1 // SPDX-License-Identifier: GPL-2.0-only
3 * The NFC Controller Interface is the communication protocol between an
4 * NFC Controller (NFCC) and a Device Host (DH).
5 * This is the HCI over NCI implementation, as specified in the 10.2
6 * section of the NCI 1.1 specification.
8 * Copyright (C) 2014 STMicroelectronics SAS. All rights reserved.
11 #include <linux/skbuff.h>
14 #include <net/nfc/nci.h>
15 #include <net/nfc/nci_core.h>
16 #include <linux/nfc.h>
17 #include <linux/kcov.h>
27 struct nci_hci_create_pipe_params {
33 struct nci_hci_create_pipe_resp {
41 struct nci_hci_delete_pipe_noti {
45 struct nci_hci_all_pipe_cleared_noti {
49 struct nci_hcp_message {
50 u8 header; /* type -cmd,evt,rsp- + instruction */
54 struct nci_hcp_packet {
55 u8 header; /* cbit+pipe */
56 struct nci_hcp_message message;
59 #define NCI_HCI_ANY_SET_PARAMETER 0x01
60 #define NCI_HCI_ANY_GET_PARAMETER 0x02
61 #define NCI_HCI_ANY_CLOSE_PIPE 0x04
62 #define NCI_HCI_ADM_CLEAR_ALL_PIPE 0x14
64 #define NCI_HFP_NO_CHAINING 0x80
66 #define NCI_NFCEE_ID_HCI 0x80
68 #define NCI_EVT_HOT_PLUG 0x03
70 #define NCI_HCI_ADMIN_PARAM_SESSION_IDENTITY 0x01
71 #define NCI_HCI_ADM_CREATE_PIPE 0x10
72 #define NCI_HCI_ADM_DELETE_PIPE 0x11
75 #define NCI_HCI_HCP_PACKET_HEADER_LEN 1
76 #define NCI_HCI_HCP_MESSAGE_HEADER_LEN 1
77 #define NCI_HCI_HCP_HEADER_LEN 2
80 #define NCI_HCI_HCP_COMMAND 0x00
81 #define NCI_HCI_HCP_EVENT 0x01
82 #define NCI_HCI_HCP_RESPONSE 0x02
84 #define NCI_HCI_ADM_NOTIFY_PIPE_CREATED 0x12
85 #define NCI_HCI_ADM_NOTIFY_PIPE_DELETED 0x13
86 #define NCI_HCI_ADM_NOTIFY_ALL_PIPE_CLEARED 0x15
88 #define NCI_HCI_FRAGMENT 0x7f
89 #define NCI_HCP_HEADER(type, instr) ((((type) & 0x03) << 6) |\
92 #define NCI_HCP_MSG_GET_TYPE(header) ((header & 0xc0) >> 6)
93 #define NCI_HCP_MSG_GET_CMD(header) (header & 0x3f)
94 #define NCI_HCP_MSG_GET_PIPE(header) (header & 0x7f)
96 static int nci_hci_result_to_errno(u8 result)
101 case NCI_HCI_ANY_E_REG_PAR_UNKNOWN:
103 case NCI_HCI_ANY_E_TIMEOUT:
111 static void nci_hci_reset_pipes(struct nci_hci_dev *hdev)
115 for (i = 0; i < NCI_HCI_MAX_PIPES; i++) {
116 hdev->pipes[i].gate = NCI_HCI_INVALID_GATE;
117 hdev->pipes[i].host = NCI_HCI_INVALID_HOST;
119 memset(hdev->gate2pipe, NCI_HCI_INVALID_PIPE, sizeof(hdev->gate2pipe));
122 static void nci_hci_reset_pipes_per_host(struct nci_dev *ndev, u8 host)
126 for (i = 0; i < NCI_HCI_MAX_PIPES; i++) {
127 if (ndev->hci_dev->pipes[i].host == host) {
128 ndev->hci_dev->pipes[i].gate = NCI_HCI_INVALID_GATE;
129 ndev->hci_dev->pipes[i].host = NCI_HCI_INVALID_HOST;
134 /* Fragment HCI data over NCI packet.
