net/nfc/digital_technology.c

   1 /*
   2  * NFC Digital Protocol stack
   3  * Copyright (c) 2013, Intel Corporation.
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms and conditions of the GNU General Public License,
   7  * version 2, as published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  12  * more details.
  13  *
  14  */
  15
  16 #define pr_fmt(fmt) "digital: %s: " fmt, __func__
  17
  18 #include "digital.h"
  19
  20 #define DIGITAL_CMD_SENS_REQ    0x26
  21 #define DIGITAL_CMD_ALL_REQ     0x52
  22 #define DIGITAL_CMD_SEL_REQ_CL1 0x93
  23 #define DIGITAL_CMD_SEL_REQ_CL2 0x95
  24 #define DIGITAL_CMD_SEL_REQ_CL3 0x97
  25
  26 #define DIGITAL_SDD_REQ_SEL_PAR 0x20
  27
  28 #define DIGITAL_SDD_RES_CT  0x88
  29 #define DIGITAL_SDD_RES_LEN 5
  30
  31 #define DIGITAL_SEL_RES_NFCID1_COMPLETE(sel_res) (!((sel_res) & 0x04))
  32 #define DIGITAL_SEL_RES_IS_T2T(sel_res) (!((sel_res) & 0x60))
  33 #define DIGITAL_SEL_RES_IS_T4T(sel_res) ((sel_res) & 0x20)
  34 #define DIGITAL_SEL_RES_IS_NFC_DEP(sel_res) ((sel_res) & 0x40)
  35
  36 #define DIGITAL_SENS_RES_IS_T1T(sens_res) (((sens_res) & 0x0C00) == 0x0C00)
  37 #define DIGITAL_SENS_RES_IS_VALID(sens_res) \
  38         ((!((sens_res) & 0x001F) && (((sens_res) & 0x0C00) == 0x0C00)) || \
  39         (((sens_res) & 0x001F) && ((sens_res) & 0x0C00) != 0x0C00))
  40
  41 #define DIGITAL_MIFARE_READ_RES_LEN 16
  42 #define DIGITAL_MIFARE_ACK_RES  0x0A
  43
  44 #define DIGITAL_CMD_SENSB_REQ                   0x05
  45 #define DIGITAL_SENSB_ADVANCED                  BIT(5)
  46 #define DIGITAL_SENSB_EXTENDED                  BIT(4)
  47 #define DIGITAL_SENSB_ALLB_REQ                  BIT(3)
  48 #define DIGITAL_SENSB_N(n)                      ((n) & 0x7)
  49
  50 #define DIGITAL_CMD_SENSB_RES                   0x50
  51
  52 #define DIGITAL_CMD_ATTRIB_REQ                  0x1D
  53 #define DIGITAL_ATTRIB_P1_TR0_DEFAULT           (0x0 << 6)
  54 #define DIGITAL_ATTRIB_P1_TR1_DEFAULT           (0x0 << 4)
  55 #define DIGITAL_ATTRIB_P1_SUPRESS_EOS           BIT(3)
  56 #define DIGITAL_ATTRIB_P1_SUPRESS_SOS           BIT(2)
  57 #define DIGITAL_ATTRIB_P2_LISTEN_POLL_1         (0x0 << 6)
  58 #define DIGITAL_ATTRIB_P2_POLL_LISTEN_1         (0x0 << 4)
  59 #define DIGITAL_ATTRIB_P2_MAX_FRAME_256         0x8
  60 #define DIGITAL_ATTRIB_P4_DID(n)                ((n) & 0xf)
  61
  62 #define DIGITAL_CMD_SENSF_REQ   0x00
  63 #define DIGITAL_CMD_SENSF_RES   0x01
  64
  65 #define DIGITAL_SENSF_RES_MIN_LENGTH 17
  66 #define DIGITAL_SENSF_RES_RD_AP_B1   0x00
  67 #define DIGITAL_SENSF_RES_RD_AP_B2   0x8F
  68
  69 #define DIGITAL_SENSF_REQ_RC_NONE 0
  70 #define DIGITAL_SENSF_REQ_RC_SC   1
  71 #define DIGITAL_SENSF_REQ_RC_AP   2
  72
  73 #define DIGITAL_CMD_ISO15693_INVENTORY_REQ      0x01
  74
  75 #define DIGITAL_ISO15693_REQ_FLAG_DATA_RATE     BIT(1)
  76 #define DIGITAL_ISO15693_REQ_FLAG_INVENTORY     BIT(2)
  77 #define DIGITAL_ISO15693_REQ_FLAG_NB_SLOTS      BIT(5)
  78 #define DIGITAL_ISO15693_RES_FLAG_ERROR         BIT(0)
  79 #define DIGITAL_ISO15693_RES_IS_VALID(flags) \
  80         (!((flags) & DIGITAL_ISO15693_RES_FLAG_ERROR))
  81
  82 #define DIGITAL_ISO_DEP_I_PCB    0x02
  83 #define DIGITAL_ISO_DEP_PNI(pni) ((pni) & 0x01)
  84
  85 #define DIGITAL_ISO_DEP_PCB_TYPE(pcb) ((pcb) & 0xC0)
  86
  87 #define DIGITAL_ISO_DEP_I_BLOCK 0x00
  88
  89 #define DIGITAL_ISO_DEP_BLOCK_HAS_DID(pcb) ((pcb) & 0x08)
  90
  91 static const u8 digital_ats_fsc[] = {
  92          16,  24,  32,  40,  48,  64,  96, 128,
  93 };
  94
  95 #define DIGITAL_ATS_FSCI(t0) ((t0) & 0x0F)
  96 #define DIGITAL_SENSB_FSCI(pi2) (((pi2) & 0xF0) >> 4)
  97 #define DIGITAL_ATS_MAX_FSC  256
  98
  99 #define DIGITAL_RATS_BYTE1 0xE0
 100 #define DIGITAL_RATS_PARAM 0x80
 101
 102 struct digital_sdd_res {
 103         u8 nfcid1[4];
 104         u8 bcc;
 105 } __packed;
 106
 107 struct digital_sel_req {
 108         u8 sel_cmd;
 109         u8 b2;
 110         u8 nfcid1[4];
 111         u8 bcc;
 112 } __packed;
 113
 114 struct digital_sensb_req {
 115         u8 cmd;
 116         u8 afi;
 117         u8 param;
 118 } __packed;
 119
 120 struct digital_sensb_res {
 121         u8 cmd;
 122         u8 nfcid0[4];
 123         u8 app_data[4];
 124         u8 proto_info[3];
 125 } __packed;
 126
 127 struct digital_attrib_req {
 128         u8 cmd;
 129         u8 nfcid0[4];
 130         u8 param1;
 131         u8 param2;
 132         u8 param3;
 133         u8 param4;
 134 } __packed;
 135
 136 struct digital_attrib_res {
 137         u8 mbli_did;
 138 } __packed;
 139
 140 struct digital_sensf_req {
 141         u8 cmd;
 142         u8 sc1;
 143         u8 sc2;
 144         u8 rc;
 145         u8 tsn;
 146 } __packed;
 147
 148 struct digital_sensf_res {
 149         u8 cmd;
 150         u8 nfcid2[8];
 151         u8 pad0[2];
 152         u8 pad1[3];
 153         u8 mrti_check;
 154         u8 mrti_update;
 155         u8 pad2;
 156         u8 rd[2];
 157 } __packed;
 158
 159 struct digital_iso15693_inv_req {
 160         u8 flags;
 161         u8 cmd;
 162         u8 mask_len;
 163         u64 mask;
 164 } __packed;
 165
 166 struct digital_iso15693_inv_res {
 167         u8 flags;
 168         u8 dsfid;
 169         u64 uid;
