xref: /openbmc/linux/drivers/nfc/st21nfca/se.c (revision dd21bfa4)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2014  STMicroelectronics SAS. All rights reserved.
4  */
5 
6 #include <net/nfc/hci.h>
7 
8 #include "st21nfca.h"
9 
10 #define ST21NFCA_EVT_UICC_ACTIVATE		0x10
11 #define ST21NFCA_EVT_UICC_DEACTIVATE		0x13
12 #define ST21NFCA_EVT_SE_HARD_RESET		0x20
13 #define ST21NFCA_EVT_SE_SOFT_RESET		0x11
14 #define ST21NFCA_EVT_SE_END_OF_APDU_TRANSFER	0x21
15 #define ST21NFCA_EVT_SE_ACTIVATE		0x22
16 #define ST21NFCA_EVT_SE_DEACTIVATE		0x23
17 
18 #define ST21NFCA_EVT_TRANSMIT_DATA		0x10
19 #define ST21NFCA_EVT_WTX_REQUEST		0x11
20 
21 #define ST21NFCA_EVT_CONNECTIVITY		0x10
22 #define ST21NFCA_EVT_TRANSACTION		0x12
23 
24 #define ST21NFCA_SE_TO_HOT_PLUG			1000
25 /* Connectivity pipe only */
26 #define ST21NFCA_SE_COUNT_PIPE_UICC		0x01
27 /* Connectivity + APDU Reader pipe */
28 #define ST21NFCA_SE_COUNT_PIPE_EMBEDDED	0x02
29 
30 #define ST21NFCA_SE_MODE_OFF			0x00
31 #define ST21NFCA_SE_MODE_ON				0x01
32 
33 #define ST21NFCA_PARAM_ATR				0x01
34 #define ST21NFCA_ATR_DEFAULT_BWI		0x04
35 
36 /*
37  * WT = 2^BWI/10[s], convert into msecs and add a secure
38  * room by increasing by 2 this timeout
39  */
40 #define ST21NFCA_BWI_TO_TIMEOUT(x)		((1 << x) * 200)
41 #define ST21NFCA_ATR_GET_Y_FROM_TD(x)	(x >> 4)
42 
43 /* If TA is present bit 0 is set */
44 #define ST21NFCA_ATR_TA_PRESENT(x) (x & 0x01)
45 /* If TB is present bit 1 is set */
46 #define ST21NFCA_ATR_TB_PRESENT(x) (x & 0x02)
47 
48 static u8 st21nfca_se_get_bwi(struct nfc_hci_dev *hdev)
49 {
50 	int i;
51 	u8 td;
52 	struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
53 
54 	/* Bits 8 to 5 of the first TB for T=1 encode BWI from zero to nine */
55 	for (i = 1; i < ST21NFCA_ESE_MAX_LENGTH; i++) {
56 		td = ST21NFCA_ATR_GET_Y_FROM_TD(info->se_info.atr[i]);
57 		if (ST21NFCA_ATR_TA_PRESENT(td))
58 			i++;
59 		if (ST21NFCA_ATR_TB_PRESENT(td)) {
60 			i++;
61 			return info->se_info.atr[i] >> 4;
62 		}
63 	}
64 	return ST21NFCA_ATR_DEFAULT_BWI;
65 }
66 
67 static void st21nfca_se_get_atr(struct nfc_hci_dev *hdev)
68 {
69 	int r;
70 	struct sk_buff *skb;
71 	struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
72 
73 	r = nfc_hci_get_param(hdev, ST21NFCA_APDU_READER_GATE,
74 			ST21NFCA_PARAM_ATR, &skb);
75 	if (r < 0)
76 		return;
77 
78 	if (skb->len <= ST21NFCA_ESE_MAX_LENGTH) {
79 		memcpy(info->se_info.atr, skb->data, skb->len);
80 		info->se_info.wt_timeout =
81 			ST21NFCA_BWI_TO_TIMEOUT(st21nfca_se_get_bwi(hdev));
82 	}
83 	kfree_skb(skb);
84 }
85 
86 static int st21nfca_hci_control_se(struct nfc_hci_dev *hdev, u32 se_idx,
87 				u8 state)
88 {
89 	struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
90 	int r, i;
91 	struct sk_buff *sk_host_list;
92 	u8 se_event, host_id;
93 
94 	switch (se_idx) {
95 	case NFC_HCI_UICC_HOST_ID:
96 		se_event = (state == ST21NFCA_SE_MODE_ON ?
