid_stats.cst_lastdiscover = gethrtime(); 2507 ccid->ccid_flags |= CCID_F_WORKER_RUNNING; 2508 ccid->ccid_flags &= ~CCID_F_WORKER_REQUESTED; 2509 2510 for (i = 0; i < ccid->ccid_nslots; i++) { 2511 ccid_slot_t *slot = &ccid->ccid_slots[i]; 2512 uint_t flags; 2513 2514 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2515 2516 if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) { 2517 ccid->ccid_flags &= ~CCID_F_WORKER_MASK; 2518 mutex_exit(&ccid->ccid_mutex); 2519 return; 2520 } 2521 2522 /* 2523 * Snapshot the flags before we start processing the worker. At 2524 * this time we clear out all of the change flags as we'll be 2525 * operating on the device. We do not clear the 2526 * CCID_SLOT_F_NEED_TXN_RESET flag, as we want to make sure that 2527 * this is maintained until we're done here. 2528 */ 2529 flags = slot->cs_flags & CCID_SLOT_F_WORK_MASK; 2530 slot->cs_flags &= ~CCID_SLOT_F_INTR_MASK; 2531 2532 if ((flags & CCID_SLOT_F_INTR_OVERCURRENT) != 0) { 2533 ccid_slot_inactive(ccid, slot); 2534 } 2535 2536 if ((flags & CCID_SLOT_F_CHANGED) != 0) { 2537 if (flags & CCID_SLOT_F_INTR_GONE) { 2538 ccid_slot_removed(ccid, slot, B_TRUE); 2539 } else { 2540 (void) ccid_slot_inserted(ccid, slot); 2541 if ((slot->cs_flags & CCID_SLOT_F_ACTIVE) != 2542 0) { 2543 ccid_slot_excl_maybe_signal(slot); 2544 } 2545 } 2546 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2547 } 2548 2549 if ((flags & CCID_SLOT_F_NEED_TXN_RESET) != 0) { 2550 /* 2551 * If the CCID_SLOT_F_PRESENT flag is set, then we 2552 * should attempt to power off and power on the ICC in 2553 * an attempt to reset it. If this fails, trigger 2554 * another worker that needs to operate. 2555 */ 2556 if ((slot->cs_flags & CCID_SLOT_F_PRESENT) != 0) { 2557 if (!ccid_slot_reset(ccid, slot)) { 2558 ccid_worker_request(ccid); 2559 continue; 2560 } 2561 } 2562 2563 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2564 slot->cs_flags &= ~CCID_SLOT_F_NEED_TXN_RESET; 2565 /* 2566 * Try to signal the next thread waiting for exclusive 2567 * access. 2568 */ 2569 ccid_slot_excl_maybe_signal(slot); 2570 } 2571 } 2572 2573 /* 2574 * If we have a request to operate again, delay before we consider this, 2575 * to make sure we don't do too much work ourselves. 2576 */ 2577 if ((ccid->ccid_flags & CCID_F_WORKER_REQUESTED) != 0) { 2578 mutex_exit(&ccid->ccid_mutex); 2579 delay(drv_usectohz(1000) * 10); 2580 mutex_enter(&ccid->ccid_mutex); 2581 } 2582 2583 ccid->ccid_flags &= ~CCID_F_WORKER_RUNNING; 2584 if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) { 2585 ccid->ccid_flags &= ~CCID_F_WORKER_REQUESTED; 2586 mutex_exit(&ccid->ccid_mutex); 2587 return; 2588 } 2589 2590 if ((ccid->ccid_flags & CCID_F_WORKER_REQUESTED) != 0) { 2591 (void) ddi_taskq_dispatch(ccid->ccid_taskq, ccid_worker, ccid, 2592 DDI_SLEEP); 2593 } 2594 mutex_exit(&ccid->ccid_mutex); 2595 } 2596 2597 static void 2598 ccid_worker_request(ccid_t *ccid) 2599 { 2600 boolean_t run; 2601 2602 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 2603 if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) { 2604 return; 2605 } 2606 2607 run = (ccid->ccid_flags & CCID_F_WORKER_MASK) == 0; 2608 ccid->ccid_flags |= CCID_F_WORKER_REQUESTED; 2609 if (run) { 2610 mutex_exit(&ccid->ccid_mutex); 2611 (void) ddi_taskq_dispatch(ccid->ccid_taskq, ccid_worker, ccid, 2612 DDI_SLEEP); 2613 mutex_enter(&ccid->ccid_mutex); 2614 } 2615 } 2616 2617 static void 2618 ccid_intr_restart_timeout(void *arg) 2619 { 2620 ccid_t *ccid = arg; 2621 2622 mutex_enter(&ccid->ccid_mutex); 2623 if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) { 2624 ccid->ccid_poll_timeout = NULL; 2625 mutex_exit(&ccid->ccid_mutex); 2626 } 2627 mutex_exit(&ccid->ccid_mutex); 2628 2629 ccid_intr_poll_init(ccid); 2630 } 2631 2632 /* 2633 * Search for the current class descriptor from the configuration cloud and 2634 * parse it for our use. We do this by first finding the current interface 2635 * descriptor and expecting it to be one of the next descriptors. 2636 */ 2637 static boolean_t 2638 ccid_parse_class_desc(ccid_t *ccid) 2639 { 2640 uint_t i; 2641 size_t len, tlen; 2642 usb_client_dev_data_t *dp; 2643 usb_alt_if_data_t *alt; 2644 2645 /* 2646 * Establish the target length we're looking for from usb_parse_data(). 2647 * Note that we cannot use the sizeof (ccid_class_descr_t) for this 2648 * because that function does not know how to account for the padding at 2649 * the end of the target structure (which is reasonble). So we manually 2650 * figure out the number of bytes it should in theory write. 2651 */ 2652 tlen = offsetof(ccid_class_descr_t, ccd_bMaxCCIDBusySlots) + 2653 sizeof (ccid->ccid_class.ccd_bMaxCCIDBusySlots); 2654 dp = ccid->ccid_dev_data; 2655 alt = &dp->dev_curr_cfg->cfg_if[dp->dev_curr_if].if_alt[0]; 2656 for (i = 0; i < alt->altif_n_cvs; i++) { 2657 usb_cvs_data_t *cvs = &alt->altif_cvs[i]; 2658 if (cvs->cvs_buf == NULL) 2659 continue; 2660 if (cvs->cvs_buf_len != CCID_DESCR_LENGTH) 2661 continue; 2662 if (cvs->cvs_buf[1] != CCID_DESCR_TYPE) 2663 continue; 2664 if ((len = usb_parse_data("ccscc3lcllc5lccscc", cvs->cvs_buf, 2665 cvs->cvs_buf_len, &ccid->ccid_class, 2666 sizeof (ccid->ccid_class))) >= tlen) { 2667 return (B_TRUE); 2668 } 2669 ccid_error(ccid, "!failed to parse CCID class descriptor from " 2670 "cvs %u, expected %lu bytes, received %lu", i, tlen, len); 2671 } 2672 2673 ccid_error(ccid, "!failed to find matching CCID class descriptor"); 2674 return (B_FALSE); 2675 } 2676 2677 /* 2678 * Verify whether or not we can support this CCID reader. 2679 */ 2680 static boolean_t 2681 ccid_supported(ccid_t *ccid) 2682 { 2683 usb_client_dev_data_t *dp; 2684 usb_alt_if_data_t *alt; 2685 ccid_class_features_t feat; 2686 uint_t bits; 2687 uint16_t ver = ccid->ccid_class.ccd_bcdCCID; 2688 2689 if (CCID_VERSION_MAJOR(ver) != CCID_VERSION_ONE) { 2690 ccid_error(ccid, "!refusing to attach to CCID with unsupported " 2691 "version %x.%2x", CCID_VERSION_MAJOR(ver), 2692 CCID_VERSION_MINOR(ver)); 2693 return (B_FALSE); 2694 } 2695 2696 /* 2697 * Check the number of endpoints. This should have either two or three. 2698 * If three, that means we should expect an interrupt-IN endpoint. 2699 * Otherwise, we shouldn't. Any other value indicates something weird 2700 * that we should ignore. 2701 */ 2702 dp = ccid->ccid_dev_data; 2703 alt = &dp->dev_curr_cfg->cfg_if[dp->dev_curr_if].if_alt[0]; 2704 switch (alt->altif_descr.bNumEndpoints) { 2705 case 2: 2706 ccid->ccid_flags &= ~CCID_F_HAS_INTR; 2707 break; 2708 case 3: 2709 ccid->ccid_flags |= CCID_F_HAS_INTR; 2710 break; 2711 default: 2712 ccid_error(ccid, "!refusing to attach to CCID with unsupported " 2713 "number of endpoints: %d", alt->altif_descr.bNumEndpoints); 2714 return (B_FALSE); 2715 } 2716 2717 /* 2718 * Try and determine the appropriate buffer size. This can be a little 2719 * tricky. The class descriptor tells us the maximum size that the 2720 * reader accepts. While it may be tempting to try and use a larger 2721 * value such as the maximum size, the readers really don't like 2722 * receiving bulk transfers that large. However, there are also reports 2723 * of readers that will overwrite to a fixed minimum size. Until we see 2724 * such a thing in the wild there's probably no point in trying to deal 2725 * with it here. 2726 */ 2727 ccid->ccid_bufsize = ccid->ccid_class.ccd_dwMaxCCIDMessageLength; 2728 if (ccid->ccid_bufsize < CCID_MIN_MESSAGE_LENGTH) { 2729 ccid_error(ccid, "!CCID reader maximum CCID message length (%u)" 2730 " is less than minimum packet length (%u)", 2731 ccid->ccid_bufsize, CCID_MIN_MESSAGE_LENGTH); 2732 return (B_FALSE); 2733 } 2734 2735 /* 2736 * At this time, we do not require that the system have automatic ICC 2737 * activation or automatic ICC voltage. These are handled automatically 2738 * by the system. 