 170 } __packed;
 171
 172 static int digital_in_send_sdd_req(struct nfc_digital_dev *ddev,
 173                                    struct nfc_target *target);
 174
 175 int digital_in_iso_dep_pull_sod(struct nfc_digital_dev *ddev,
 176                                 struct sk_buff *skb)
 177 {
 178         u8 pcb;
 179         u8 block_type;
 180
 181         if (skb->len < 1)
 182                 return -EIO;
 183
 184         pcb = *skb->data;
 185         block_type = DIGITAL_ISO_DEP_PCB_TYPE(pcb);
 186
 187         /* No support fo R-block nor S-block */
 188         if (block_type != DIGITAL_ISO_DEP_I_BLOCK) {
 189                 pr_err("ISO_DEP R-block and S-block not supported\n");
 190                 return -EIO;
 191         }
 192
 193         if (DIGITAL_ISO_DEP_BLOCK_HAS_DID(pcb)) {
 194                 pr_err("DID field in ISO_DEP PCB not supported\n");
 195                 return -EIO;
 196         }
 197
 198         skb_pull(skb, 1);
 199
 200         return 0;
 201 }
 202
 203 int digital_in_iso_dep_push_sod(struct nfc_digital_dev *ddev,
 204                                 struct sk_buff *skb)
 205 {
 206         /*
 207          * Chaining not supported so skb->len + 1 PCB byte + 2 CRC bytes must
 208          * not be greater than remote FSC
 209          */
 210         if (skb->len + 3 > ddev->target_fsc)
 211                 return -EIO;
 212
 213         skb_push(skb, 1);
 214
 215         *skb->data = DIGITAL_ISO_DEP_I_PCB | ddev->curr_nfc_dep_pni;
 216
 217         ddev->curr_nfc_dep_pni =
 218                 DIGITAL_ISO_DEP_PNI(ddev->curr_nfc_dep_pni + 1);
 219
 220         return 0;
 221 }
 222
 223 static void digital_in_recv_ats(struct nfc_digital_dev *ddev, void *arg,
 224                                 struct sk_buff *resp)
 225 {
 226         struct nfc_target *target = arg;
 227         u8 fsdi;
 228         int rc;
 229
 230         if (IS_ERR(resp)) {
 231                 rc = PTR_ERR(resp);
 232                 resp = NULL;
 233                 goto exit;
 234         }
 235
 236         if (resp->len < 2) {
 237                 rc = -EIO;
 238                 goto exit;
 239         }
 240
 241         fsdi = DIGITAL_ATS_FSCI(resp->data[1]);
 242         if (fsdi >= 8)
 243                 ddev->target_fsc = DIGITAL_ATS_MAX_FSC;
 244         else
 245                 ddev->target_fsc = digital_ats_fsc[fsdi];
 246
 247         ddev->curr_nfc_dep_pni = 0;
 248
 249         rc = digital_target_found(ddev, target, NFC_PROTO_ISO14443);
 250
 251 exit:
 252         dev_kfree_skb(resp);
 253         kfree(target);
 254
 255         if (rc)
 256                 digital_poll_next_tech(ddev);
 257 }
 258
 259 static int digital_in_send_rats(struct nfc_digital_dev *ddev,
 260                                 struct nfc_target *target)
 261 {
 262         int rc;
 263         struct sk_buff *skb;
 264
 265         skb = digital_skb_alloc(ddev, 2);
 266         if (!skb)
 267                 return -ENOMEM;
 268
 269         skb_put_u8(skb, DIGITAL_RATS_BYTE1);
 270         skb_put_u8(skb, DIGITAL_RATS_PARAM);
 271
 272         rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_ats,
 273                                  target);
 274         if (rc)
 275                 kfree_skb(skb);
 276
 277         return rc;
 278 }
 279
 280 static void digital_in_recv_sel_res(struct nfc_digital_dev *ddev, void *arg,
 281                                     struct sk_buff *resp)
 282 {
 283         struct nfc_target *target = arg;
 284         int rc;
 285         u8 sel_res;
 286         u8 nfc_proto;
 287
 288         if (IS_ERR(resp)) {
 289                 rc = PTR_ERR(resp);
 290                 resp = NULL;
 291                 goto exit;
 292         }
 293
 294         if (!DIGITAL_DRV_CAPS_IN_CRC(ddev)) {
 295                 rc = digital_skb_check_crc_a(resp);
 296                 if (rc) {
 297                         PROTOCOL_ERR("4.4.1.3");
 298                         goto exit;
 299                 }
 300         }
 301
 302         if (!resp->len) {
 303                 rc = -EIO;
 304                 goto exit;
 305         }
 306
 307         sel_res = resp->data[0];
 308
 309         if (!DIGITAL_SEL_RES_NFCID1_COMPLETE(sel_res)) {
 310                 rc = digital_in_send_sdd_req(ddev, target);
 311                 if (rc)
 312                         goto exit;
 313
 314                 goto exit_free_skb;
 315         }
 316
 317         target->sel_res = sel_res;
 318
 319         if (DIGITAL_SEL_RES_IS_T2T(sel_res)) {
 320                 nfc_proto = NFC_PROTO_MIFARE;
 321         } else if (DIGITAL_SEL_RES_IS_NFC_DEP(sel_res)) {
 322                 nfc_proto = NFC_PROTO_NFC_DEP;
 323         } else if (DIGITAL_SEL_RES_IS_T4T(sel_res)) {
 324                 rc = digital_in_send_rats(ddev, target);
 325                 if (rc)
 326                         goto exit;
 327                 /*
 328                  * Skip target_found and don't free it for now. This will be
 329                  * done when receiving the ATS
 330                  */
 331                 goto exit_free_skb;
 332         } else {
 333                 rc = -EOPNOTSUPP;
 334                 goto exit;
 335         }
 336