97 					ST21NFCA_EVT_UICC_ACTIVATE :
98 					ST21NFCA_EVT_UICC_DEACTIVATE);
99 
100 		info->se_info.count_pipes = 0;
101 		info->se_info.expected_pipes = ST21NFCA_SE_COUNT_PIPE_UICC;
102 		break;
103 	case ST21NFCA_ESE_HOST_ID:
104 		se_event = (state == ST21NFCA_SE_MODE_ON ?
105 					ST21NFCA_EVT_SE_ACTIVATE :
106 					ST21NFCA_EVT_SE_DEACTIVATE);
107 
108 		info->se_info.count_pipes = 0;
109 		info->se_info.expected_pipes = ST21NFCA_SE_COUNT_PIPE_EMBEDDED;
110 		break;
111 	default:
112 		return -EINVAL;
113 	}
114 
115 	/*
116 	 * Wait for an EVT_HOT_PLUG in order to
117 	 * retrieve a relevant host list.
118 	 */
119 	reinit_completion(&info->se_info.req_completion);
120 	r = nfc_hci_send_event(hdev, ST21NFCA_DEVICE_MGNT_GATE, se_event,
121 			       NULL, 0);
122 	if (r < 0)
123 		return r;
124 
125 	mod_timer(&info->se_info.se_active_timer, jiffies +
126 		msecs_to_jiffies(ST21NFCA_SE_TO_HOT_PLUG));
127 	info->se_info.se_active = true;
128 
129 	/* Ignore return value and check in any case the host_list */
130 	wait_for_completion_interruptible(&info->se_info.req_completion);
131 
132 	r = nfc_hci_get_param(hdev, NFC_HCI_ADMIN_GATE,
133 			NFC_HCI_ADMIN_HOST_LIST,
134 			&sk_host_list);
135 	if (r < 0)
136 		return r;
137 
138 	for (i = 0; i < sk_host_list->len &&
139 		sk_host_list->data[i] != se_idx; i++)
140 		;
141 	host_id = sk_host_list->data[i];
142 	kfree_skb(sk_host_list);
143 
144 	if (state == ST21NFCA_SE_MODE_ON && host_id == se_idx)
145 		return se_idx;
146 	else if (state == ST21NFCA_SE_MODE_OFF && host_id != se_idx)
147 		return se_idx;
148 
149 	return -1;
150 }
151 
152 int st21nfca_hci_discover_se(struct nfc_hci_dev *hdev)
153 {
154 	struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
155 	int se_count = 0;
156 
157 	if (test_bit(ST21NFCA_FACTORY_MODE, &hdev->quirks))
158 		return 0;
159 
160 	if (info->se_status->is_uicc_present) {
161 		nfc_add_se(hdev->ndev, NFC_HCI_UICC_HOST_ID, NFC_SE_UICC);
162 		se_count++;
163 	}
164 
165 	if (info->se_status->is_ese_present) {
166 		nfc_add_se(hdev->ndev, ST21NFCA_ESE_HOST_ID, NFC_SE_EMBEDDED);
167 		se_count++;
168 	}
169 
170 	return !se_count;
171 }
172 EXPORT_SYMBOL(st21nfca_hci_discover_se);
173 
174 int st21nfca_hci_enable_se(struct nfc_hci_dev *hdev, u32 se_idx)
175 {
176 	int r;
177 
178 	/*
179 	 * According to upper layer, se_idx == NFC_SE_UICC when
180 	 * info->se_status->is_uicc_enable is true should never happen.
181 	 * Same for eSE.
182 	 */
183 	r = st21nfca_hci_control_se(hdev, se_idx, ST21NFCA_SE_MODE_ON);
184 	if (r == ST21NFCA_ESE_HOST_ID) {
185 		st21nfca_se_get_atr(hdev);
186 		r = nfc_hci_send_event(hdev, ST21NFCA_APDU_READER_GATE,
187 				ST21NFCA_EVT_SE_SOFT_RESET, NULL, 0);
188 		if (r < 0)
189 			return r;
190 	} else if (r < 0) {
191 		/*
192 		 * The activation tentative failed, the secure element
193 		 * is not connected. Remove from the list.