2739 */ 2740 feat = ccid->ccid_class.ccd_dwFeatures; 2741 2742 /* 2743 * Check the number of data rates that are supported by the reader. If 2744 * the reader has a non-zero value and we don't support automatic 2745 * negotiation then warn about that. 2746 */ 2747 if (ccid->ccid_class.ccd_bNumDataRatesSupported != 0 && 2748 (feat & CCID_CLASS_F_AUTO_BAUD) == 0) { 2749 ccid_error(ccid, "!CCID reader only supports fixed clock rates," 2750 " data will be limited to default values"); 2751 } 2752 2753 /* 2754 * Check which automatic features the reader provides and which features 2755 * it does not. Missing features will require additional work before a 2756 * card can be activated. Note, this also applies to APDU based readers 2757 * which may need to have various aspects of the device negotiated. 2758 */ 2759 2760 /* 2761 * The footnote for these two bits in CCID r1.1.0 indicates that 2762 * when neither are missing we have to do the PPS negotiation 2763 * ourselves. 2764 */ 2765 bits = CCID_CLASS_F_AUTO_PARAM_NEG | CCID_CLASS_F_AUTO_PPS; 2766 if ((feat & bits) == 0) { 2767 ccid->ccid_flags |= CCID_F_NEEDS_PPS; 2768 } 2769 2770 if ((feat & CCID_CLASS_F_AUTO_PARAM_NEG) == 0) { 2771 ccid->ccid_flags |= CCID_F_NEEDS_PARAMS; 2772 } 2773 2774 bits = CCID_CLASS_F_AUTO_BAUD | CCID_CLASS_F_AUTO_ICC_CLOCK; 2775 if ((feat & bits) != bits) { 2776 ccid->ccid_flags |= CCID_F_NEEDS_DATAFREQ; 2777 } 2778 2779 return (B_TRUE); 2780 } 2781 2782 static boolean_t 2783 ccid_open_pipes(ccid_t *ccid) 2784 { 2785 int ret; 2786 usb_ep_data_t *ep; 2787 usb_client_dev_data_t *data; 2788 usb_pipe_policy_t policy; 2789 2790 data = ccid->ccid_dev_data; 2791 2792 /* 2793 * First fill all the descriptors. 2794 */ 2795 ep = usb_lookup_ep_data(ccid->ccid_dip, data, data->dev_curr_if, 0, 0, 2796 USB_EP_ATTR_BULK, USB_EP_DIR_IN); 2797 if (ep == NULL) { 2798 ccid_error(ccid, "!failed to find CCID Bulk-IN endpoint"); 2799 return (B_FALSE); 2800 } 2801 2802 if ((ret = usb_ep_xdescr_fill(USB_EP_XDESCR_CURRENT_VERSION, 2803 ccid->ccid_dip, ep, &ccid->ccid_bulkin_xdesc)) != USB_SUCCESS) { 2804 ccid_error(ccid, "!failed to fill Bulk-IN xdescr: %d", ret); 2805 return (B_FALSE); 2806 } 2807 2808 ep = usb_lookup_ep_data(ccid->ccid_dip, data, data->dev_curr_if, 0, 0, 2809 USB_EP_ATTR_BULK, USB_EP_DIR_OUT); 2810 if (ep == NULL) { 2811 ccid_error(ccid, "!failed to find CCID Bulk-OUT endpoint"); 2812 return (B_FALSE); 2813 } 2814 2815 if ((ret = usb_ep_xdescr_fill(USB_EP_XDESCR_CURRENT_VERSION, 2816 ccid->ccid_dip, ep, &ccid->ccid_bulkout_xdesc)) != USB_SUCCESS) { 2817 ccid_error(ccid, "!failed to fill Bulk-OUT xdescr: %d", ret); 2818 return (B_FALSE); 2819 } 2820 2821 if (ccid->ccid_flags & CCID_F_HAS_INTR) { 2822 ep = usb_lookup_ep_data(ccid->ccid_dip, data, data->dev_curr_if, 2823 0, 0, USB_EP_ATTR_INTR, USB_EP_DIR_IN); 2824 if (ep == NULL) { 2825 ccid_error(ccid, "!failed to find CCID Intr-IN " 2826 "endpoint"); 2827 return (B_FALSE); 2828 } 2829 2830 if ((ret = usb_ep_xdescr_fill(USB_EP_XDESCR_CURRENT_VERSION, 2831 ccid->ccid_dip, ep, &ccid->ccid_intrin_xdesc)) != 2832 USB_SUCCESS) { 2833 ccid_error(ccid, "!failed to fill Intr-OUT xdescr: %d", 2834 ret); 2835 return (B_FALSE); 2836 } 2837 } 2838 2839 /* 2840 * Now open up the pipes. 2841 */ 2842 bzero(&policy, sizeof (policy)); 2843 policy.pp_max_async_reqs = CCID_NUM_ASYNC_REQS; 2844 2845 if ((ret = usb_pipe_xopen(ccid->ccid_dip, &ccid->ccid_bulkin_xdesc, 2846 &policy, USB_FLAGS_SLEEP, &ccid->ccid_bulkin_pipe)) != 2847 USB_SUCCESS) { 2848 ccid_error(ccid, "!failed to open Bulk-IN pipe: %d\n", ret); 2849 return (B_FALSE); 2850 } 2851 2852 if ((ret = usb_pipe_xopen(ccid->ccid_dip, &ccid->ccid_bulkout_xdesc, 2853 &policy, USB_FLAGS_SLEEP, &ccid->ccid_bulkout_pipe)) != 2854 USB_SUCCESS) { 2855 ccid_error(ccid, "!failed to open Bulk-OUT pipe: %d\n", ret); 2856 usb_pipe_close(ccid->ccid_dip, ccid->ccid_bulkin_pipe, 2857 USB_FLAGS_SLEEP, NULL, NULL); 2858 ccid->ccid_bulkin_pipe = NULL; 2859 return (B_FALSE); 2860 } 2861 2862 if (ccid->ccid_flags & CCID_F_HAS_INTR) { 2863 if ((ret = usb_pipe_xopen(ccid->ccid_dip, 2864 &ccid->ccid_intrin_xdesc, &policy, USB_FLAGS_SLEEP, 2865 &ccid->ccid_intrin_pipe)) != USB_SUCCESS) { 2866 ccid_error(ccid, "!failed to open Intr-IN pipe: %d\n", 2867 ret); 2868 usb_pipe_close(ccid->ccid_dip, ccid->ccid_bulkin_pipe, 2869 USB_FLAGS_SLEEP, NULL, NULL); 2870 ccid->ccid_bulkin_pipe = NULL; 2871 usb_pipe_close(ccid->ccid_dip, ccid->ccid_bulkout_pipe, 2872 USB_FLAGS_SLEEP, NULL, NULL); 2873 ccid->ccid_bulkout_pipe = NULL; 2874 return (B_FALSE); 2875 } 2876 } 2877 2878 ccid->ccid_control_pipe = data->dev_default_ph; 2879 return (B_TRUE); 2880 } 2881 2882 static void 2883 ccid_slots_fini(ccid_t *ccid) 2884 { 2885 uint_t i; 2886 2887 for (i = 0; i < ccid->ccid_nslots; i++) { 2888 VERIFY3U(ccid->ccid_slots[i].cs_slotno, ==, i); 2889 2890 if (ccid->ccid_slots[i].cs_command != NULL) { 2891 ccid_command_free(ccid->ccid_slots[i].cs_command); 2892 ccid->ccid_slots[i].cs_command = NULL; 2893 } 2894 2895 cv_destroy(&ccid->ccid_slots[i].cs_io.ci_cv); 2896 freemsgchain(ccid->ccid_slots[i].cs_atr); 2897 atr_data_free(ccid->ccid_slots[i].cs_icc.icc_atr_data); 2898 list_destroy(&ccid->ccid_slots[i].cs_minors); 2899 list_destroy(&ccid->ccid_slots[i].cs_excl_waiters); 2900 } 2901 2902 ddi_remove_minor_node(ccid->ccid_dip, NULL); 2903 kmem_free(ccid->ccid_slots, sizeof (ccid_slot_t) * ccid->ccid_nslots); 2904 ccid->ccid_nslots = 0; 2905 ccid->ccid_slots = NULL; 2906 } 2907 2908 static boolean_t 2909 ccid_slots_init(ccid_t *ccid) 2910 { 2911 uint_t i; 2912 2913 /* 2914 * The class descriptor has the maximum index that one can index into. 2915 * We therefore have to add one to determine the actual number of slots 2916 * that exist. 