 337         rc = digital_target_found(ddev, target, nfc_proto);
 338
 339 exit:
 340         kfree(target);
 341
 342 exit_free_skb:
 343         dev_kfree_skb(resp);
 344
 345         if (rc)
 346                 digital_poll_next_tech(ddev);
 347 }
 348
 349 static int digital_in_send_sel_req(struct nfc_digital_dev *ddev,
 350                                    struct nfc_target *target,
 351                                    struct digital_sdd_res *sdd_res)
 352 {
 353         struct sk_buff *skb;
 354         struct digital_sel_req *sel_req;
 355         u8 sel_cmd;
 356         int rc;
 357
 358         skb = digital_skb_alloc(ddev, sizeof(struct digital_sel_req));
 359         if (!skb)
 360                 return -ENOMEM;
 361
 362         skb_put(skb, sizeof(struct digital_sel_req));
 363         sel_req = (struct digital_sel_req *)skb->data;
 364
 365         if (target->nfcid1_len <= 4)
 366                 sel_cmd = DIGITAL_CMD_SEL_REQ_CL1;
 367         else if (target->nfcid1_len < 10)
 368                 sel_cmd = DIGITAL_CMD_SEL_REQ_CL2;
 369         else
 370                 sel_cmd = DIGITAL_CMD_SEL_REQ_CL3;
 371
 372         sel_req->sel_cmd = sel_cmd;
 373         sel_req->b2 = 0x70;
 374         memcpy(sel_req->nfcid1, sdd_res->nfcid1, 4);
 375         sel_req->bcc = sdd_res->bcc;
 376
 377         if (DIGITAL_DRV_CAPS_IN_CRC(ddev)) {
 378                 rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
 379                                 NFC_DIGITAL_FRAMING_NFCA_STANDARD_WITH_CRC_A);
 380                 if (rc)
 381                         goto exit;
 382         } else {
 383                 digital_skb_add_crc_a(skb);
 384         }
 385
 386         rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sel_res,
 387                                  target);
 388 exit:
 389         if (rc)
 390                 kfree_skb(skb);
 391
 392         return rc;
 393 }
 394
 395 static void digital_in_recv_sdd_res(struct nfc_digital_dev *ddev, void *arg,
 396                                     struct sk_buff *resp)
 397 {
 398         struct nfc_target *target = arg;
 399         struct digital_sdd_res *sdd_res;
 400         int rc;
 401         u8 offset, size;
 402         u8 i, bcc;
 403
 404         if (IS_ERR(resp)) {
 405                 rc = PTR_ERR(resp);
 406                 resp = NULL;
 407                 goto exit;
 408         }
 409
 410         if (resp->len < DIGITAL_SDD_RES_LEN) {
 411                 PROTOCOL_ERR("4.7.2.8");
 412                 rc = -EINVAL;
 413                 goto exit;
 414         }
 415
 416         sdd_res = (struct digital_sdd_res *)resp->data;
 417
 418         for (i = 0, bcc = 0; i < 4; i++)
 419                 bcc ^= sdd_res->nfcid1[i];
 420
 421         if (bcc != sdd_res->bcc) {
 422                 PROTOCOL_ERR("4.7.2.6");
 423                 rc = -EINVAL;
 424                 goto exit;
 425         }
 426
 427         if (sdd_res->nfcid1[0] == DIGITAL_SDD_RES_CT) {
 428                 offset = 1;
 429                 size = 3;
 430         } else {
 431                 offset = 0;
 432                 size = 4;
 433         }
 434
 435         memcpy(target->nfcid1 + target->nfcid1_len, sdd_res->nfcid1 + offset,
 436                size);
 437         target->nfcid1_len += size;
 438
 439         rc = digital_in_send_sel_req(ddev, target, sdd_res);
 440
 441 exit:
 442         dev_kfree_skb(resp);
 443
 444         if (rc) {
 445                 kfree(target);
 446                 digital_poll_next_tech(ddev);
 447         }
 448 }
 449
 450 static int digital_in_send_sdd_req(struct nfc_digital_dev *ddev,
 451                                    struct nfc_target *target)
 452 {
 453         int rc;
 454         struct sk_buff *skb;
 455         u8 sel_cmd;
 456
 457         rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
 458                                      NFC_DIGITAL_FRAMING_NFCA_STANDARD);
 459         if (rc)
 460                 return rc;
 461
 462         skb = digital_skb_alloc(ddev, 2);
 463         if (!skb)
 464                 return -ENOMEM;
 465
 466         if (target->nfcid1_len == 0)
 467                 sel_cmd = DIGITAL_CMD_SEL_REQ_CL1;
 468         else if (target->nfcid1_len == 3)
 469                 sel_cmd = DIGITAL_CMD_SEL_REQ_CL2;
 470         else
 471                 sel_cmd = DIGITAL_CMD_SEL_REQ_CL3;
 472
 473         skb_put_u8(skb, sel_cmd);
 474         skb_put_u8(skb, DIGITAL_SDD_REQ_SEL_PAR);
 475
 476         return digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res,
 477                                    target);
 478 }
 479
 480 static void digital_in_recv_sens_res(struct nfc_digital_dev *ddev, void *arg,
 481                                      struct sk_buff *resp)
 482 {
 483         struct nfc_target *target = NULL;
 484         int rc;
 485
 486         if (IS_ERR(resp)) {
 487                 rc = PTR_ERR(resp);
 488                 resp = NULL;
 489                 goto exit;
 490         }
 491
 492         if (resp->len < sizeof(u16)) {
 493                 rc = -EIO;
 494                 goto exit;
 495         }
 496
 497         target = kzalloc(sizeof(struct nfc_target), GFP_KERNEL);
 498         if (!target) {
 499                 rc = -ENOMEM;