135 * NFC Forum NCI 10.2.2 Data Exchange:
136 * The payload of the Data Packets sent on the Logical Connection SHALL be
137 * valid HCP packets, as defined within [ETSI_102622]. Each Data Packet SHALL
138 * contain a single HCP packet. NCI Segmentation and Reassembly SHALL NOT be
139 * applied to Data Messages in either direction. The HCI fragmentation mechanism
140 * is used if required.
142 static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe,
143 const u8 data_type, const u8 *data,
146 const struct nci_conn_info *conn_info;
151 conn_info = ndev->hci_dev->conn_info;
156 skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len +
157 NCI_DATA_HDR_SIZE, GFP_ATOMIC);
161 skb_reserve(skb, NCI_DATA_HDR_SIZE + 2);
162 *(u8 *)skb_push(skb, 1) = data_type;
165 /* If last packet add NCI_HFP_NO_CHAINING */
166 if (i + conn_info->max_pkt_payload_len -
167 (skb->len + 1) >= data_len) {
168 cb |= NCI_HFP_NO_CHAINING;
171 len = conn_info->max_pkt_payload_len - skb->len - 1;
174 *(u8 *)skb_push(skb, 1) = cb;
177 skb_put_data(skb, data + i, len);
179 r = nci_send_data(ndev, conn_info->conn_id, skb);
186 skb = nci_skb_alloc(ndev,
187 conn_info->max_pkt_payload_len +
188 NCI_DATA_HDR_SIZE, GFP_ATOMIC);
192 skb_reserve(skb, NCI_DATA_HDR_SIZE + 1);
194 } while (i < data_len);
199 static void nci_hci_send_data_req(struct nci_dev *ndev, const void *opt)
201 const struct nci_data *data = opt;
203 nci_hci_send_data(ndev, data->pipe, data->cmd,
204 data->data, data->data_len);
207 int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event,
208 const u8 *param, size_t param_len)
210 u8 pipe = ndev->hci_dev->gate2pipe[gate];
212 if (pipe == NCI_HCI_INVALID_PIPE)
213 return -EADDRNOTAVAIL;
215 return nci_hci_send_data(ndev, pipe,
216 NCI_HCP_HEADER(NCI_HCI_HCP_EVENT, event),
219 EXPORT_SYMBOL(nci_hci_send_event);
221 int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate, u8 cmd,
222 const u8 *param, size_t param_len,
223 struct sk_buff **skb)
225 const struct nci_hcp_message *message;
226 const struct nci_conn_info *conn_info;
227 struct nci_data data;
229 u8 pipe = ndev->hci_dev->gate2pipe[gate];
231 if (pipe == NCI_HCI_INVALID_PIPE)
232 return -EADDRNOTAVAIL;
234 conn_info = ndev->hci_dev->conn_info;
238 data.conn_id = conn_info->conn_id;
240 data.cmd = NCI_HCP_HEADER(NCI_HCI_HCP_COMMAND, cmd);
242 data.data_len = param_len;
244 r = nci_request(ndev, nci_hci_send_data_req, &data,
245 msecs_to_jiffies(NCI_DATA_TIMEOUT));
246 if (r == NCI_STATUS_OK) {
247 message = (struct nci_hcp_message *)conn_info->rx_skb->data;
248 r = nci_hci_result_to_errno(
249 NCI_HCP_MSG_GET_CMD(message->header));
250 skb_pull(conn_info->rx_skb, NCI_HCI_HCP_MESSAGE_HEADER_LEN);
253 *skb = conn_info->rx_skb;
258 EXPORT_SYMBOL(nci_hci_send_cmd);
260 int nci_hci_clear_all_pipes(struct nci_dev *ndev)