2917 */ 2918 ccid->ccid_nslots = ccid->ccid_class.ccd_bMaxSlotIndex + 1; 2919 ccid->ccid_slots = kmem_zalloc(sizeof (ccid_slot_t) * ccid->ccid_nslots, 2920 KM_SLEEP); 2921 for (i = 0; i < ccid->ccid_nslots; i++) { 2922 ccid_slot_t *slot = &ccid->ccid_slots[i]; 2923 2924 /* 2925 * We initialize every possible slot as having changed to make 2926 * sure that we have a chance to discover it. See the slot 2927 * detection section in the big theory statement for more info. 2928 */ 2929 slot->cs_flags |= CCID_SLOT_F_CHANGED; 2930 slot->cs_slotno = i; 2931 slot->cs_ccid = ccid; 2932 slot->cs_icc.icc_atr_data = atr_data_alloc(); 2933 slot->cs_idx.cmi_minor = CCID_MINOR_INVALID; 2934 slot->cs_idx.cmi_isslot = B_TRUE; 2935 slot->cs_idx.cmi_data.cmi_slot = slot; 2936 cv_init(&slot->cs_io.ci_cv, NULL, CV_DRIVER, NULL); 2937 list_create(&slot->cs_minors, sizeof (ccid_minor_t), 2938 offsetof(ccid_minor_t, cm_minor_list)); 2939 list_create(&slot->cs_excl_waiters, sizeof (ccid_minor_t), 2940 offsetof(ccid_minor_t, cm_excl_list)); 2941 } 2942 2943 return (B_TRUE); 2944 } 2945 2946 static void 2947 ccid_minors_fini(ccid_t *ccid) 2948 { 2949 uint_t i; 2950 2951 ddi_remove_minor_node(ccid->ccid_dip, NULL); 2952 for (i = 0; i < ccid->ccid_nslots; i++) { 2953 if (ccid->ccid_slots[i].cs_idx.cmi_minor == CCID_MINOR_INVALID) 2954 continue; 2955 ccid_minor_idx_free(&ccid->ccid_slots[i].cs_idx); 2956 } 2957 } 2958 2959 static boolean_t 2960 ccid_minors_init(ccid_t *ccid) 2961 { 2962 uint_t i; 2963 2964 for (i = 0; i < ccid->ccid_nslots; i++) { 2965 char buf[32]; 2966 2967 (void) ccid_minor_idx_alloc(&ccid->ccid_slots[i].cs_idx, 2968 B_TRUE); 2969 2970 (void) snprintf(buf, sizeof (buf), "slot%u", i); 2971 if (ddi_create_minor_node(ccid->ccid_dip, buf, S_IFCHR, 2972 ccid->ccid_slots[i].cs_idx.cmi_minor, 2973 DDI_NT_CCID_ATTACHMENT_POINT, 0) != DDI_SUCCESS) { 2974 ccid_minors_fini(ccid); 2975 return (B_FALSE); 2976 } 2977 } 2978 2979 return (B_TRUE); 2980 } 2981 2982 static void 2983 ccid_intr_poll_fini(ccid_t *ccid) 2984 { 2985 if (ccid->ccid_flags & CCID_F_HAS_INTR) { 2986 timeout_id_t tid; 2987 2988 mutex_enter(&ccid->ccid_mutex); 2989 tid = ccid->ccid_poll_timeout; 2990 ccid->ccid_poll_timeout = NULL; 2991 mutex_exit(&ccid->ccid_mutex); 2992 (void) untimeout(tid); 2993 usb_pipe_stop_intr_polling(ccid->ccid_intrin_pipe, 2994 USB_FLAGS_SLEEP); 2995 } else { 2996 VERIFY3P(ccid->ccid_intrin_pipe, ==, NULL); 2997 } 2998 } 2999 3000 static void 3001 ccid_intr_poll_init(ccid_t *ccid) 3002 { 3003 int ret; 3004 usb_intr_req_t *uirp; 3005 3006 uirp = usb_alloc_intr_req(ccid->ccid_dip, 0, USB_FLAGS_SLEEP); 3007 uirp->intr_client_private = (usb_opaque_t)ccid; 3008 uirp->intr_attributes = USB_ATTRS_SHORT_XFER_OK | 3009 USB_ATTRS_AUTOCLEARING; 3010 uirp->intr_len = CCID_INTR_RESPONSE_SIZE; 3011 uirp->intr_cb = ccid_intr_pipe_cb; 3012 uirp->intr_exc_cb = ccid_intr_pipe_except_cb; 3013 3014 mutex_enter(&ccid->ccid_mutex); 3015 if (ccid->ccid_flags & CCID_F_DEV_GONE_MASK) { 3016 mutex_exit(&ccid->ccid_mutex); 3017 usb_free_intr_req(uirp); 3018 return; 3019 } 3020 3021 if ((ret = usb_pipe_intr_xfer(ccid->ccid_intrin_pipe, uirp, 3022 USB_FLAGS_SLEEP)) != USB_SUCCESS) { 3023 ccid_error(ccid, "!failed to start polling on CCID Intr-IN " 3024 "pipe: %d", ret); 3025 ccid->ccid_poll_timeout = timeout(ccid_intr_restart_timeout, 3026 ccid, drv_usectohz(1000000)); 3027 usb_free_intr_req(uirp); 3028 } 3029 mutex_exit(&ccid->ccid_mutex); 3030 } 3031 3032 static void 3033 ccid_cleanup_bulkin(ccid_t *ccid) 3034 { 3035 uint_t i; 3036 3037 VERIFY3P(ccid->ccid_bulkin_dispatched, ==, NULL); 3038 for (i = 0; i < ccid->ccid_bulkin_alloced; i++) { 3039 VERIFY3P(ccid->ccid_bulkin_cache[i], !=, NULL); 3040 usb_free_bulk_req(ccid->ccid_bulkin_cache[i]); 3041 ccid->ccid_bulkin_cache[i] = NULL; 3042 } 3043 3044 #ifdef DEBUG 3045 for (i = 0; i < CCID_BULK_NALLOCED; i++) { 3046 VERIFY3P(ccid->ccid_bulkin_cache[i], ==, NULL); 3047 } 3048 #endif 3049 ccid->ccid_bulkin_alloced = 0; 3050 } 3051 3052 static int 3053 ccid_disconnect_cb(dev_info_t *dip) 3054 { 3055 int inst; 3056 ccid_t *ccid; 3057 uint_t i; 3058 3059 if (dip == NULL) 3060 goto done; 3061 3062 inst = ddi_get_instance(dip); 3063 ccid = ddi_get_soft_state(ccid_softstate, inst); 3064 if (ccid == NULL) 3065 goto done; 3066 VERIFY3P(dip, ==, ccid->ccid_dip); 3067 3068 mutex_enter(&ccid->ccid_mutex); 3069 /* 3070 * First, set the disconnected flag. This will make sure that anyone 3071 * that tries to make additional operations will be kicked out. This 3072 * flag is checked by detach and by users. 3073 */ 3074 ccid->ccid_flags |= CCID_F_DISCONNECTED; 3075 3076 /* 3077 * Now, go through any threads that are blocked on a minor for exclusive 3078 * access. They should be woken up and they'll fail due to the fact that 3079 * we've set the disconnected flag above. 3080 */ 3081 for (i = 0; i < ccid->ccid_nslots; i++) { 3082 ccid_minor_t *cmp; 3083 ccid_slot_t *slot = &ccid->ccid_slots[i]; 3084 3085 for (cmp = list_head(&slot->cs_excl_waiters); cmp != NULL; 3086 cmp = list_next(&slot->cs_excl_waiters, cmp)) { 3087 cv_signal(&cmp->cm_excl_cv); 3088 } 3089 } 3090 3091 /* 3092 * Finally, we need to basically wake up anyone blocked in read and make 3093 * sure that they don't wait there forever and make sure that anyone 3094 * polling gets a POLLHUP. We can't really distinguish between this and 3095 * an ICC being removed. It will be discovered when someone tries to do 3096 * an operation and they receive an ENODEV. We only need to do this on 3097 * minors that have exclusive access. Don't worry about them finishing 3098 * up, this'll be done as part of detach. 3099 */ 3100 for (i = 0; i < ccid->ccid_nslots; i++) { 3101 ccid_slot_t *slot = &ccid->ccid_slots[i]; 3102 if (slot->cs_excl_minor == NULL) 3103 continue; 3104 3105 pollwakeup(&slot->cs_excl_minor->cm_pollhead, 3106 POLLHUP | POLLERR); 3107 cv_signal(&slot->cs_excl_minor->cm_read_cv); 3108 } 3109 3110 /* 3111 * If there are outstanding commands, they will ultimately be cleaned 3112 * up as the USB commands themselves time out. We will get notified 3113 * through the various bulk xfer exception callbacks, which will induce 3114 * the cleanup through ccid_command_transport_error(). This will also 3115 * take care of commands waiting for I/O teardown. 3116 */ 3117 mutex_exit(&ccid->ccid_mutex); 3118 3119 done: 3120 return (USB_SUCCESS); 3121 } 3122 3123 static usb_event_t ccid_usb_events = { 3124 ccid_disconnect_cb, 3125 NULL, 3126 NULL, 3127 NULL 3128 }; 3129 3130 static void 3131 ccid_cleanup(dev_info_t *dip) 3132 { 3133 int inst; 3134 ccid_t *ccid; 3135 3136 if (dip == NULL) 3137 return; 3138 3139 inst = ddi_get_instance(dip); 3140 ccid = ddi_get_soft_state(ccid_softstate, inst); 3141 if (ccid == NULL) 3142 return; 3143 VERIFY3P(dip, ==, ccid->ccid_dip); 3144 3145 /* 3146 * Make sure we set the detaching flag so anything running in the 3147 * background knows to stop. 3148 */ 3149 mutex_enter(&ccid->ccid_mutex); 3150 ccid->ccid_flags |= CCID_F_DETACHING; 3151 mutex_exit(&ccid->ccid_mutex); 3152 3153 if ((ccid->ccid_attach & CCID_ATTACH_MINORS) != 0) { 3154 ccid_minors_fini(ccid); 3155 ccid->ccid_attach &= ~CCID_ATTACH_MINORS; 3156 } 3157 3158 if ((ccid->ccid_attach & CCID_ATTACH_INTR_ACTIVE) != 0) { 3159 ccid_intr_poll_fini(ccid); 3160 ccid->ccid_attach &= ~CCID_ATTACH_INTR_ACTIVE; 3161 } 3162 3163 /* 3164 * At this point, we have shut down the interrupt pipe, the last place 3165 * aside from a user that could have kicked off I/O. So finally wait for 3166 * any worker threads. 