 500                 goto exit;
 501         }
 502
 503         target->sens_res = __le16_to_cpu(*(__le16 *)resp->data);
 504
 505         if (!DIGITAL_SENS_RES_IS_VALID(target->sens_res)) {
 506                 PROTOCOL_ERR("4.6.3.3");
 507                 rc = -EINVAL;
 508                 goto exit;
 509         }
 510
 511         if (DIGITAL_SENS_RES_IS_T1T(target->sens_res))
 512                 rc = digital_target_found(ddev, target, NFC_PROTO_JEWEL);
 513         else
 514                 rc = digital_in_send_sdd_req(ddev, target);
 515
 516 exit:
 517         dev_kfree_skb(resp);
 518
 519         if (rc) {
 520                 kfree(target);
 521                 digital_poll_next_tech(ddev);
 522         }
 523 }
 524
 525 int digital_in_send_sens_req(struct nfc_digital_dev *ddev, u8 rf_tech)
 526 {
 527         struct sk_buff *skb;
 528         int rc;
 529
 530         rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH,
 531                                      NFC_DIGITAL_RF_TECH_106A);
 532         if (rc)
 533                 return rc;
 534
 535         rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
 536                                      NFC_DIGITAL_FRAMING_NFCA_SHORT);
 537         if (rc)
 538                 return rc;
 539
 540         skb = digital_skb_alloc(ddev, 1);
 541         if (!skb)
 542                 return -ENOMEM;
 543
 544         skb_put_u8(skb, DIGITAL_CMD_SENS_REQ);
 545
 546         rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sens_res, NULL);
 547         if (rc)
 548                 kfree_skb(skb);
 549
 550         return rc;
 551 }
 552
 553 int digital_in_recv_mifare_res(struct sk_buff *resp)
 554 {
 555         /* Successful READ command response is 16 data bytes + 2 CRC bytes long.
 556          * Since the driver can't differentiate a ACK/NACK response from a valid
 557          * READ response, the CRC calculation must be handled at digital level
 558          * even if the driver supports it for this technology.
 559          */
 560         if (resp->len == DIGITAL_MIFARE_READ_RES_LEN + DIGITAL_CRC_LEN) {
 561                 if (digital_skb_check_crc_a(resp)) {
 562                         PROTOCOL_ERR("9.4.1.2");
 563                         return -EIO;
 564                 }
 565
 566                 return 0;
 567         }
 568
 569         /* ACK response (i.e. successful WRITE). */
 570         if (resp->len == 1 && resp->data[0] == DIGITAL_MIFARE_ACK_RES) {
 571                 resp->data[0] = 0;
 572                 return 0;
 573         }
 574
 575         /* NACK and any other responses are treated as error. */
 576         return -EIO;
 577 }
 578
 579 static void digital_in_recv_attrib_res(struct nfc_digital_dev *ddev, void *arg,
 580                                        struct sk_buff *resp)
 581 {
 582         struct nfc_target *target = arg;
 583         struct digital_attrib_res *attrib_res;
 584         int rc;
 585
 586         if (IS_ERR(resp)) {
 587                 rc = PTR_ERR(resp);
 588                 resp = NULL;
 589                 goto exit;
 590         }
 591
 592         if (resp->len < sizeof(*attrib_res)) {
 593                 PROTOCOL_ERR("12.6.2");
 594                 rc = -EIO;
 595                 goto exit;
 596         }
 597
 598         attrib_res = (struct digital_attrib_res *)resp->data;
 599
 600         if (attrib_res->mbli_did & 0x0f) {
 601                 PROTOCOL_ERR("12.6.2.1");
 602                 rc = -EIO;
 603                 goto exit;
 604         }
 605
 606         rc = digital_target_found(ddev, target, NFC_PROTO_ISO14443_B);
 607
 608 exit:
 609         dev_kfree_skb(resp);
 610         kfree(target);
 611
 612         if (rc)
 613                 digital_poll_next_tech(ddev);
 614 }
 615
 616 static int digital_in_send_attrib_req(struct nfc_digital_dev *ddev,
 617                                struct nfc_target *target,
 618                                struct digital_sensb_res *sensb_res)
 619 {
 620         struct digital_attrib_req *attrib_req;
 621         struct sk_buff *skb;
 622         int rc;
 623
 624         skb = digital_skb_alloc(ddev, sizeof(*attrib_req));
 625         if (!skb)
 626                 return -ENOMEM;
 627
 628         attrib_req = skb_put(skb, sizeof(*attrib_req));
 629
 630         attrib_req->cmd = DIGITAL_CMD_ATTRIB_REQ;
 631         memcpy(attrib_req->nfcid0, sensb_res->nfcid0,
 632                sizeof(attrib_req->nfcid0));
 633         attrib_req->param1 = DIGITAL_ATTRIB_P1_TR0_DEFAULT |
 634                              DIGITAL_ATTRIB_P1_TR1_DEFAULT;
 635         attrib_req->param2 = DIGITAL_ATTRIB_P2_LISTEN_POLL_1 |
 636                              DIGITAL_ATTRIB_P2_POLL_LISTEN_1 |
 637                              DIGITAL_ATTRIB_P2_MAX_FRAME_256;
 638         attrib_req->param3 = sensb_res->proto_info[1] & 0x07;
 639         attrib_req->param4 = DIGITAL_ATTRIB_P4_DID(0);
 640
 641         rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_attrib_res,
 642                                  target);
 643         if (rc)
 644                 kfree_skb(skb);
 645
 646         return rc;
 647 }
 648
 649 static void digital_in_recv_sensb_res(struct nfc_digital_dev *ddev, void *arg,