264 r = nci_hci_send_cmd(ndev, NCI_HCI_ADMIN_GATE,
265 NCI_HCI_ADM_CLEAR_ALL_PIPE, NULL, 0, NULL);
269 nci_hci_reset_pipes(ndev->hci_dev);
272 EXPORT_SYMBOL(nci_hci_clear_all_pipes);
274 static void nci_hci_event_received(struct nci_dev *ndev, u8 pipe,
275 u8 event, struct sk_buff *skb)
277 if (ndev->ops->hci_event_received)
278 ndev->ops->hci_event_received(ndev, pipe, event, skb);
281 static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
282 u8 cmd, struct sk_buff *skb)
284 u8 gate = ndev->hci_dev->pipes[pipe].gate;
285 u8 status = NCI_HCI_ANY_OK | ~NCI_HCI_FRAGMENT;
286 u8 dest_gate, new_pipe;
287 struct nci_hci_create_pipe_resp *create_info;
288 struct nci_hci_delete_pipe_noti *delete_info;
289 struct nci_hci_all_pipe_cleared_noti *cleared_info;
291 pr_debug("from gate %x pipe %x cmd %x\n", gate, pipe, cmd);
294 case NCI_HCI_ADM_NOTIFY_PIPE_CREATED:
296 status = NCI_HCI_ANY_E_NOK;
299 create_info = (struct nci_hci_create_pipe_resp *)skb->data;
300 dest_gate = create_info->dest_gate;
301 new_pipe = create_info->pipe;
302 if (new_pipe >= NCI_HCI_MAX_PIPES) {
303 status = NCI_HCI_ANY_E_NOK;
307 /* Save the new created pipe and bind with local gate,
308 * the description for skb->data[3] is destination gate id
309 * but since we received this cmd from host controller, we
310 * are the destination and it is our local gate
312 ndev->hci_dev->gate2pipe[dest_gate] = new_pipe;
313 ndev->hci_dev->pipes[new_pipe].gate = dest_gate;
314 ndev->hci_dev->pipes[new_pipe].host =
315 create_info->src_host;
317 case NCI_HCI_ANY_OPEN_PIPE:
318 /* If the pipe is not created report an error */
319 if (gate == NCI_HCI_INVALID_GATE) {
320 status = NCI_HCI_ANY_E_NOK;
324 case NCI_HCI_ADM_NOTIFY_PIPE_DELETED:
326 status = NCI_HCI_ANY_E_NOK;
329 delete_info = (struct nci_hci_delete_pipe_noti *)skb->data;
330 if (delete_info->pipe >= NCI_HCI_MAX_PIPES) {
331 status = NCI_HCI_ANY_E_NOK;
335 ndev->hci_dev->pipes[delete_info->pipe].gate =
336 NCI_HCI_INVALID_GATE;
337 ndev->hci_dev->pipes[delete_info->pipe].host =
338 NCI_HCI_INVALID_HOST;
340 case NCI_HCI_ADM_NOTIFY_ALL_PIPE_CLEARED:
342 status = NCI_HCI_ANY_E_NOK;
347 (struct nci_hci_all_pipe_cleared_noti *)skb->data;
348 nci_hci_reset_pipes_per_host(ndev, cleared_info->host);
351 pr_debug("Discarded unknown cmd %x to gate %x\n", cmd, gate);
355 if (ndev->ops->hci_cmd_received)
356 ndev->ops->hci_cmd_received(ndev, pipe, cmd, skb);
359 nci_hci_send_data(ndev, pipe, status, NULL, 0);
364 static void nci_hci_resp_received(struct nci_dev *ndev, u8 pipe,
367 struct nci_conn_info *conn_info;
369 conn_info = ndev->hci_dev->conn_info;
373 conn_info->rx_skb = skb;
376 nci_req_complete(ndev, NCI_STATUS_OK);
379 /* Receive hcp message for pipe, with type and cmd.
380 * skb contains optional message data only.