194 		 */
195 		nfc_remove_se(hdev->ndev, se_idx);
196 		return r;
197 	}
198 
199 	return 0;
200 }
201 EXPORT_SYMBOL(st21nfca_hci_enable_se);
202 
203 int st21nfca_hci_disable_se(struct nfc_hci_dev *hdev, u32 se_idx)
204 {
205 	int r;
206 
207 	/*
208 	 * According to upper layer, se_idx == NFC_SE_UICC when
209 	 * info->se_status->is_uicc_enable is true should never happen
210 	 * Same for eSE.
211 	 */
212 	r = st21nfca_hci_control_se(hdev, se_idx, ST21NFCA_SE_MODE_OFF);
213 	if (r < 0)
214 		return r;
215 
216 	return 0;
217 }
218 EXPORT_SYMBOL(st21nfca_hci_disable_se);
219 
220 int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx,
221 			u8 *apdu, size_t apdu_length,
222 			se_io_cb_t cb, void *cb_context)
223 {
224 	struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
225 
226 	pr_debug("se_io %x\n", se_idx);
227 
228 	switch (se_idx) {
229 	case ST21NFCA_ESE_HOST_ID:
230 		info->se_info.cb = cb;
231 		info->se_info.cb_context = cb_context;
232 		mod_timer(&info->se_info.bwi_timer, jiffies +
233 			  msecs_to_jiffies(info->se_info.wt_timeout));
234 		info->se_info.bwi_active = true;
235 		return nfc_hci_send_event(hdev, ST21NFCA_APDU_READER_GATE,
236 					ST21NFCA_EVT_TRANSMIT_DATA,
237 					apdu, apdu_length);
238 	default:
239 		return -ENODEV;
240 	}
241 }
242 EXPORT_SYMBOL(st21nfca_hci_se_io);
243 
244 static void st21nfca_se_wt_timeout(struct timer_list *t)
245 {
246 	/*
247 	 * No answer from the secure element
248 	 * within the defined timeout.
249 	 * Let's send a reset request as recovery procedure.
250 	 * According to the situation, we first try to send a software reset
251 	 * to the secure element. If the next command is still not
252 	 * answering in time, we send to the CLF a secure element hardware
253 	 * reset request.
254 	 */
255 	/* hardware reset managed through VCC_UICC_OUT power supply */
256 	u8 param = 0x01;
257 	struct st21nfca_hci_info *info = from_timer(info, t,
258 						    se_info.bwi_timer);
259 
260 	info->se_info.bwi_active = false;
261 
262 	if (!info->se_info.xch_error) {
263 		info->se_info.xch_error = true;
264 		nfc_hci_send_event(info->hdev, ST21NFCA_APDU_READER_GATE,
265 				ST21NFCA_EVT_SE_SOFT_RESET, NULL, 0);
266 	} else {
267 		info->se_info.xch_error = false;
268 		nfc_hci_send_event(info->hdev, ST21NFCA_DEVICE_MGNT_GATE,
269 				ST21NFCA_EVT_SE_HARD_RESET, &param, 1);
270 	}
271 	info->se_info.cb(info->se_info.cb_context, NULL, 0, -ETIME);
272 }
273 
274 static void st21nfca_se_activation_timeout(struct timer_list *t)
275 {
276 	struct st21nfca_hci_info *info = from_timer(info, t,
277 						    se_info.se_active_timer);
278 
279 	info->se_info.se_active = false;
280 
281 	complete(&info->se_info.req_completion);
282 }
283 
284 /*
285  * Returns:
286  * <= 0: driver handled the event, skb consumed
287  *    1: driver does not handle the event, please do standard processing
288  */
289 int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
290 				u8 event, struct sk_buff *skb)
291 {
292 	int r = 0;
293 	struct device *dev = &hdev->ndev->dev;
294 	struct nfc_evt_transaction *transaction;
295 
296 	pr_debug("connectivity gate event: %x\n", event);
297 
298 	switch (event) {
299 	case ST21NFCA_EVT_CONNECTIVITY:
300 		r = nfc_se_connectivity(hdev->ndev, host);
301 	break;
302 	case ST21NFCA_EVT_TRANSACTION:
303 		/*
304 		 * According to specification etsi 102 622
305 		 * 11.2.2.4 EVT_TRANSACTION Table 52
306 		 * Description	Tag	Length
307 		 * AID		81	5 to 16
308 		 * PARAMETERS	82	0 to 255
309 		 */