 650                                       struct sk_buff *resp)
 651 {
 652         struct nfc_target *target = NULL;
 653         struct digital_sensb_res *sensb_res;
 654         u8 fsci;
 655         int rc;
 656
 657         if (IS_ERR(resp)) {
 658                 rc = PTR_ERR(resp);
 659                 resp = NULL;
 660                 goto exit;
 661         }
 662
 663         if (resp->len != sizeof(*sensb_res)) {
 664                 PROTOCOL_ERR("5.6.2.1");
 665                 rc = -EIO;
 666                 goto exit;
 667         }
 668
 669         sensb_res = (struct digital_sensb_res *)resp->data;
 670
 671         if (sensb_res->cmd != DIGITAL_CMD_SENSB_RES) {
 672                 PROTOCOL_ERR("5.6.2");
 673                 rc = -EIO;
 674                 goto exit;
 675         }
 676
 677         if (!(sensb_res->proto_info[1] & BIT(0))) {
 678                 PROTOCOL_ERR("5.6.2.12");
 679                 rc = -EIO;
 680                 goto exit;
 681         }
 682
 683         if (sensb_res->proto_info[1] & BIT(3)) {
 684                 PROTOCOL_ERR("5.6.2.16");
 685                 rc = -EIO;
 686                 goto exit;
 687         }
 688
 689         fsci = DIGITAL_SENSB_FSCI(sensb_res->proto_info[1]);
 690         if (fsci >= 8)
 691                 ddev->target_fsc = DIGITAL_ATS_MAX_FSC;
 692         else
 693                 ddev->target_fsc = digital_ats_fsc[fsci];
 694
 695         target = kzalloc(sizeof(struct nfc_target), GFP_KERNEL);
 696         if (!target) {
 697                 rc = -ENOMEM;
 698                 goto exit;
 699         }
 700
 701         rc = digital_in_send_attrib_req(ddev, target, sensb_res);
 702
 703 exit:
 704         dev_kfree_skb(resp);
 705
 706         if (rc) {
 707                 kfree(target);
 708                 digital_poll_next_tech(ddev);
 709         }
 710 }
 711
 712 int digital_in_send_sensb_req(struct nfc_digital_dev *ddev, u8 rf_tech)
 713 {
 714         struct digital_sensb_req *sensb_req;
 715         struct sk_buff *skb;
 716         int rc;
 717
 718         rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH,
 719                                      NFC_DIGITAL_RF_TECH_106B);
 720         if (rc)
 721                 return rc;
 722
 723         rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
 724                                      NFC_DIGITAL_FRAMING_NFCB);
 725         if (rc)
 726                 return rc;
 727
 728         skb = digital_skb_alloc(ddev, sizeof(*sensb_req));
 729         if (!skb)
 730                 return -ENOMEM;
 731
 732         sensb_req = skb_put(skb, sizeof(*sensb_req));
 733
 734         sensb_req->cmd = DIGITAL_CMD_SENSB_REQ;
 735         sensb_req->afi = 0x00; /* All families and sub-families */
 736         sensb_req->param = DIGITAL_SENSB_N(0);
 737
 738         rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sensb_res,
 739                                  NULL);
 740         if (rc)
 741                 kfree_skb(skb);
 742
 743         return rc;
 744 }
 745
 746 static void digital_in_recv_sensf_res(struct nfc_digital_dev *ddev, void *arg,
 747                                    struct sk_buff *resp)
 748 {
 749         int rc;
 750         u8 proto;
 751         struct nfc_target target;
 752         struct digital_sensf_res *sensf_res;
 753
 754         if (IS_ERR(resp)) {
 755                 rc = PTR_ERR(resp);
 756                 resp = NULL;
 757                 goto exit;
 758         }
 759
 760         if (resp->len < DIGITAL_SENSF_RES_MIN_LENGTH) {
 761                 rc = -EIO;
 762                 goto exit;
 763         }
 764
 765         if (!DIGITAL_DRV_CAPS_IN_CRC(ddev)) {
 766                 rc = digital_skb_check_crc_f(resp);
 767                 if (rc) {
 768                         PROTOCOL_ERR("6.4.1.8");
 769                         goto exit;
 770                 }
 771         }
 772
 773         skb_pull(resp, 1);
 774
 775         memset(&target, 0, sizeof(struct nfc_target));
 776
 777         sensf_res = (struct digital_sensf_res *)resp->data;
 778
 779         memcpy(target.sensf_res, sensf_res, resp->len);
 780         target.sensf_res_len = resp->len;
 781
 782         memcpy(target.nfcid2, sensf_res->nfcid2, NFC_NFCID2_MAXSIZE);
 783         target.nfcid2_len = NFC_NFCID2_MAXSIZE;
 784
 785         if (target.nfcid2[0] == DIGITAL_SENSF_NFCID2_NFC_DEP_B1 &&
 786             target.nfcid2[1] == DIGITAL_SENSF_NFCID2_NFC_DEP_B2)
 787                 proto = NFC_PROTO_NFC_DEP;
 788         else
 789                 proto = NFC_PROTO_FELICA;
 790
 791         rc = digital_target_found(ddev, &target, proto);
 792
 793 exit:
 794         dev_kfree_skb(resp);
 795
 796         if (rc)
 797                 digital_poll_next_tech(ddev);
 798 }
 799
 800 int digital_in_send_sensf_req(struct nfc_digital_dev *ddev, u8 rf_tech)
 801 {
 802         struct digital_sensf_req *sensf_req;
 803         struct sk_buff *skb;
 804         int rc;
 805         u8 size;
 806
 807         rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH, rf_tech);
 808         if (rc)
 809                 return rc;
 810
 811         rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