3167 */ 3168 if (ccid->ccid_taskq != NULL) { 3169 ddi_taskq_wait(ccid->ccid_taskq); 3170 mutex_enter(&ccid->ccid_mutex); 3171 VERIFY0(ccid->ccid_flags & CCID_F_WORKER_MASK); 3172 mutex_exit(&ccid->ccid_mutex); 3173 } 3174 3175 if ((ccid->ccid_attach & CCID_ATTACH_HOTPLUG_CB) != 0) { 3176 usb_unregister_event_cbs(dip, &ccid_usb_events); 3177 ccid->ccid_attach &= ~CCID_ATTACH_HOTPLUG_CB; 3178 } 3179 3180 if ((ccid->ccid_attach & CCID_ATTACH_SLOTS) != 0) { 3181 ccid_slots_fini(ccid); 3182 ccid->ccid_attach &= ~CCID_ATTACH_SLOTS; 3183 } 3184 3185 if ((ccid->ccid_attach & CCID_ATTACH_SEQ_IDS) != 0) { 3186 id_space_destroy(ccid->ccid_seqs); 3187 ccid->ccid_seqs = NULL; 3188 ccid->ccid_attach &= ~CCID_ATTACH_SEQ_IDS; 3189 } 3190 3191 if ((ccid->ccid_attach & CCID_ATTACH_OPEN_PIPES) != 0) { 3192 usb_pipe_close(dip, ccid->ccid_bulkin_pipe, USB_FLAGS_SLEEP, 3193 NULL, NULL); 3194 ccid->ccid_bulkin_pipe = NULL; 3195 usb_pipe_close(dip, ccid->ccid_bulkout_pipe, USB_FLAGS_SLEEP, 3196 NULL, NULL); 3197 ccid->ccid_bulkout_pipe = NULL; 3198 if ((ccid->ccid_flags & CCID_F_HAS_INTR) != 0) { 3199 usb_pipe_close(dip, ccid->ccid_intrin_pipe, 3200 USB_FLAGS_SLEEP, NULL, NULL); 3201 ccid->ccid_intrin_pipe = NULL; 3202 } else { 3203 VERIFY3P(ccid->ccid_intrin_pipe, ==, NULL); 3204 } 3205 ccid->ccid_control_pipe = NULL; 3206 ccid->ccid_attach &= ~CCID_ATTACH_OPEN_PIPES; 3207 } 3208 3209 /* 3210 * Now that all of the pipes are closed. If we happened to have any 3211 * cached bulk requests, we should free them. 3212 */ 3213 ccid_cleanup_bulkin(ccid); 3214 3215 if (ccid->ccid_attach & CCID_ATTACH_CMD_LIST) { 3216 ccid_command_t *cc; 3217 3218 while ((cc = list_remove_head(&ccid->ccid_command_queue)) != 3219 NULL) { 3220 ccid_command_free(cc); 3221 } 3222 list_destroy(&ccid->ccid_command_queue); 3223 3224 while ((cc = list_remove_head(&ccid->ccid_complete_queue)) != 3225 NULL) { 3226 ccid_command_free(cc); 3227 } 3228 list_destroy(&ccid->ccid_complete_queue); 3229 } 3230 3231 if ((ccid->ccid_attach & CCID_ATTACH_TASKQ) != 0) { 3232 ddi_taskq_destroy(ccid->ccid_taskq); 3233 ccid->ccid_taskq = NULL; 3234 ccid->ccid_attach &= ~CCID_ATTACH_TASKQ; 3235 } 3236 3237 if ((ccid->ccid_attach & CCID_ATTACH_MUTEX_INIT) != 0) { 3238 mutex_destroy(&ccid->ccid_mutex); 3239 ccid->ccid_attach &= ~CCID_ATTACH_MUTEX_INIT; 3240 } 3241 3242 if ((ccid->ccid_attach & CCID_ATTACH_USB_CLIENT) != 0) { 3243 usb_client_detach(dip, ccid->ccid_dev_data); 3244 ccid->ccid_dev_data = NULL; 3245 ccid->ccid_attach &= ~CCID_ATTACH_USB_CLIENT; 3246 } 3247 3248 ASSERT0(ccid->ccid_attach); 3249 ddi_soft_state_free(ccid_softstate, inst); 3250 } 3251 3252 static int 3253 ccid_attach(dev_info_t *dip, ddi_attach_cmd_t cmd) 3254 { 3255 ccid_t *ccid; 3256 int inst, ret; 3257 char buf[64]; 3258 3259 if (cmd != DDI_ATTACH) 3260 return (DDI_FAILURE); 3261 3262 inst = ddi_get_instance(dip); 3263 if (ddi_soft_state_zalloc(ccid_softstate, inst) != DDI_SUCCESS) { 3264 ccid_error(NULL, "!failed to allocate soft state for ccid " 3265 "instance %d", inst); 3266 return (DDI_FAILURE); 3267 } 3268 3269 ccid = ddi_get_soft_state(ccid_softstate, inst); 3270 ccid->ccid_dip = dip; 3271 3272 if ((ret = usb_client_attach(dip, USBDRV_VERSION, 0)) != USB_SUCCESS) { 3273 ccid_error(ccid, "!failed to attach to usb client: %d", ret); 3274 goto cleanup; 3275 } 3276 ccid->ccid_attach |= CCID_ATTACH_USB_CLIENT; 3277 3278 if ((ret = usb_get_dev_data(dip, &ccid->ccid_dev_data, USB_PARSE_LVL_IF, 3279 0)) != USB_SUCCESS) { 3280 ccid_error(ccid, "!failed to get usb device data: %d", ret); 3281 goto cleanup; 3282 } 3283 3284 mutex_init(&ccid->ccid_mutex, NULL, MUTEX_DRIVER, 3285 ccid->ccid_dev_data->dev_iblock_cookie); 3286 ccid->ccid_attach |= CCID_ATTACH_MUTEX_INIT; 3287 3288 (void) snprintf(buf, sizeof (buf), "ccid%d_taskq", inst); 3289 ccid->ccid_taskq = ddi_taskq_create(dip, buf, 1, TASKQ_DEFAULTPRI, 0); 3290 if (ccid->ccid_taskq == NULL) { 3291 ccid_error(ccid, "!failed to create CCID taskq"); 3292 goto cleanup; 3293 } 3294 ccid->ccid_attach |= CCID_ATTACH_TASKQ; 3295 3296 list_create(&ccid->ccid_command_queue, sizeof (ccid_command_t), 3297 offsetof(ccid_command_t, cc_list_node)); 3298 list_create(&ccid->ccid_complete_queue, sizeof (ccid_command_t), 3299 offsetof(ccid_command_t, cc_list_node)); 3300 3301 if (!ccid_parse_class_desc(ccid)) { 3302 ccid_error(ccid, "!failed to parse CCID class descriptor"); 3303 goto cleanup; 3304 } 3305 3306 if (!ccid_supported(ccid)) { 3307 ccid_error(ccid, 3308 "!CCID reader is not supported, not attaching"); 3309 goto cleanup; 3310 } 3311 3312 if (!ccid_open_pipes(ccid)) { 3313 ccid_error(ccid, "!failed to open CCID pipes, not attaching"); 3314 goto cleanup; 3315 } 3316 ccid->ccid_attach |= CCID_ATTACH_OPEN_PIPES; 3317 3318 (void) snprintf(buf, sizeof (buf), "ccid%d_seqs", inst); 3319 if ((ccid->ccid_seqs = id_space_create(buf, CCID_SEQ_MIN, 3320 CCID_SEQ_MAX + 1)) == NULL) { 3321 ccid_error(ccid, "!failed to create CCID sequence id space"); 3322 goto cleanup; 3323 } 3324 ccid->ccid_attach |= CCID_ATTACH_SEQ_IDS; 3325 3326 if (!ccid_slots_init(ccid)) { 3327 ccid_error(ccid, "!failed to initialize CCID slot structures"); 3328 goto cleanup; 3329 } 3330 ccid->ccid_attach |= CCID_ATTACH_SLOTS; 3331 3332 if (usb_register_event_cbs(dip, &ccid_usb_events, 0) != USB_SUCCESS) { 3333 ccid_error(ccid, "!failed to register USB hotplug callbacks"); 3334 goto cleanup; 3335 } 3336 ccid->ccid_attach |= CCID_ATTACH_HOTPLUG_CB; 3337 3338 /* 3339 * Before we enable the interrupt pipe, take a shot at priming our 3340 * bulkin_cache. 3341 */ 3342 mutex_enter(&ccid->ccid_mutex); 3343 ccid_bulkin_cache_refresh(ccid); 3344 mutex_exit(&ccid->ccid_mutex); 3345 3346 if (ccid->ccid_flags & CCID_F_HAS_INTR) { 3347 ccid_intr_poll_init(ccid); 3348 } 3349 ccid->ccid_attach |= CCID_ATTACH_INTR_ACTIVE; 3350 3351 /* 3352 * Create minor nodes for each slot. 3353 */ 3354 if (!ccid_minors_init(ccid)) { 3355 ccid_error(ccid, "!failed to create minor nodes"); 3356 goto cleanup; 3357 } 3358 ccid->ccid_attach |= CCID_ATTACH_MINORS; 3359 3360 mutex_enter(&ccid->ccid_mutex); 3361 ccid_worker_request(ccid); 3362 mutex_exit(&ccid->ccid_mutex); 3363 3364 return (DDI_SUCCESS); 3365 3366 cleanup: 3367 ccid_cleanup(dip); 3368 return (DDI_FAILURE); 3369 } 3370 3371 static int 3372 ccid_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **outp) 3373 { 3374 return (DDI_FAILURE); 3375 } 3376 3377 static int 3378 ccid_detach(dev_info_t *dip, ddi_detach_cmd_t cmd) 3379 { 3380 int inst; 3381 ccid_t *ccid; 3382 3383 if (cmd != DDI_DETACH) 3384 return (DDI_FAILURE); 3385 3386 inst = ddi_get_instance(dip); 3387 ccid = ddi_get_soft_state(ccid_softstate, inst); 3388 VERIFY3P(ccid, !