drivers/nfc/st-nci/se.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Secure Element driver for STMicroelectronics NFC NCI chip
   4  *
   5  * Copyright (C) 2014-2015 STMicroelectronics SAS. All rights reserved.
   6  */
   7
   8 #include <linux/module.h>
   9 #include <linux/nfc.h>
  10 #include <linux/delay.h>
  11 #include <net/nfc/nci.h>
  12 #include <net/nfc/nci_core.h>
  13
  14 #include "st-nci.h"
  15
  16 struct st_nci_pipe_info {
  17         u8 pipe_state;
  18         u8 src_host_id;
  19         u8 src_gate_id;
  20         u8 dst_host_id;
  21         u8 dst_gate_id;
  22 } __packed;
  23
  24 /* Hosts */
  25 #define ST_NCI_HOST_CONTROLLER_ID     0x00
  26 #define ST_NCI_TERMINAL_HOST_ID       0x01
  27 #define ST_NCI_UICC_HOST_ID           0x02
  28 #define ST_NCI_ESE_HOST_ID            0xc0
  29
  30 /* Gates */
  31 #define ST_NCI_APDU_READER_GATE       0xf0
  32 #define ST_NCI_CONNECTIVITY_GATE      0x41
  33
  34 /* Pipes */
  35 #define ST_NCI_DEVICE_MGNT_PIPE               0x02
  36
  37 /* Connectivity pipe only */
  38 #define ST_NCI_SE_COUNT_PIPE_UICC             0x01
  39 /* Connectivity + APDU Reader pipe */
  40 #define ST_NCI_SE_COUNT_PIPE_EMBEDDED         0x02
  41
  42 #define ST_NCI_SE_TO_HOT_PLUG                   1000 /* msecs */
  43 #define ST_NCI_SE_TO_PIPES                      2000
  44
  45 #define ST_NCI_EVT_HOT_PLUG_IS_INHIBITED(x)   (x->data[0] & 0x80)
  46
  47 #define NCI_HCI_APDU_PARAM_ATR                     0x01
  48 #define NCI_HCI_ADMIN_PARAM_SESSION_IDENTITY       0x01
  49 #define NCI_HCI_ADMIN_PARAM_WHITELIST              0x03
  50 #define NCI_HCI_ADMIN_PARAM_HOST_LIST              0x04
  51
  52 #define ST_NCI_EVT_SE_HARD_RESET                0x20
  53 #define ST_NCI_EVT_TRANSMIT_DATA                0x10
  54 #define ST_NCI_EVT_WTX_REQUEST                  0x11
  55 #define ST_NCI_EVT_SE_SOFT_RESET                0x11
  56 #define ST_NCI_EVT_SE_END_OF_APDU_TRANSFER      0x21
  57 #define ST_NCI_EVT_HOT_PLUG                     0x03
  58
  59 #define ST_NCI_SE_MODE_OFF                    0x00
  60 #define ST_NCI_SE_MODE_ON                     0x01
  61
  62 #define ST_NCI_EVT_CONNECTIVITY       0x10
  63 #define ST_NCI_EVT_TRANSACTION        0x12
  64
  65 #define ST_NCI_DM_GETINFO             0x13
  66 #define ST_NCI_DM_GETINFO_PIPE_LIST   0x02
  67 #define ST_NCI_DM_GETINFO_PIPE_INFO   0x01
  68 #define ST_NCI_DM_PIPE_CREATED        0x02
  69 #define ST_NCI_DM_PIPE_OPEN           0x04
  70 #define ST_NCI_DM_RF_ACTIVE           0x80
  71 #define ST_NCI_DM_DISCONNECT          0x30
  72
  73 #define ST_NCI_DM_IS_PIPE_OPEN(p) \
  74         ((p & 0x0f) == (ST_NCI_DM_PIPE_CREATED | ST_NCI_DM_PIPE_OPEN))
  75
  76 #define ST_NCI_ATR_DEFAULT_BWI        0x04
  77
  78 /*
  79  * WT = 2^BWI/10[s], convert into msecs and add a secure
  80  * room by increasing by 2 this timeout
  81  */
  82 #define ST_NCI_BWI_TO_TIMEOUT(x)      ((1 << x) * 200)
  83 #define ST_NCI_ATR_GET_Y_FROM_TD(x)   (x >> 4)
  84
  85 /* If TA is present bit 0 is set */
  86 #define ST_NCI_ATR_TA_PRESENT(x) (x & 0x01)
  87 /* If TB is present bit 1 is set */
  88 #define ST_NCI_ATR_TB_PRESENT(x) (x & 0x02)
  89
  90 #define ST_NCI_NUM_DEVICES           256
  91
  92 static DECLARE_BITMAP(dev_mask, ST_NCI_NUM_DEVICES);
  93