 812                                      NFC_DIGITAL_FRAMING_NFCF);
 813         if (rc)
 814                 return rc;
 815
 816         size = sizeof(struct digital_sensf_req);
 817
 818         skb = digital_skb_alloc(ddev, size);
 819         if (!skb)
 820                 return -ENOMEM;
 821
 822         skb_put(skb, size);
 823
 824         sensf_req = (struct digital_sensf_req *)skb->data;
 825         sensf_req->cmd = DIGITAL_CMD_SENSF_REQ;
 826         sensf_req->sc1 = 0xFF;
 827         sensf_req->sc2 = 0xFF;
 828         sensf_req->rc = 0;
 829         sensf_req->tsn = 0;
 830
 831         *(u8 *)skb_push(skb, 1) = size + 1;
 832
 833         if (!DIGITAL_DRV_CAPS_IN_CRC(ddev))
 834                 digital_skb_add_crc_f(skb);
 835
 836         rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sensf_res,
 837                                  NULL);
 838         if (rc)
 839                 kfree_skb(skb);
 840
 841         return rc;
 842 }
 843
 844 static void digital_in_recv_iso15693_inv_res(struct nfc_digital_dev *ddev,
 845                 void *arg, struct sk_buff *resp)
 846 {
 847         struct digital_iso15693_inv_res *res;
 848         struct nfc_target *target = NULL;
 849         int rc;
 850
 851         if (IS_ERR(resp)) {
 852                 rc = PTR_ERR(resp);
 853                 resp = NULL;
 854                 goto out_free_skb;
 855         }
 856
 857         if (resp->len != sizeof(*res)) {
 858                 rc = -EIO;
 859                 goto out_free_skb;
 860         }
 861
 862         res = (struct digital_iso15693_inv_res *)resp->data;
 863
 864         if (!DIGITAL_ISO15693_RES_IS_VALID(res->flags)) {
 865                 PROTOCOL_ERR("ISO15693 - 10.3.1");
 866                 rc = -EINVAL;
 867                 goto out_free_skb;
 868         }
 869
 870         target = kzalloc(sizeof(*target), GFP_KERNEL);
 871         if (!target) {
 872                 rc = -ENOMEM;
 873                 goto out_free_skb;
 874         }
 875
 876         target->is_iso15693 = 1;
 877         target->iso15693_dsfid = res->dsfid;
 878         memcpy(target->iso15693_uid, &res->uid, sizeof(target->iso15693_uid));
 879
 880         rc = digital_target_found(ddev, target, NFC_PROTO_ISO15693);
 881
 882         kfree(target);
 883
 884 out_free_skb:
 885         dev_kfree_skb(resp);
 886
 887         if (rc)
 888                 digital_poll_next_tech(ddev);
 889 }
 890
 891 int digital_in_send_iso15693_inv_req(struct nfc_digital_dev *ddev, u8 rf_tech)
 892 {
 893         struct digital_iso15693_inv_req *req;
 894         struct sk_buff *skb;
 895         int rc;
 896
 897         rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH,
 898                                      NFC_DIGITAL_RF_TECH_ISO15693);
 899         if (rc)
 900                 return rc;
 901
 902         rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
 903                                      NFC_DIGITAL_FRAMING_ISO15693_INVENTORY);
 904         if (rc)
 905                 return rc;
 906
 907         skb = digital_skb_alloc(ddev, sizeof(*req));
 908         if (!skb)
 909                 return -ENOMEM;
 910
 911         skb_put(skb, sizeof(*req) - sizeof(req->mask)); /* No mask */
 912         req = (struct digital_iso15693_inv_req *)skb->data;
 913
 914         /* Single sub-carrier, high data rate, no AFI, single slot
 915          * Inventory command
 916          */
 917         req->flags = DIGITAL_ISO15693_REQ_FLAG_DATA_RATE |
 918                      DIGITAL_ISO15693_REQ_FLAG_INVENTORY |
 919                      DIGITAL_ISO15693_REQ_FLAG_NB_SLOTS;
 920         req->cmd = DIGITAL_CMD_ISO15693_INVENTORY_REQ;
 921         req->mask_len = 0;
 922
 923         rc = digital_in_send_cmd(ddev, skb, 30,
 924                                  digital_in_recv_iso15693_inv_res, NULL);
 925         if (rc)
 926                 kfree_skb(skb);
 927
 928         return rc;
 929 }
 930
 931 static int digital_tg_send_sel_res(struct nfc_digital_dev *ddev)
 932 {
 933         struct sk_buff *skb;
 934         int rc;
 935
 936         skb = digital_skb_alloc(ddev, 1);
 937         if (!skb)
 938                 return -ENOMEM;
 939
 940         skb_put_u8(skb, DIGITAL_SEL_RES_NFC_DEP);
 941
 942         if (!DIGITAL_DRV_CAPS_TG_CRC(ddev))
 943                 digital_skb_add_crc_a(skb);
 944
 945         rc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
 946                                      NFC_DIGITAL_FRAMING_NFCA_ANTICOL_COMPLETE);
 947         if (rc) {
 948                 kfree_skb(skb);
 949                 return rc;
 950         }
 951
 952         rc = digital_tg_send_cmd(ddev, skb, 300, digital_tg_recv_atr_req,
 953                                  NULL);
 954         if (rc)
 955                 kfree_skb(skb);
 956
 957         return rc;
 958 }
 959
 960 static void digital_tg_recv_sel_req(struct nfc_digital_dev *ddev, void *arg,
 961                                     struct sk_buff *resp)
 962 {
 963         int rc;
 964
 965         if (IS_ERR(resp)) {
 966                 rc = PTR_ERR(resp);
 967                 resp = NULL;
 968                 goto exit;
 969         }
 970
 971         if (!DIGITAL_DRV_CAPS_TG_CRC(ddev)) {