=, NULL); 3389 VERIFY3P(dip, ==, ccid->ccid_dip); 3390 3391 mutex_enter(&ccid->ccid_mutex); 3392 3393 /* 3394 * If the device hasn't been disconnected from a USB sense, refuse to 3395 * detach. Otherwise, there's no way to guarantee that the ccid 3396 * driver will be attached when a user hotplugs an ICC. 3397 */ 3398 if ((ccid->ccid_flags & CCID_F_DISCONNECTED) == 0) { 3399 mutex_exit(&ccid->ccid_mutex); 3400 return (DDI_FAILURE); 3401 } 3402 3403 if (!list_is_empty(&ccid->ccid_command_queue) || 3404 !list_is_empty(&ccid->ccid_complete_queue)) { 3405 mutex_exit(&ccid->ccid_mutex); 3406 return (DDI_FAILURE); 3407 } 3408 mutex_exit(&ccid->ccid_mutex); 3409 3410 ccid_cleanup(dip); 3411 return (DDI_SUCCESS); 3412 } 3413 3414 static void 3415 ccid_minor_free(ccid_minor_t *cmp) 3416 { 3417 VERIFY3U(cmp->cm_idx.cmi_minor, ==, CCID_MINOR_INVALID); 3418 crfree(cmp->cm_opener); 3419 cv_destroy(&cmp->cm_iowait_cv); 3420 cv_destroy(&cmp->cm_read_cv); 3421 cv_destroy(&cmp->cm_excl_cv); 3422 kmem_free(cmp, sizeof (ccid_minor_t)); 3423 3424 } 3425 3426 static int 3427 ccid_open(dev_t *devp, int flag, int otyp, cred_t *credp) 3428 { 3429 ccid_minor_idx_t *idx; 3430 ccid_minor_t *cmp; 3431 ccid_slot_t *slot; 3432 3433 /* 3434 * Always check the zone first, to make sure we lie about it existing. 3435 */ 3436 if (crgetzoneid(credp) != GLOBAL_ZONEID) 3437 return (ENOENT); 3438 3439 if ((otyp & (FNDELAY | FEXCL)) != 0) 3440 return (EINVAL); 3441 3442 if (drv_priv(credp) != 0) 3443 return (EPERM); 3444 3445 if (otyp != OTYP_CHR) 3446 return (ENOTSUP); 3447 3448 if ((flag & FREAD) != FREAD) 3449 return (EINVAL); 3450 3451 idx = ccid_minor_find(getminor(*devp)); 3452 if (idx == NULL) { 3453 return (ENOENT); 3454 } 3455 3456 /* 3457 * We don't expect anyone to be able to get a non-slot related minor. If 3458 * that somehow happens, guard against it and error out. 3459 */ 3460 if (!idx->cmi_isslot) { 3461 return (ENOENT); 3462 } 3463 3464 slot = idx->cmi_data.cmi_slot; 3465 3466 mutex_enter(&slot->cs_ccid->ccid_mutex); 3467 if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 3468 mutex_exit(&slot->cs_ccid->ccid_mutex); 3469 return (ENODEV); 3470 } 3471 mutex_exit(&slot->cs_ccid->ccid_mutex); 3472 3473 cmp = kmem_zalloc(sizeof (ccid_minor_t), KM_SLEEP); 3474 3475 cmp->cm_idx.cmi_minor = CCID_MINOR_INVALID; 3476 cmp->cm_idx.cmi_isslot = B_FALSE; 3477 cmp->cm_idx.cmi_data.cmi_user = cmp; 3478 if (!ccid_minor_idx_alloc(&cmp->cm_idx, B_FALSE)) { 3479 kmem_free(cmp, sizeof (ccid_minor_t)); 3480 return (ENOSPC); 3481 } 3482 cv_init(&cmp->cm_excl_cv, NULL, CV_DRIVER, NULL); 3483 cv_init(&cmp->cm_read_cv, NULL, CV_DRIVER, NULL); 3484 cv_init(&cmp->cm_iowait_cv, NULL, CV_DRIVER, NULL); 3485 cmp->cm_opener = crdup(credp); 3486 cmp->cm_slot = slot; 3487 *devp = makedevice(getmajor(*devp), cmp->cm_idx.cmi_minor); 3488 3489 if ((flag & FWRITE) == FWRITE) { 3490 cmp->cm_flags |= CCID_MINOR_F_WRITABLE; 3491 } 3492 3493 mutex_enter(&slot->cs_ccid->ccid_mutex); 3494 list_insert_tail(&slot->cs_minors, cmp); 3495 mutex_exit(&slot->cs_ccid->ccid_mutex); 3496 3497 return (0); 3498 } 3499 3500 /* 3501 * Copy a command which may have a message block chain out to the user. 3502 */ 3503 static int 3504 ccid_read_copyout(struct uio *uiop, const mblk_t *mp) 3505 { 3506 offset_t off; 3507 3508 off = uiop->uio_loffset; 3509 VERIFY3P(mp->b_next, ==, NULL); 3510 3511 for (; mp != NULL; mp = mp->b_cont) { 3512 int ret; 3513 3514 if (MBLKL(mp) == 0) 3515 continue; 3516 3517 ret = uiomove(mp->b_rptr, MBLKL(mp), UIO_READ, uiop); 3518 if (ret != 0) { 3519 return (EFAULT); 3520 } 3521 } 3522 3523 uiop->uio_loffset = off; 3524 return (0); 3525 } 3526 3527 /* 3528 * Called to indicate that we are ready for a user to consume the I/O. 3529 */ 3530 static void 3531 ccid_user_io_done(ccid_t *ccid, ccid_slot_t *slot) 3532 { 3533 ccid_minor_t *cmp; 3534 3535 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 3536 3537 slot->cs_io.ci_flags &= ~CCID_IO_F_IN_PROGRESS; 3538 slot->cs_io.ci_flags |= CCID_IO_F_DONE; 3539 cmp = slot->cs_excl_minor; 3540 if (cmp != NULL) { 3541 ccid_slot_pollin_signal(slot); 3542 cv_signal(&cmp->cm_read_cv); 3543 } 3544 } 3545 3546 /* 3547 * This is called in a few different sitautions. It's called when an exclusive 3548 * hold is being released by a user on the slot. It's also called when the ICC 3549 * is removed, the reader has been unplugged, or the ICC is being reset. In all 3550 * these cases we need to make sure that I/O is taken care of and we won't be 3551 * leaving behind vestigial garbage. 3552 */ 3553 static void 3554 ccid_teardown_apdu(ccid_t *ccid, ccid_slot_t *slot, int error) 3555 { 3556 3557 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 3558 3559 /* 3560 * If no I/O is in progress, then there's nothing to do at our end. 3561 */ 3562 if ((slot->cs_io.ci_flags & CCID_IO_F_IN_PROGRESS) == 0) { 3563 return; 3564 } 3565 3566 slot->cs_io.ci_errno = error; 3567 ccid_user_io_done(ccid, slot); 3568 3569 /* 3570 * There is still I/O going on. We need to mark this on the slot such 3571 * that no one can gain ownership of it or issue commands. This will 3572 * block hand off of a slot. 3573 */ 3574 slot->cs_flags |= CCID_SLOT_F_NEED_IO_TEARDOWN; 3575 } 3576 3577 /* 3578 * This function is called in response to a CCID command completing. 3579 */ 3580 static void 3581 ccid_complete_apdu(ccid_t *ccid, ccid_slot_t *slot, ccid_command_t *cc) 3582 { 3583 ccid_reply_command_status_t crs; 3584 ccid_reply_icc_status_t cis; 3585 ccid_command_err_t cce; 3586 3587 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 3588 VERIFY3P(slot->cs_io.ci_command, ==, cc); 3589 3590 /* 3591 * This completion could be called due to the fact that a user is no 3592 * longer present, but we still have outstanding work to do in the 3593 * stack. As such, we need to go through and check if the flag was set 3594 * on the slot during teardown and if so, clean it up now. 3595 */ 3596 if ((slot->cs_flags & CCID_SLOT_F_NEED_IO_TEARDOWN) != 0) { 3597 ccid_command_free(cc); 3598 slot->cs_io.ci_command = NULL; 3599 ccid_slot_io_teardown_done(slot); 3600 return; 3601 } 3602 3603 /* 3604 * Process this command and figure out what we should logically be 3605 * returning to the user. 3606 */ 3607 if (cc->cc_state != CCID_COMMAND_COMPLETE) { 3608 slot->cs_io.ci_errno = EIO; 3609 slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET; 3610 ccid_worker_request(ccid); 3611 goto consume; 3612 } 3613 3614 ccid_command_status_decode(cc, &crs, &cis, &cce); 3615 if (crs == CCID_REPLY_STATUS_COMPLETE) { 3616 mblk_t *mp; 3617 3618 mp = cc->cc_response; 3619 cc->cc_response = NULL; 3620 mp->b_rptr += sizeof (ccid_header_t); 3621 slot->cs_io.ci_errno = 0; 3622 slot->cs_io.ci_data = mp; 3623 } else if (cis == CCID_REPLY_ICC_MISSING) { 3624 slot->cs_io.ci_errno = ENXIO; 3625 } else { 3626 /* 3627 * There are a few more semantic things we can do 3628 * with the errors here that we're throwing out and 3629 * lumping as EIO. Oh well. 3630 */ 3631 slot->cs_io.ci_errno = EIO; 3632 } 3633 3634 /* 3635 * Now, we can go ahead and wake up a reader to process this command. 3636 */ 3637 consume: 3638 slot->cs_io.ci_command = NULL; 3639 ccid_command_free(cc); 3640 ccid_user_io_done(ccid, slot); 3641 } 3642 3643 /* 3644 * We have the user buffer in the CCID slot. Given that, transform it into 3645 * something that we can send to the device. For APDU's this is simply creating 3646 * a transfer command and copying it into that buffer. 