382 static void nci_hci_hcp_message_rx(struct nci_dev *ndev, u8 pipe,
383 u8 type, u8 instruction, struct sk_buff *skb)
386 case NCI_HCI_HCP_RESPONSE:
387 nci_hci_resp_received(ndev, pipe, skb);
389 case NCI_HCI_HCP_COMMAND:
390 nci_hci_cmd_received(ndev, pipe, instruction, skb);
392 case NCI_HCI_HCP_EVENT:
393 nci_hci_event_received(ndev, pipe, instruction, skb);
396 pr_err("UNKNOWN MSG Type %d, instruction=%d\n",
402 nci_req_complete(ndev, NCI_STATUS_OK);
405 static void nci_hci_msg_rx_work(struct work_struct *work)
407 struct nci_hci_dev *hdev =
408 container_of(work, struct nci_hci_dev, msg_rx_work);
410 const struct nci_hcp_message *message;
411 u8 pipe, type, instruction;
413 for (; (skb = skb_dequeue(&hdev->msg_rx_queue)); kcov_remote_stop()) {
414 kcov_remote_start_common(skb_get_kcov_handle(skb));
415 pipe = NCI_HCP_MSG_GET_PIPE(skb->data[0]);
416 skb_pull(skb, NCI_HCI_HCP_PACKET_HEADER_LEN);
417 message = (struct nci_hcp_message *)skb->data;
418 type = NCI_HCP_MSG_GET_TYPE(message->header);
419 instruction = NCI_HCP_MSG_GET_CMD(message->header);
420 skb_pull(skb, NCI_HCI_HCP_MESSAGE_HEADER_LEN);
422 nci_hci_hcp_message_rx(hdev->ndev, pipe,
423 type, instruction, skb);
427 void nci_hci_data_received_cb(void *context,
428 struct sk_buff *skb, int err)
430 struct nci_dev *ndev = (struct nci_dev *)context;
431 struct nci_hcp_packet *packet;
433 struct sk_buff *hcp_skb;
434 struct sk_buff *frag_skb;
438 nci_req_complete(ndev, err);
442 packet = (struct nci_hcp_packet *)skb->data;
443 if ((packet->header & ~NCI_HCI_FRAGMENT) == 0) {
444 skb_queue_tail(&ndev->hci_dev->rx_hcp_frags, skb);
448 /* it's the last fragment. Does it need re-aggregation? */
449 if (skb_queue_len(&ndev->hci_dev->rx_hcp_frags)) {
450 pipe = NCI_HCP_MSG_GET_PIPE(packet->header);
451 skb_queue_tail(&ndev->hci_dev->rx_hcp_frags, skb);
454 skb_queue_walk(&ndev->hci_dev->rx_hcp_frags, frag_skb) {
455 msg_len += (frag_skb->len -
456 NCI_HCI_HCP_PACKET_HEADER_LEN);
459 hcp_skb = nfc_alloc_recv_skb(NCI_HCI_HCP_PACKET_HEADER_LEN +
460 msg_len, GFP_KERNEL);
462 nci_req_complete(ndev, -ENOMEM);
466 skb_put_u8(hcp_skb, pipe);
468 skb_queue_walk(&ndev->hci_dev->rx_hcp_frags, frag_skb) {
469 msg_len = frag_skb->len - NCI_HCI_HCP_PACKET_HEADER_LEN;
470 skb_put_data(hcp_skb,
471 frag_skb->data + NCI_HCI_HCP_PACKET_HEADER_LEN,
475 skb_queue_purge(&ndev->hci_dev->rx_hcp_frags);
477 packet->header &= NCI_HCI_FRAGMENT;
481 /* if this is a response, dispatch immediately to
482 * unblock waiting cmd context. Otherwise, enqueue to dispatch
483 * in separate context where handler can also execute command.