 972                 rc = digital_skb_check_crc_a(resp);
 973                 if (rc) {
 974                         PROTOCOL_ERR("4.4.1.3");
 975                         goto exit;
 976                 }
 977         }
 978
 979         /* Silently ignore SEL_REQ content and send a SEL_RES for NFC-DEP */
 980
 981         rc = digital_tg_send_sel_res(ddev);
 982
 983 exit:
 984         if (rc)
 985                 digital_poll_next_tech(ddev);
 986
 987         dev_kfree_skb(resp);
 988 }
 989
 990 static int digital_tg_send_sdd_res(struct nfc_digital_dev *ddev)
 991 {
 992         struct sk_buff *skb;
 993         struct digital_sdd_res *sdd_res;
 994         int rc, i;
 995
 996         skb = digital_skb_alloc(ddev, sizeof(struct digital_sdd_res));
 997         if (!skb)
 998                 return -ENOMEM;
 999
1000         skb_put(skb, sizeof(struct digital_sdd_res));
1001         sdd_res = (struct digital_sdd_res *)skb->data;
1002
1003         sdd_res->nfcid1[0] = 0x08;
1004         get_random_bytes(sdd_res->nfcid1 + 1, 3);
1005
1006         sdd_res->bcc = 0;
1007         for (i = 0; i < 4; i++)
1008                 sdd_res->bcc ^= sdd_res->nfcid1[i];
1009
1010         rc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
1011                                 NFC_DIGITAL_FRAMING_NFCA_STANDARD_WITH_CRC_A);
1012         if (rc) {
1013                 kfree_skb(skb);
1014                 return rc;
1015         }
1016
1017         rc = digital_tg_send_cmd(ddev, skb, 300, digital_tg_recv_sel_req,
1018                                  NULL);
1019         if (rc)
1020                 kfree_skb(skb);
1021
1022         return rc;
1023 }
1024
1025 static void digital_tg_recv_sdd_req(struct nfc_digital_dev *ddev, void *arg,
1026                                     struct sk_buff *resp)
1027 {
1028         u8 *sdd_req;
1029         int rc;
1030
1031         if (IS_ERR(resp)) {
1032                 rc = PTR_ERR(resp);
1033                 resp = NULL;
1034                 goto exit;
1035         }
1036
1037         sdd_req = resp->data;
1038
1039         if (resp->len < 2 || sdd_req[0] != DIGITAL_CMD_SEL_REQ_CL1 ||
1040             sdd_req[1] != DIGITAL_SDD_REQ_SEL_PAR) {
1041                 rc = -EINVAL;
1042                 goto exit;
1043         }
1044
1045         rc = digital_tg_send_sdd_res(ddev);
1046
1047 exit:
1048         if (rc)
1049                 digital_poll_next_tech(ddev);
1050
1051         dev_kfree_skb(resp);
1052 }
1053
1054 static int digital_tg_send_sens_res(struct nfc_digital_dev *ddev)
1055 {
1056         struct sk_buff *skb;
1057         u8 *sens_res;
1058         int rc;
1059
1060         skb = digital_skb_alloc(ddev, 2);
1061         if (!skb)
1062                 return -ENOMEM;
1063
1064         sens_res = skb_put(skb, 2);
1065
1066         sens_res[0] = (DIGITAL_SENS_RES_NFC_DEP >> 8) & 0xFF;
1067         sens_res[1] = DIGITAL_SENS_RES_NFC_DEP & 0xFF;
1068
1069         rc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
1070                                      NFC_DIGITAL_FRAMING_NFCA_STANDARD);
1071         if (rc) {
1072                 kfree_skb(skb);
1073                 return rc;
1074         }
1075
1076         rc = digital_tg_send_cmd(ddev, skb, 300, digital_tg_recv_sdd_req,
1077                                  NULL);
1078         if (rc)
1079                 kfree_skb(skb);
1080
1081         return rc;
1082 }
1083
1084 void digital_tg_recv_sens_req(struct nfc_digital_dev *ddev, void *arg,
1085                               struct sk_buff *resp)
1086 {
1087         u8 sens_req;
1088         int rc;
1089
1090         if (IS_ERR(resp)) {
1091                 rc = PTR_ERR(resp);
1092                 resp = NULL;
1093                 goto exit;
1094         }
1095
1096         sens_req = resp->data[0];
1097
1098         if (!resp->len || (sens_req != DIGITAL_CMD_SENS_REQ &&
1099             sens_req != DIGITAL_CMD_ALL_REQ)) {
1100                 rc = -EINVAL;
1101                 goto exit;
1102         }
1103
1104         rc = digital_tg_send_sens_res(ddev);
1105
1106 exit:
1107         if (rc)
1108                 digital_poll_next_tech(ddev);
1109
1110         dev_kfree_skb(resp);
1111 }
1112
1113 static void digital_tg_recv_atr_or_sensf_req(struct nfc_digital_dev *ddev,
1114                 void *arg, struct sk_buff *resp)
1115 {
1116         if (!IS_ERR(resp) && (resp->len >= 2) &&
1117                         (resp->data[1] == DIGITAL_CMD_SENSF_REQ))
1118                 digital_tg_recv_sensf_req(ddev, arg, resp);
1119         else
1120                 digital_tg_recv_atr_req(ddev, arg, resp);
1121
1122         return;
1123 }
1124
1125 static int digital_tg_send_sensf_res(struct nfc_digital_dev *ddev,
1126                               struct digital_sensf_req *sensf_req)
1127 {
1128         struct sk_buff *skb;
1129         u8 size;
1130         int rc;
1131         struct digital_sensf_res *sensf_res;
1132
1133         size = sizeof(struct digital_sensf_res);
1134
1135         if (sensf_req->rc == DIGITAL_SENSF_REQ_RC_NONE)
1136                 size -= sizeof(sensf_res->rd);
1137
1138         skb = digital_skb_alloc(ddev, size);
1139         if (!skb)
1140                 return -ENOMEM;
1141
1142         skb_put(skb, size);
1143