310 		if (skb->len < NFC_MIN_AID_LENGTH + 2 &&
311 		    skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)
312 			return -EPROTO;
313 
314 		transaction = devm_kzalloc(dev, skb->len - 2, GFP_KERNEL);
315 		if (!transaction)
316 			return -ENOMEM;
317 
318 		transaction->aid_len = skb->data[1];
319 
320 		/* Checking if the length of the AID is valid */
321 		if (transaction->aid_len > sizeof(transaction->aid))
322 			return -EINVAL;
323 
324 		memcpy(transaction->aid, &skb->data[2],
325 		       transaction->aid_len);
326 
327 		/* Check next byte is PARAMETERS tag (82) */
328 		if (skb->data[transaction->aid_len + 2] !=
329 		    NFC_EVT_TRANSACTION_PARAMS_TAG)
330 			return -EPROTO;
331 
332 		transaction->params_len = skb->data[transaction->aid_len + 3];
333 
334 		/* Total size is allocated (skb->len - 2) minus fixed array members */
335 		if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction)))
336 			return -EINVAL;
337 
338 		memcpy(transaction->params, skb->data +
339 		       transaction->aid_len + 4, transaction->params_len);
340 
341 		r = nfc_se_transaction(hdev->ndev, host, transaction);
342 	break;
343 	default:
344 		nfc_err(&hdev->ndev->dev, "Unexpected event on connectivity gate\n");
345 		return 1;
346 	}
347 	kfree_skb(skb);
348 	return r;
349 }
350 EXPORT_SYMBOL(st21nfca_connectivity_event_received);
351 
352 int st21nfca_apdu_reader_event_received(struct nfc_hci_dev *hdev,
353 					u8 event, struct sk_buff *skb)
354 {
355 	int r = 0;
356 	struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
357 
358 	pr_debug("apdu reader gate event: %x\n", event);
359 
360 	switch (event) {
361 	case ST21NFCA_EVT_TRANSMIT_DATA:
362 		del_timer_sync(&info->se_info.bwi_timer);
363 		info->se_info.bwi_active = false;
364 		r = nfc_hci_send_event(hdev, ST21NFCA_DEVICE_MGNT_GATE,
365 				ST21NFCA_EVT_SE_END_OF_APDU_TRANSFER, NULL, 0);
366 		if (r < 0)
367 			goto exit;
368 
369 		info->se_info.cb(info->se_info.cb_context,
370 			skb->data, skb->len, 0);
371 		break;
372 	case ST21NFCA_EVT_WTX_REQUEST:
373 		mod_timer(&info->se_info.bwi_timer, jiffies +
374 				msecs_to_jiffies(info->se_info.wt_timeout));
375 		break;
376 	default:
377 		nfc_err(&hdev->ndev->dev, "Unexpected event on apdu reader gate\n");
378 		return 1;
379 	}
380 
381 exit:
382 	kfree_skb(skb);
383 	return r;
384 }
385 EXPORT_SYMBOL(st21nfca_apdu_reader_event_received);
386 
387 void st21nfca_se_init(struct nfc_hci_dev *hdev)
388 {
389 	struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
390 
391 	init_completion(&info->se_info.req_completion);
392 	/* initialize timers */
393 	timer_setup(&info->se_info.bwi_timer, st21nfca_se_wt_timeout, 0);
394 	info->se_info.bwi_active = false;
395 
396 	timer_setup(&info->se_info.se_active_timer,
397 		    st21nfca_se_activation_timeout, 0);
398 	info->se_info.se_active = false;
399 
400 	info->se_info.count_pipes = 0;
401 	info->se_info.expected_pipes = 0;
402 
403 	info->se_info.xch_error = false;
404 
405 	info->se_info.wt_timeout =
406 			ST21NFCA_BWI_TO_TIMEOUT(ST21NFCA_ATR_DEFAULT_BWI);
407 }
408 EXPORT_SYMBOL(st21nfca_se_init);
409 
410 void st21nfca_se_deinit(struct nfc_hci_dev *hdev)
411 {
412 	struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
413 
414 	if (info->se_info.bwi_active)
415 		del_timer_sync(&info->se_info.bwi_timer);
416 	if (info->se_info.se_active)
417 		del_timer_sync(&info->se_info.se_active_timer);
418 
419 	info->se_info.bwi_active = false;
420 	info->se_info.se_active = false;
421 }
422 EXPORT_SYMBOL(st21nfca_se_deinit);
423