485 packet = (struct nci_hcp_packet *)hcp_skb->data;
486 type = NCI_HCP_MSG_GET_TYPE(packet->message.header);
487 if (type == NCI_HCI_HCP_RESPONSE) {
488 pipe = NCI_HCP_MSG_GET_PIPE(packet->header);
489 skb_pull(hcp_skb, NCI_HCI_HCP_PACKET_HEADER_LEN);
490 nci_hci_hcp_message_rx(ndev, pipe, type,
491 NCI_STATUS_OK, hcp_skb);
493 skb_queue_tail(&ndev->hci_dev->msg_rx_queue, hcp_skb);
494 schedule_work(&ndev->hci_dev->msg_rx_work);
498 int nci_hci_open_pipe(struct nci_dev *ndev, u8 pipe)
500 struct nci_data data;
501 const struct nci_conn_info *conn_info;
503 conn_info = ndev->hci_dev->conn_info;
507 data.conn_id = conn_info->conn_id;
509 data.cmd = NCI_HCP_HEADER(NCI_HCI_HCP_COMMAND,
510 NCI_HCI_ANY_OPEN_PIPE);
514 return nci_request(ndev, nci_hci_send_data_req, &data,
515 msecs_to_jiffies(NCI_DATA_TIMEOUT));
517 EXPORT_SYMBOL(nci_hci_open_pipe);
519 static u8 nci_hci_create_pipe(struct nci_dev *ndev, u8 dest_host,
520 u8 dest_gate, int *result)
524 struct nci_hci_create_pipe_params params;
525 const struct nci_hci_create_pipe_resp *resp;
527 pr_debug("gate=%d\n", dest_gate);
529 params.src_gate = NCI_HCI_ADMIN_GATE;
530 params.dest_host = dest_host;
531 params.dest_gate = dest_gate;
533 *result = nci_hci_send_cmd(ndev, NCI_HCI_ADMIN_GATE,
534 NCI_HCI_ADM_CREATE_PIPE,
535 (u8 *)¶ms, sizeof(params), &skb);
537 return NCI_HCI_INVALID_PIPE;
539 resp = (struct nci_hci_create_pipe_resp *)skb->data;
543 pr_debug("pipe created=%d\n", pipe);
548 static int nci_hci_delete_pipe(struct nci_dev *ndev, u8 pipe)
550 return nci_hci_send_cmd(ndev, NCI_HCI_ADMIN_GATE,
551 NCI_HCI_ADM_DELETE_PIPE, &pipe, 1, NULL);
554 int nci_hci_set_param(struct nci_dev *ndev, u8 gate, u8 idx,
555 const u8 *param, size_t param_len)
557 const struct nci_hcp_message *message;
558 const struct nci_conn_info *conn_info;
559 struct nci_data data;
562 u8 pipe = ndev->hci_dev->gate2pipe[gate];
564 pr_debug("idx=%d to gate %d\n", idx, gate);
566 if (pipe == NCI_HCI_INVALID_PIPE)
567 return -EADDRNOTAVAIL;
569 conn_info = ndev->hci_dev->conn_info;
573 tmp = kmalloc(1 + param_len, GFP_KERNEL);
578 memcpy(tmp + 1, param, param_len);
580 data.conn_id = conn_info->conn_id;
582 data.cmd = NCI_HCP_HEADER(NCI_HCI_HCP_COMMAND,
583 NCI_HCI_ANY_SET_PARAMETER);
585 data.data_len = param_len + 1;
587 r = nci_request(ndev, nci_hci_send_data_req, &data,
588 msecs_to_jiffies(NCI_DATA_TIMEOUT));
589 if (r == NCI_STATUS_OK) {
590 message = (struct nci_hcp_message *)conn_info->rx_skb->data;
591 r = nci_hci_result_to_errno(
592 NCI_HCP_MSG_GET_CMD(message->header));
593 skb_pull(conn_info->rx_skb, NCI_HCI_HCP_MESSAGE_HEADER_LEN);
599 EXPORT_SYMBOL(nci_hci_set_param);
601 int nci_hci_get_param(struct nci_dev *ndev, u8 gate, u8 idx,
602 struct sk_buff **skb)
604 const struct nci_hcp_message *message;
605 const struct nci_conn_info *conn_info;
606 struct nci_data data;
608 u8 pipe = ndev->hci_dev->gate2pipe[gate];
610 pr_debug("idx=%d to gate %d\n", idx, gate);
612 if (pipe == NCI_HCI_INVALID_PIPE)
613 return -EADDRNOTAVAIL;
615 conn_info = ndev->hci_dev->conn_info;
619 data.conn_id = conn_info->conn_id;
621 data.cmd = NCI_HCP_HEADER(NCI_HCI_HCP_COMMAND,
622 NCI_HCI_ANY_GET_PARAMETER);
626 r = nci_request(ndev, nci_hci_send_data_req, &data,
627 msecs_to_jiffies(NCI_DATA_TIMEOUT));
629 if (r == NCI_STATUS_OK) {
630 message = (struct nci_hcp_message *)conn_info->rx_skb->data;
631 r = nci_hci_result_to_errno(
632 NCI_HCP_MSG_GET_CMD(message->header));
633 skb_pull(conn_info->rx_skb, NCI_HCI_HCP_MESSAGE_HEADER_LEN);
636 *skb = conn_info->rx_skb;
641 EXPORT_SYMBOL(nci_hci_get_param);
643 int nci_hci_connect_gate(struct nci_dev *ndev,
644 u8 dest_host, u8 dest_gate, u8 pipe)
646 bool pipe_created = false;
649 if (pipe == NCI_HCI_DO_NOT_OPEN_PIPE)
652 if (ndev->hci_dev->gate2pipe[dest_gate] != NCI_HCI_INVALID_PIPE)
655 if (pipe != NCI_HCI_INVALID_PIPE)
659 case NCI_HCI_LINK_MGMT_GATE:
660 pipe = NCI_HCI_LINK_MGMT_PIPE;
662 case NCI_HCI_ADMIN_GATE:
663 pipe = NCI_HCI_ADMIN_PIPE;
666 pipe = nci_hci_create_pipe(ndev, dest_host, dest_gate, &r);
667 if (pipe == NCI_HCI_INVALID_PIPE)
674 r = nci_hci_open_pipe(ndev, pipe);
677 if (nci_hci_delete_pipe(ndev, pipe) < 0) {
678 /* TODO: Cannot clean by deleting pipe...