1144         sensf_res = (struct digital_sensf_res *)skb->data;
1145
1146         memset(sensf_res, 0, size);
1147
1148         sensf_res->cmd = DIGITAL_CMD_SENSF_RES;
1149         sensf_res->nfcid2[0] = DIGITAL_SENSF_NFCID2_NFC_DEP_B1;
1150         sensf_res->nfcid2[1] = DIGITAL_SENSF_NFCID2_NFC_DEP_B2;
1151         get_random_bytes(&sensf_res->nfcid2[2], 6);
1152
1153         switch (sensf_req->rc) {
1154         case DIGITAL_SENSF_REQ_RC_SC:
1155                 sensf_res->rd[0] = sensf_req->sc1;
1156                 sensf_res->rd[1] = sensf_req->sc2;
1157                 break;
1158         case DIGITAL_SENSF_REQ_RC_AP:
1159                 sensf_res->rd[0] = DIGITAL_SENSF_RES_RD_AP_B1;
1160                 sensf_res->rd[1] = DIGITAL_SENSF_RES_RD_AP_B2;
1161                 break;
1162         }
1163
1164         *(u8 *)skb_push(skb, sizeof(u8)) = size + 1;
1165
1166         if (!DIGITAL_DRV_CAPS_TG_CRC(ddev))
1167                 digital_skb_add_crc_f(skb);
1168
1169         rc = digital_tg_send_cmd(ddev, skb, 300,
1170                                  digital_tg_recv_atr_or_sensf_req, NULL);
1171         if (rc)
1172                 kfree_skb(skb);
1173
1174         return rc;
1175 }
1176
1177 void digital_tg_recv_sensf_req(struct nfc_digital_dev *ddev, void *arg,
1178                                struct sk_buff *resp)
1179 {
1180         struct digital_sensf_req *sensf_req;
1181         int rc;
1182
1183         if (IS_ERR(resp)) {
1184                 rc = PTR_ERR(resp);
1185                 resp = NULL;
1186                 goto exit;
1187         }
1188
1189         if (!DIGITAL_DRV_CAPS_TG_CRC(ddev)) {
1190                 rc = digital_skb_check_crc_f(resp);
1191                 if (rc) {
1192                         PROTOCOL_ERR("6.4.1.8");
1193                         goto exit;
1194                 }
1195         }
1196
1197         if (resp->len != sizeof(struct digital_sensf_req) + 1) {
1198                 rc = -EINVAL;
1199                 goto exit;
1200         }
1201
1202         skb_pull(resp, 1);
1203         sensf_req = (struct digital_sensf_req *)resp->data;
1204
1205         if (sensf_req->cmd != DIGITAL_CMD_SENSF_REQ) {
1206                 rc = -EINVAL;
1207                 goto exit;
1208         }
1209
1210         rc = digital_tg_send_sensf_res(ddev, sensf_req);
1211
1212 exit:
1213         if (rc)
1214                 digital_poll_next_tech(ddev);
1215
1216         dev_kfree_skb(resp);
1217 }
1218
1219 static int digital_tg_config_nfca(struct nfc_digital_dev *ddev)
1220 {
1221         int rc;
1222
1223         rc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH,
1224                                      NFC_DIGITAL_RF_TECH_106A);
1225         if (rc)
1226                 return rc;
1227
1228         return digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
1229                                        NFC_DIGITAL_FRAMING_NFCA_NFC_DEP);
1230 }
1231
1232 int digital_tg_listen_nfca(struct nfc_digital_dev *ddev, u8 rf_tech)
1233 {
1234         int rc;
1235
1236         rc = digital_tg_config_nfca(ddev);
1237         if (rc)
1238                 return rc;
1239
1240         return digital_tg_listen(ddev, 300, digital_tg_recv_sens_req, NULL);
1241 }
1242
1243 static int digital_tg_config_nfcf(struct nfc_digital_dev *ddev, u8 rf_tech)
1244 {
1245         int rc;
1246
1247         rc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH, rf_tech);
1248         if (rc)
1249                 return rc;
1250
1251         return digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
1252                                        NFC_DIGITAL_FRAMING_NFCF_NFC_DEP);
1253 }
1254
1255 int digital_tg_listen_nfcf(struct nfc_digital_dev *ddev, u8 rf_tech)
1256 {
1257         int rc;
1258
1259         rc = digital_tg_config_nfcf(ddev, rf_tech);
1260         if (rc)
1261                 return rc;
1262
1263         return digital_tg_listen(ddev, 300, digital_tg_recv_sensf_req, NULL);
1264 }
1265
1266 void digital_tg_recv_md_req(struct nfc_digital_dev *ddev, void *arg,
1267                             struct sk_buff *resp)
1268 {
1269         u8 rf_tech;
1270         int rc;
1271
1272         if (IS_ERR(resp)) {
1273                 resp = NULL;
1274                 goto exit_free_skb;
1275         }
1276
1277         rc = ddev->ops->tg_get_rf_tech(ddev, &rf_tech);
1278         if (rc)
1279                 goto exit_free_skb;
1280
1281         switch (rf_tech) {
1282         case NFC_DIGITAL_RF_TECH_106A:
1283                 rc = digital_tg_config_nfca(ddev);
1284                 if (rc)
1285                         goto exit_free_skb;
1286                 digital_tg_recv_sens_req(ddev, arg, resp);
1287                 break;
1288         case NFC_DIGITAL_RF_TECH_212F:
1289         case NFC_DIGITAL_RF_TECH_424F:
1290                 rc = digital_tg_config_nfcf(ddev, rf_tech);
1291                 if (rc)
1292                         goto exit_free_skb;
1293                 digital_tg_recv_sensf_req(ddev, arg, resp);
1294                 break;
1295         default:
1296                 goto exit_free_skb;
1297         }
1298
1299         return;
1300
1301 exit_free_skb:
1302         digital_poll_next_tech(ddev);
1303         dev_kfree_skb(resp);
1304 }