3647 */ 3648 static int 3649 ccid_write_apdu(ccid_t *ccid, ccid_slot_t *slot) 3650 { 3651 int ret; 3652 ccid_command_t *cc; 3653 3654 VERIFY(MUTEX_HELD(&ccid->ccid_mutex)); 3655 3656 if ((ret = ccid_command_alloc(ccid, slot, B_FALSE, NULL, 3657 slot->cs_io.ci_ilen, CCID_REQUEST_TRANSFER_BLOCK, 0, 0, 0, 3658 &cc)) != 0) { 3659 return (ret); 3660 } 3661 3662 cc->cc_flags |= CCID_COMMAND_F_USER; 3663 ccid_command_bcopy(cc, slot->cs_io.ci_ibuf, slot->cs_io.ci_ilen); 3664 3665 slot->cs_io.ci_command = cc; 3666 mutex_exit(&ccid->ccid_mutex); 3667 3668 if ((ret = ccid_command_queue(ccid, cc)) != 0) { 3669 mutex_enter(&ccid->ccid_mutex); 3670 slot->cs_io.ci_command = NULL; 3671 ccid_command_free(cc); 3672 return (ret); 3673 } 3674 3675 mutex_enter(&ccid->ccid_mutex); 3676 3677 return (0); 3678 } 3679 3680 static int 3681 ccid_read(dev_t dev, struct uio *uiop, cred_t *credp) 3682 { 3683 int ret; 3684 ccid_minor_idx_t *idx; 3685 ccid_minor_t *cmp; 3686 ccid_slot_t *slot; 3687 ccid_t *ccid; 3688 boolean_t done; 3689 3690 if (uiop->uio_resid <= 0) { 3691 return (EINVAL); 3692 } 3693 3694 if ((idx = ccid_minor_find_user(getminor(dev))) == NULL) { 3695 return (ENOENT); 3696 } 3697 3698 cmp = idx->cmi_data.cmi_user; 3699 slot = cmp->cm_slot; 3700 ccid = slot->cs_ccid; 3701 3702 mutex_enter(&ccid->ccid_mutex); 3703 if ((ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 3704 mutex_exit(&ccid->ccid_mutex); 3705 return (ENODEV); 3706 } 3707 3708 /* 3709 * First, check if we have exclusive access. If not, we're done. 3710 */ 3711 if ((cmp->cm_flags & CCID_MINOR_F_HAS_EXCL) == 0) { 3712 mutex_exit(&ccid->ccid_mutex); 3713 return (EACCES); 3714 } 3715 3716 /* 3717 * While it's tempting to mirror ccid_write() here and check if we have 3718 * a tx or rx function, that actually has no relevance on read. The only 3719 * thing that matters is whether or not we actually have an I/O. 3720 */ 3721 3722 /* 3723 * If there's been no write I/O issued, then this read is not allowed. 3724 * While this may seem like a silly constraint, it certainly simplifies 3725 * a lot of the surrounding logic and fits with the current consumer 3726 * model. 3727 */ 3728 if ((slot->cs_io.ci_flags & (CCID_IO_F_IN_PROGRESS | CCID_IO_F_DONE)) == 3729 0) { 3730 mutex_exit(&ccid->ccid_mutex); 3731 return (ENODATA); 3732 } 3733 3734 /* 3735 * If another thread is already blocked in read, then don't allow us 3736 * in. We only want to allow one thread to attempt to consume a read, 3737 * just as we only allow one thread to initiate a write. 3738 */ 3739 if ((cmp->cm_flags & CCID_MINOR_F_READ_WAITING) != 0) { 3740 mutex_exit(&ccid->ccid_mutex); 3741 return (EBUSY); 3742 } 3743 3744 /* 3745 * Check if an I/O has completed. Once it has, call the protocol 3746 * specific code. Note that the lock may be dropped after polling. In 3747 * such a case we will have to logically recheck several conditions. 3748 * 3749 * Note, we don't really care if the slot is active or not as I/O could 3750 * have been in flight while the slot was inactive. 3751 */ 3752 while ((slot->cs_io.ci_flags & CCID_IO_F_DONE) == 0) { 3753 if (uiop->uio_fmode & FNONBLOCK) { 3754 mutex_exit(&ccid->ccid_mutex); 3755 return (EWOULDBLOCK); 3756 } 3757 3758 /* 3759 * While we perform a cv_wait_sig() we'll end up dropping the 3760 * CCID mutex. This means that we need to notify the rest of the 3761 * driver that a thread is blocked in read. This is used not 3762 * only for excluding multiple threads trying to read from the 3763 * device, but more importantly so that we know that if the ICC 3764 * or reader are removed, that we need to wake up this thread. 3765 */ 3766 cmp->cm_flags |= CCID_MINOR_F_READ_WAITING; 3767 ret = cv_wait_sig(&cmp->cm_read_cv, &ccid->ccid_mutex); 3768 cmp->cm_flags &= ~CCID_MINOR_F_READ_WAITING; 3769 cv_signal(&cmp->cm_iowait_cv); 3770 3771 if (ret == 0) { 3772 mutex_exit(&ccid->ccid_mutex); 3773 return (EINTR); 3774 } 3775 3776 /* 3777 * Check if the reader has been removed. We do not need to check 3778 * for other conditions, as we'll end up being told that the I/O 3779 * is done and that the error has been set. 3780 */ 3781 if ((ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 3782 mutex_exit(&ccid->ccid_mutex); 3783 return (ENODEV); 3784 } 3785 } 3786 3787 /* 3788 * We'll either have an error or data available for the user at this 3789 * point that we can copy out. We need to make sure that it's not too 3790 * large. The data should have already been adjusted such that we only 3791 * have data payloads. 3792 */ 3793 done = B_FALSE; 3794 if (slot->cs_io.ci_errno == 0) { 3795 size_t mlen; 3796 3797 mlen = msgsize(slot->cs_io.ci_data); 3798 if (mlen > uiop->uio_resid) { 3799 ret = EOVERFLOW; 3800 } else { 3801 ret = ccid_read_copyout(uiop, slot->cs_io.ci_data); 3802 if (ret == 0) { 3803 done = B_TRUE; 3804 } 3805 } 3806 } else { 3807 ret = slot->cs_io.ci_errno; 3808 done = B_TRUE; 3809 } 3810 3811 if (done) { 3812 ccid_clear_io(&slot->cs_io); 3813 ccid_slot_pollout_signal(slot); 3814 } 3815 3816 mutex_exit(&ccid->ccid_mutex); 3817 3818 return (ret); 3819 } 3820 3821 static int 3822 ccid_write(dev_t dev, struct uio *uiop, cred_t *credp) 3823 { 3824 int ret; 3825 ccid_minor_idx_t *idx; 3826 ccid_minor_t *cmp; 3827 ccid_slot_t *slot; 3828 ccid_t *ccid; 3829 size_t len, cbytes; 3830 3831 if (uiop->uio_resid > CCID_APDU_LEN_MAX) { 3832 return (E2BIG); 3833 } 3834 3835 if (uiop->uio_resid <= 0) { 3836 return (EINVAL); 3837 } 3838 3839 len = uiop->uio_resid; 3840 idx = ccid_minor_find_user(getminor(dev)); 3841 if (idx == NULL) { 3842 return (ENOENT); 3843 } 3844 3845 cmp = idx->cmi_data.cmi_user; 3846 slot = cmp->cm_slot; 3847 ccid = slot->cs_ccid; 3848 3849 /* 3850 * Now that we have the slot, verify whether or not we can perform this 3851 * I/O. 3852 */ 3853 mutex_enter(&ccid->ccid_mutex); 3854 if ((ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 3855 mutex_exit(&ccid->ccid_mutex); 3856 return (ENODEV); 3857 } 3858 3859 /* 3860 * Check that we are open for writing, have exclusive access, and 3861 * there's a card present. If not, error out. 3862 */ 3863 if ((cmp->cm_flags & (CCID_MINOR_F_WRITABLE | CCID_MINOR_F_HAS_EXCL)) != 3864 (CCID_MINOR_F_WRITABLE | CCID_MINOR_F_HAS_EXCL)) { 3865 mutex_exit(&ccid->ccid_mutex); 3866 return (EACCES); 3867 } 3868 3869 if ((slot->cs_flags & CCID_SLOT_F_ACTIVE) == 0) { 3870 mutex_exit(&ccid->ccid_mutex); 3871 return (ENXIO); 3872 } 3873 3874 /* 3875 * Make sure that we have a supported transmit function. 3876 */ 3877 if (slot->cs_icc.icc_tx == NULL) { 3878 mutex_exit(&ccid->ccid_mutex); 3879 return (ENOTSUP); 3880 } 3881 3882 /* 3883 * See if another command is in progress. If so, try to claim it. 3884 * Otherwise, fail with EBUSY. Note, we only fail for commands that are 3885 * user initiated. There may be other commands that are ongoing in the 3886 * system. 3887 */ 3888 if ((slot->cs_io.ci_flags & CCID_IO_F_POLLOUT_FLAGS) != 0) { 3889 mutex_exit(&ccid->ccid_mutex); 3890 return (EBUSY); 3891 } 3892 3893 /* 3894 * Use uiocopy and not uiomove. This way if we fail for whatever reason, 3895 * we don't have to worry about restoring the original buffer. 