679 * -> inconsistent state
686 ndev->hci_dev->pipes[pipe].gate = dest_gate;
687 ndev->hci_dev->pipes[pipe].host = dest_host;
688 ndev->hci_dev->gate2pipe[dest_gate] = pipe;
692 EXPORT_SYMBOL(nci_hci_connect_gate);
694 static int nci_hci_dev_connect_gates(struct nci_dev *ndev,
696 const struct nci_hci_gate *gates)
700 while (gate_count--) {
701 r = nci_hci_connect_gate(ndev, gates->dest_host,
702 gates->gate, gates->pipe);
711 int nci_hci_dev_session_init(struct nci_dev *ndev)
713 struct nci_conn_info *conn_info;
717 ndev->hci_dev->count_pipes = 0;
718 ndev->hci_dev->expected_pipes = 0;
720 conn_info = ndev->hci_dev->conn_info;
724 conn_info->data_exchange_cb = nci_hci_data_received_cb;
725 conn_info->data_exchange_cb_context = ndev;
727 nci_hci_reset_pipes(ndev->hci_dev);
729 if (ndev->hci_dev->init_data.gates[0].gate != NCI_HCI_ADMIN_GATE)
732 r = nci_hci_connect_gate(ndev,
733 ndev->hci_dev->init_data.gates[0].dest_host,
734 ndev->hci_dev->init_data.gates[0].gate,
735 ndev->hci_dev->init_data.gates[0].pipe);
739 r = nci_hci_get_param(ndev, NCI_HCI_ADMIN_GATE,
740 NCI_HCI_ADMIN_PARAM_SESSION_IDENTITY, &skb);
745 skb->len == strlen(ndev->hci_dev->init_data.session_id) &&
746 !memcmp(ndev->hci_dev->init_data.session_id, skb->data, skb->len) &&
747 ndev->ops->hci_load_session) {
748 /* Restore gate<->pipe table from some proprietary location. */
749 r = ndev->ops->hci_load_session(ndev);
751 r = nci_hci_clear_all_pipes(ndev);
755 r = nci_hci_dev_connect_gates(ndev,
756 ndev->hci_dev->init_data.gate_count,
757 ndev->hci_dev->init_data.gates);
761 r = nci_hci_set_param(ndev, NCI_HCI_ADMIN_GATE,
762 NCI_HCI_ADMIN_PARAM_SESSION_IDENTITY,
763 ndev->hci_dev->init_data.session_id,
764 strlen(ndev->hci_dev->init_data.session_id));
772 EXPORT_SYMBOL(nci_hci_dev_session_init);
774 struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev)
776 struct nci_hci_dev *hdev;
778 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
782 skb_queue_head_init(&hdev->rx_hcp_frags);
783 INIT_WORK(&hdev->msg_rx_work, nci_hci_msg_rx_work);
784 skb_queue_head_init(&hdev->msg_rx_queue);
790 void nci_hci_deallocate(struct nci_dev *ndev)
792 kfree(ndev->hci_dev);