  94 /* Here are the mandatory pipe for st_nci */
  95 static struct nci_hci_gate st_nci_gates[] = {
  96         {NCI_HCI_ADMIN_GATE, NCI_HCI_ADMIN_PIPE,
  97                                         ST_NCI_HOST_CONTROLLER_ID},
  98         {NCI_HCI_LINK_MGMT_GATE, NCI_HCI_LINK_MGMT_PIPE,
  99                                         ST_NCI_HOST_CONTROLLER_ID},
 100         {ST_NCI_DEVICE_MGNT_GATE, ST_NCI_DEVICE_MGNT_PIPE,
 101                                         ST_NCI_HOST_CONTROLLER_ID},
 102
 103         {NCI_HCI_IDENTITY_MGMT_GATE, NCI_HCI_INVALID_PIPE,
 104                                         ST_NCI_HOST_CONTROLLER_ID},
 105
 106         /* Secure element pipes are created by secure element host */
 107         {ST_NCI_CONNECTIVITY_GATE, NCI_HCI_DO_NOT_OPEN_PIPE,
 108                                         ST_NCI_HOST_CONTROLLER_ID},
 109         {ST_NCI_APDU_READER_GATE, NCI_HCI_DO_NOT_OPEN_PIPE,
 110                                         ST_NCI_HOST_CONTROLLER_ID},
 111 };
 112
 113 static u8 st_nci_se_get_bwi(struct nci_dev *ndev)
 114 {
 115         int i;
 116         u8 td;
 117         struct st_nci_info *info = nci_get_drvdata(ndev);
 118
 119         /* Bits 8 to 5 of the first TB for T=1 encode BWI from zero to nine */
 120         for (i = 1; i < ST_NCI_ESE_MAX_LENGTH; i++) {
 121                 td = ST_NCI_ATR_GET_Y_FROM_TD(info->se_info.atr[i]);
 122                 if (ST_NCI_ATR_TA_PRESENT(td))
 123                         i++;
 124                 if (ST_NCI_ATR_TB_PRESENT(td)) {
 125                         i++;
 126                         return info->se_info.atr[i] >> 4;
 127                 }
 128         }
 129         return ST_NCI_ATR_DEFAULT_BWI;
 130 }
 131
 132 static void st_nci_se_get_atr(struct nci_dev *ndev)
 133 {
 134         struct st_nci_info *info = nci_get_drvdata(ndev);
 135         int r;
 136         struct sk_buff *skb;
 137
 138         r = nci_hci_get_param(ndev, ST_NCI_APDU_READER_GATE,
 139                                 NCI_HCI_APDU_PARAM_ATR, &skb);
 140         if (r < 0)
 141                 return;
 142
 143         if (skb->len <= ST_NCI_ESE_MAX_LENGTH) {
 144                 memcpy(info->se_info.atr, skb->data, skb->len);
 145
 146                 info->se_info.wt_timeout =
 147                         ST_NCI_BWI_TO_TIMEOUT(st_nci_se_get_bwi(ndev));
 148         }
 149         kfree_skb(skb);
 150 }
 151
 152 int st_nci_hci_load_session(struct nci_dev *ndev)
 153 {
 154         int i, j, r;
 155         struct sk_buff *skb_pipe_list, *skb_pipe_info;
 156         struct st_nci_pipe_info *dm_pipe_info;
 157         u8 pipe_list[] = { ST_NCI_DM_GETINFO_PIPE_LIST,
 158                         ST_NCI_TERMINAL_HOST_ID};
 159         u8 pipe_info[] = { ST_NCI_DM_GETINFO_PIPE_INFO,
 160                         ST_NCI_TERMINAL_HOST_ID, 0};
 161
 162         /* On ST_NCI device pipes number are dynamics
 163          * If pipes are already created, hci_dev_up will fail.
 164          * Doing a clear all pipe is a bad idea because:
 165          * - It does useless EEPROM cycling
 166          * - It might cause issue for secure elements support
 167          * (such as removing connectivity or APDU reader pipe)
 168          * A better approach on ST_NCI is to:
 169          * - get a pipe list for each host.