3896 */ 3897 if (uiocopy(slot->cs_io.ci_ibuf, len, UIO_WRITE, uiop, &cbytes) != 0) { 3898 mutex_exit(&ccid->ccid_mutex); 3899 return (EFAULT); 3900 } 3901 3902 slot->cs_io.ci_ilen = len; 3903 slot->cs_io.ci_flags |= CCID_IO_F_PREPARING; 3904 slot->cs_io.ci_omp = NULL; 3905 3906 /* 3907 * Now that we're here, go ahead and call the actual tx function. 3908 */ 3909 if ((ret = slot->cs_icc.icc_tx(ccid, slot)) != 0) { 3910 /* 3911 * The command wasn't actually transmitted. In this case we need 3912 * to reset the copied in data and signal anyone who is polling 3913 * that this is writeable again. We don't have to worry about 3914 * readers at this point, as they won't get in unless 3915 * CCID_IO_F_IN_PROGRESS has been set. 3916 */ 3917 slot->cs_io.ci_ilen = 0; 3918 bzero(slot->cs_io.ci_ibuf, sizeof (slot->cs_io.ci_ibuf)); 3919 slot->cs_io.ci_flags &= ~CCID_IO_F_PREPARING; 3920 3921 ccid_slot_pollout_signal(slot); 3922 } else { 3923 slot->cs_io.ci_flags &= ~CCID_IO_F_PREPARING; 3924 slot->cs_io.ci_flags |= CCID_IO_F_IN_PROGRESS; 3925 uiop->uio_resid -= cbytes; 3926 } 3927 /* 3928 * Notify a waiter that we've moved on. 3929 */ 3930 cv_signal(&slot->cs_excl_minor->cm_iowait_cv); 3931 mutex_exit(&ccid->ccid_mutex); 3932 3933 return (ret); 3934 } 3935 3936 static int 3937 ccid_ioctl_status(ccid_slot_t *slot, intptr_t arg, int mode) 3938 { 3939 uccid_cmd_status_t ucs; 3940 ccid_t *ccid = slot->cs_ccid; 3941 3942 if (ddi_copyin((void *)arg, &ucs, sizeof (ucs), mode & FKIOCTL) != 0) 3943 return (EFAULT); 3944 3945 if (ucs.ucs_version != UCCID_VERSION_ONE) 3946 return (EINVAL); 3947 3948 ucs.ucs_status = 0; 3949 ucs.ucs_instance = ddi_get_instance(slot->cs_ccid->ccid_dip); 3950 ucs.ucs_slot = slot->cs_slotno; 3951 3952 mutex_enter(&slot->cs_ccid->ccid_mutex); 3953 if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 3954 mutex_exit(&slot->cs_ccid->ccid_mutex); 3955 return (ENODEV); 3956 } 3957 3958 if ((slot->cs_flags & CCID_SLOT_F_PRESENT) != 0) 3959 ucs.ucs_status |= UCCID_STATUS_F_CARD_PRESENT; 3960 if ((slot->cs_flags & CCID_SLOT_F_ACTIVE) != 0) 3961 ucs.ucs_status |= UCCID_STATUS_F_CARD_ACTIVE; 3962 3963 if (slot->cs_atr != NULL) { 3964 ucs.ucs_atrlen = MIN(UCCID_ATR_MAX, MBLKL(slot->cs_atr)); 3965 bcopy(slot->cs_atr->b_rptr, ucs.ucs_atr, ucs.ucs_atrlen); 3966 } else { 3967 bzero(ucs.ucs_atr, sizeof (ucs.ucs_atr)); 3968 ucs.ucs_atrlen = 0; 3969 } 3970 3971 bcopy(&ccid->ccid_class, &ucs.ucs_class, sizeof (ucs.ucs_class)); 3972 3973 if (ccid->ccid_dev_data->dev_product != NULL) { 3974 (void) strlcpy(ucs.ucs_product, 3975 ccid->ccid_dev_data->dev_product, sizeof (ucs.ucs_product)); 3976 ucs.ucs_status |= UCCID_STATUS_F_PRODUCT_VALID; 3977 } else { 3978 ucs.ucs_product[0] = '\0'; 3979 } 3980 3981 if (ccid->ccid_dev_data->dev_serial != NULL) { 3982 (void) strlcpy(ucs.ucs_serial, ccid->ccid_dev_data->dev_serial, 3983 sizeof (ucs.ucs_serial)); 3984 ucs.ucs_status |= UCCID_STATUS_F_SERIAL_VALID; 3985 } else { 3986 ucs.ucs_serial[0] = '\0'; 3987 } 3988 mutex_exit(&slot->cs_ccid->ccid_mutex); 3989 3990 if ((slot->cs_flags & CCID_SLOT_F_ACTIVE) != 0) { 3991 ucs.ucs_status |= UCCID_STATUS_F_PARAMS_VALID; 3992 ucs.ucs_prot = slot->cs_icc.icc_cur_protocol; 3993 ucs.ucs_params = slot->cs_icc.icc_params; 3994 } 3995 3996 if (ddi_copyout(&ucs, (void *)arg, sizeof (ucs), mode & FKIOCTL) != 0) 3997 return (EFAULT); 3998 3999 return (0); 4000 } 4001 4002 static int 4003 ccid_ioctl_txn_begin(ccid_slot_t *slot, ccid_minor_t *cmp, intptr_t arg, 4004 int mode) 4005 { 4006 int ret; 4007 uccid_cmd_txn_begin_t uct; 4008 boolean_t nowait; 4009 4010 if (ddi_copyin((void *)arg, &uct, sizeof (uct), mode & FKIOCTL) != 0) 4011 return (EFAULT); 4012 4013 if (uct.uct_version != UCCID_VERSION_ONE) 4014 return (EINVAL); 4015 4016 if ((uct.uct_flags & ~UCCID_TXN_DONT_BLOCK) != 0) 4017 return (EINVAL); 4018 nowait = (uct.uct_flags & UCCID_TXN_DONT_BLOCK) != 0; 4019 4020 mutex_enter(&slot->cs_ccid->ccid_mutex); 4021 if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 4022 mutex_exit(&slot->cs_ccid->ccid_mutex); 4023 return (ENODEV); 4024 } 4025 4026 if ((cmp->cm_flags & CCID_MINOR_F_WRITABLE) == 0) { 4027 mutex_exit(&slot->cs_ccid->ccid_mutex); 4028 return (EBADF); 4029 } 4030 4031 ret = ccid_slot_excl_req(slot, cmp, nowait); 4032 mutex_exit(&slot->cs_ccid->ccid_mutex); 4033 4034 return (ret); 4035 } 4036 4037 static int 4038 ccid_ioctl_txn_end(ccid_slot_t *slot, ccid_minor_t *cmp, intptr_t arg, int mode) 4039 { 4040 uccid_cmd_txn_end_t uct; 4041 4042 if (ddi_copyin((void *)arg, &uct, sizeof (uct), mode & FKIOCTL) != 0) { 4043 return (EFAULT); 4044 } 4045 4046 if (uct.uct_version != UCCID_VERSION_ONE) { 4047 return (EINVAL); 4048 } 4049 4050 mutex_enter(&slot->cs_ccid->ccid_mutex); 4051 if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 4052 mutex_exit(&slot->cs_ccid->ccid_mutex); 4053 return (ENODEV); 4054 } 4055 4056 if (slot->cs_excl_minor != cmp) { 4057 mutex_exit(&slot->cs_ccid->ccid_mutex); 4058 return (EINVAL); 4059 } 4060 VERIFY3S(cmp->cm_flags & CCID_MINOR_F_HAS_EXCL, !=, 0); 4061 4062 /* 4063 * Require exactly one of the flags to be set. 4064 */ 4065 switch (uct.uct_flags) { 4066 case UCCID_TXN_END_RESET: 4067 cmp->cm_flags |= CCID_MINOR_F_TXN_RESET; 4068 4069 case UCCID_TXN_END_RELEASE: 4070 break; 4071 4072 default: 4073 mutex_exit(&slot->cs_ccid->ccid_mutex); 4074 return (EINVAL); 4075 } 4076 4077 ccid_slot_excl_rele(slot); 4078 mutex_exit(&slot->cs_ccid->ccid_mutex); 4079 4080 return (0); 4081 } 4082 4083 static int 4084 ccid_ioctl_fionread(ccid_slot_t *slot, ccid_minor_t *cmp, intptr_t arg, 4085 int mode) 4086 { 4087 int data; 4088 4089 mutex_enter(&slot->cs_ccid->ccid_mutex); 4090 if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 4091 mutex_exit(&slot->cs_ccid->ccid_mutex); 4092 return (ENODEV); 4093 } 4094 4095 if ((cmp->cm_flags & CCID_MINOR_F_HAS_EXCL) == 0) { 4096 mutex_exit(&slot->cs_ccid->ccid_mutex); 4097 return (EACCES); 4098 } 4099 4100 if ((cmp->cm_flags & CCID_MINOR_F_WRITABLE) == 0) { 4101 mutex_exit(&slot->cs_ccid->ccid_mutex); 4102 return (EBADF); 4103 } 4104 4105 if ((slot->cs_io.ci_flags & CCID_IO_F_DONE) != 0) { 4106 mutex_exit(&slot->cs_ccid->ccid_mutex); 4107 return (ENODATA); 4108 } 4109 4110 /* 4111 * If there's an error, claim that there's at least one byte to read 4112 * even if it means we'll get the error and consume it. FIONREAD only 4113 * allows up to an int of data. Realistically because we don't allow 4114 * extended APDUs, the amount of data here should be always less than 4115 * INT_MAX. 4116 */ 4117 if (slot->cs_io.ci_errno != 0) { 4118 data = 1; 4119 } else { 4120 size_t s = msgsize(slot->cs_io.ci_data); 4121 data = MIN(s, INT_MAX); 4122 } 4123 4124 if (ddi_copyout(&data, (void *)arg, sizeof (data), mode & FKIOCTL) != 4125 0) { 4126 mutex_exit(&slot->cs_ccid->ccid_mutex); 4127 return (EFAULT); 4128 } 4129 4130 mutex_exit(&slot->cs_ccid->ccid_mutex); 4131 return (0); 4132 } 4133 4134 static int 4135 ccid_ioctl_icc_modify(ccid_slot_t *slot, ccid_minor_t *cmp, intptr_t arg, 4136 int mode) 4137 { 4138 int ret = 0; 4139 uccid_cmd_icc_modify_t uci; 4140 ccid_t *ccid; 4141 4142 if (ddi_copyin((void *)arg, &uci, sizeof (uci), mode & FKIOCTL) != 0) { 4143 return (EFAULT); 4144 } 4145 4146 if (uci.uci_version != UCCID_VERSION_ONE) { 4147 return (EINVAL); 4148 } 4149 4150 switch (uci.uci_action) { 4151 case UCCID_ICC_POWER_ON: 4152 case UCCID_ICC_POWER_OFF: 4153 case UCCID_ICC_WARM_RESET: 4154 break; 4155 default: 4156 return (EINVAL); 4157 } 4158 4159 ccid = slot->cs_ccid; 4160 mutex_enter(&ccid->ccid_mutex); 4161 if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 4162 mutex_exit(&slot->cs_ccid->ccid_mutex); 4163 return (ENODEV); 4164 } 4165 4166 if ((cmp->cm_flags & CCID_MINOR_F_WRITABLE) == 0) { 4167 mutex_exit(&slot->cs_ccid->ccid_mutex); 4168 return (EBADF); 4169 } 4170 4171 switch (uci.uci_action) { 4172 case UCCID_ICC_WARM_RESET: 4173 ret = ccid_slot_warm_reset(ccid, slot); 4174 break; 4175 4176 case UCCID_ICC_POWER_OFF: 4177 ret = ccid_slot_power_off(ccid, slot); 4178 break; 4179 4180 case UCCID_ICC_POWER_ON: 4181 ret = ccid_slot_inserted(ccid, slot); 4182 break; 4183 } 4184 4185 mutex_exit(&ccid->ccid_mutex); 4186 4187 return (ret); 4188 } 4189 4190 static int 4191 ccid_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp, 4192 int *rvalp) 4193 { 4194 ccid_minor_idx_t *idx; 4195 ccid_slot_t *slot; 4196 ccid_minor_t *cmp; 4197 4198 idx = ccid_minor_find_user(getminor(dev)); 4199 if (idx == NULL) { 4200 return (ENOENT); 4201 } 4202 4203 cmp = idx->cmi_data.cmi_user; 4204 slot = cmp->cm_slot; 4205 4206 switch (cmd) { 4207 case UCCID_CMD_TXN_BEGIN: 4208 return (ccid_ioctl_txn_begin(slot, cmp, arg, mode)); 4209 case UCCID_CMD_TXN_END: 4210 return (ccid_ioctl_txn_end(slot, cmp, arg, mode)); 4211 case UCCID_CMD_STATUS: 4212 return (ccid_ioctl_status(slot, arg, mode)); 4213 case FIONREAD: 4214 return (ccid_ioctl_fionread(slot, cmp, arg, mode)); 4215 case UCCID_CMD_ICC_MODIFY: 4216 return (ccid_ioctl_icc_modify(slot, cmp, arg, mode)); 4217 default: 4218 break; 4219 } 4220 4221 return (ENOTTY); 4222 } 4223 4224 static int 4225 ccid_chpoll(dev_t dev, short events, int anyyet, short *reventsp, 4226 struct pollhead **phpp) 4227 { 4228 short ready = 0; 4229 ccid_minor_idx_t *idx; 4230 ccid_minor_t *cmp; 4231 ccid_slot_t *slot; 4232 ccid_t *ccid; 4233 4234 idx = ccid_minor_find_user(getminor(dev)); 4235 if (idx == NULL) { 4236 return (ENOENT); 4237 } 4238 4239 cmp = idx->cmi_data.cmi_user; 4240 slot = cmp->cm_slot; 4241 ccid = slot->cs_ccid; 4242 4243 mutex_enter(&ccid->ccid_mutex); 4244 if ((ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) { 4245 mutex_exit(&ccid->ccid_mutex); 4246 return (ENODEV); 4247 } 4248 4249 if (!(cmp->cm_flags & CCID_MINOR_F_HAS_EXCL) != 0) { 4250 mutex_exit(&ccid->ccid_mutex); 4251 return (EACCES); 4252 } 4253 4254 /* 4255 * If the CCID_IO_F_DONE flag is set, then we're always 4256 * readable. However, flags are insufficient to be writeable. 4257 */ 4258 if ((slot->cs_io.ci_flags & CCID_IO_F_DONE) != 0) { 4259 ready |= POLLIN | POLLRDNORM; 4260 } else if ((slot->cs_flags & CCID_SLOT_F_ACTIVE) != 0 && 4261 (slot->cs_io.ci_flags & CCID_IO_F_POLLOUT_FLAGS) == 0 && 4262 slot->cs_icc.icc_tx != NULL) { 4263 ready |= POLLOUT; 4264 } 4265 4266 if ((slot->cs_flags & CCID_SLOT_F_PRESENT) == 0) { 4267 ready |= POLLHUP; 4268 } 4269 4270 *reventsp = ready & events; 4271 if ((*reventsp == 0 && !anyyet) || (events & POLLET)) { 4272 *phpp = &cmp->cm_pollhead; 4273 } 4274 4275 mutex_exit(&ccid->ccid_mutex); 4276 4277 return (0); 4278 } 4279 4280 static int 4281 ccid_close(dev_t dev, int flag, int otyp, cred_t *credp) 4282 { 4283 ccid_minor_idx_t *idx; 4284 ccid_minor_t *cmp; 4285 ccid_slot_t *slot; 4286 4287 idx = ccid_minor_find_user(getminor(dev)); 4288 if (idx == NULL) { 4289 return (ENOENT); 4290 } 4291 4292 /* 4293 * First tear down the global index entry. 4294 */ 4295 cmp = idx->cmi_data.cmi_user; 4296 slot = cmp->cm_slot; 4297 ccid_minor_idx_free(idx); 4298 4299 /* 4300 * If the minor node was closed without an explicit transaction end, 4301 * then we need to assume that the reader's ICC is in an arbitrary 4302 * state. For example, the ICC could have a specific PIV applet 4303 * selected. In such a case, the only safe thing to do is to force a 4304 * reset. 4305 */ 4306 mutex_enter(&slot->cs_ccid->ccid_mutex); 4307 if ((cmp->cm_flags & CCID_MINOR_F_HAS_EXCL) != 0) { 4308 cmp->cm_flags |= CCID_MINOR_F_TXN_RESET; 4309 ccid_slot_excl_rele(slot); 4310 } 4311 4312 list_remove(&slot->cs_minors, cmp); 4313 mutex_exit(&slot->cs_ccid->ccid_mutex); 4314 4315 pollhead_clean(&cmp->cm_pollhead); 4316 ccid_minor_free(cmp); 4317 4318 return (0); 4319 } 4320 4321 static struct cb_ops ccid_cb_ops = { 4322 ccid_open, /* cb_open */ 4323 ccid_close, /* cb_close */ 4324 nodev, /* cb_strategy */ 4325 nodev, /* cb_print */ 4326 nodev, /* cb_dump */ 4327 ccid_read, /* cb_read */ 4328 ccid_write, /* cb_write */ 4329 ccid_ioctl, /* cb_ioctl */ 4330 nodev, /* cb_devmap */ 4331 nodev, /* cb_mmap */ 4332 nodev, /* cb_segmap */ 4333 ccid_chpoll, /* cb_chpoll */ 4334 ddi_prop_op, /* cb_prop_op */ 4335 NULL, /* cb_stream */ 4336 D_MP, /* cb_flag */ 4337 CB_REV, /* cb_rev */ 4338 nodev, /* cb_aread */ 4339 nodev /* cb_awrite */ 4340 }; 4341 4342 static struct dev_ops ccid_dev_ops = { 4343 DEVO_REV, /* devo_rev */ 4344 0, /* devo_refcnt */ 4345 ccid_getinfo, /* devo_getinfo */ 4346 nulldev, /* devo_identify */ 4347 nulldev, /* devo_probe */ 4348 ccid_attach, /* devo_attach */ 4349 ccid_detach, /* devo_detach */ 4350 nodev, /* devo_reset */ 4351 &ccid_cb_ops, /* devo_cb_ops */ 4352 NULL, /* devo_bus_ops */ 4353 NULL, /* devo_power */ 4354 ddi_quiesce_not_supported /* devo_quiesce */ 4355 }; 4356 4357 static struct modldrv ccid_modldrv = { 4358 &mod_driverops, 4359 "USB CCID", 4360 &ccid_dev_ops 4361 }; 4362 4363 static struct modlinkage ccid_modlinkage = { 4364 MODREV_1, 4365 { &ccid_modldrv, NULL } 4366 }; 4367 4368 int 4369 _init(void) 4370 { 4371 int ret; 4372 4373 if ((ret = ddi_soft_state_init(&ccid_softstate, sizeof (ccid_t), 4374 0)) != 0) { 4375 return (ret); 4376 } 4377 4378 if ((ccid_minors = id_space_create("ccid_minors", CCID_MINOR_MIN, 4379 INT_MAX)) == NULL) { 4380 ddi_soft_state_fini(&ccid_softstate); 4381 return (ret); 4382 } 4383 4384 if ((ret = mod_install(&ccid_modlinkage)) != 0) { 4385 id_space_destroy(ccid_minors); 4386 ccid_minors = NULL; 4387 ddi_soft_state_fini(&ccid_softstate); 4388 return (ret); 4389 } 4390 4391 mutex_init(&ccid_idxlock, NULL, MUTEX_DRIVER, NULL); 4392 avl_create(&ccid_idx, ccid_idx_comparator, sizeof (ccid_minor_idx_t), 4393 offsetof(ccid_minor_idx_t, cmi_avl)); 4394 4395 return (ret); 4396 } 4397 4398 int 4399 _info(struct modinfo *modinfop) 4400 { 4401 return (mod_info(&ccid_modlinkage, modinfop)); 4402 } 4403 4404 int 4405 _fini(void) 4406 { 4407 int ret; 4408 4409 if ((ret = mod_remove(&ccid_modlinkage)) != 0) { 4410 return (ret); 4411 } 4412 4413 avl_destroy(&ccid_idx); 4414 mutex_destroy(&ccid_idxlock); 4415 id_space_destroy(ccid_minors); 4416 ccid_minors = NULL; 4417 ddi_soft_state_fini(&ccid_softstate); 4418 4419 return (ret); 4420 } 4421