 170          * (eg: ST_NCI_HOST_CONTROLLER_ID for now).
 171          * (TODO Later on UICC HOST and eSE HOST)
 172          * - get pipe information
 173          * - match retrieved pipe list in st_nci_gates
 174          * ST_NCI_DEVICE_MGNT_GATE is a proprietary gate
 175          * with ST_NCI_DEVICE_MGNT_PIPE.
 176          * Pipe can be closed and need to be open.
 177          */
 178         r = nci_hci_connect_gate(ndev, ST_NCI_HOST_CONTROLLER_ID,
 179                                 ST_NCI_DEVICE_MGNT_GATE,
 180                                 ST_NCI_DEVICE_MGNT_PIPE);
 181         if (r < 0)
 182                 return r;
 183
 184         /* Get pipe list */
 185         r = nci_hci_send_cmd(ndev, ST_NCI_DEVICE_MGNT_GATE,
 186                         ST_NCI_DM_GETINFO, pipe_list, sizeof(pipe_list),
 187                         &skb_pipe_list);
 188         if (r < 0)
 189                 return r;
 190
 191         /* Complete the existing gate_pipe table */
 192         for (i = 0; i < skb_pipe_list->len; i++) {
 193                 pipe_info[2] = skb_pipe_list->data[i];
 194                 r = nci_hci_send_cmd(ndev, ST_NCI_DEVICE_MGNT_GATE,
 195                                         ST_NCI_DM_GETINFO, pipe_info,
 196                                         sizeof(pipe_info), &skb_pipe_info);
 197
 198                 if (r)
 199                         continue;
 200
 201                 /*
 202                  * Match pipe ID and gate ID
 203                  * Output format from ST21NFC_DM_GETINFO is:
 204                  * - pipe state (1byte)
 205                  * - source hid (1byte)
 206                  * - source gid (1byte)
 207                  * - destination hid (1byte)
 208                  * - destination gid (1byte)
 209                  */
 210                 dm_pipe_info = (struct st_nci_pipe_info *)skb_pipe_info->data;
 211                 if (dm_pipe_info->dst_gate_id == ST_NCI_APDU_READER_GATE &&
 212                     dm_pipe_info->src_host_id == ST_NCI_UICC_HOST_ID) {
 213                         pr_err("Unexpected apdu_reader pipe on host %x\n",
 214                                dm_pipe_info->src_host_id);
 215                         kfree_skb(skb_pipe_info);
 216                         continue;
 217                 }
 218
 219                 for (j = 3; (j < ARRAY_SIZE(st_nci_gates)) &&
 220                      (st_nci_gates[j].gate != dm_pipe_info->dst_gate_id); j++)
 221                         ;
 222
 223                 if (j < ARRAY_SIZE(st_nci_gates) &&
 224                     st_nci_gates[j].gate == dm_pipe_info->dst_gate_id &&
 225                     ST_NCI_DM_IS_PIPE_OPEN(dm_pipe_info->pipe_state)) {
 226                         ndev->hci_dev->init_data.gates[j].pipe = pipe_info[2];
 227
 228                         ndev->hci_dev->gate2pipe[st_nci_gates[j].gate] =
 229                                                 pipe_info[2];
 230                         ndev->hci_dev->pipes[pipe_info[2]].gate =
 231                                                 st_nci_gates[j].gate;
 232                         ndev->hci_dev->pipes[pipe_info[2]].host =
 233                                                 dm_pipe_info->src_host_id;
 234                 }
 235                 kfree_skb(skb_pipe_info);
 236         }
 237
 238         /*
 239          * 3 gates have a well known pipe ID. Only NCI_HCI_LINK_MGMT_GATE
 240          * is not yet open at this stage.
 241          */
 242         r = nci_hci_connect_gate(ndev, ST_NCI_HOST_CONTROLLER_ID,
 243                                  NCI_HCI_LINK_MGMT_GATE,
 244                                  NCI_HCI_LINK_MGMT_PIPE);
 245
 246         kfree_skb(skb_pipe_list);
 247         return r;
 248 }
 249 EXPORT_SYMBOL_GPL(st_nci_hci_load_session);
 250
 251 static void st_nci_hci_admin_event_received(struct nci_dev *ndev,
 252                                               u8 event, struct sk_buff *skb)
 253 {
 254         struct st_nci_info *info = nci_get_drvdata(ndev);
 255
 256         switch (event) {
 257         case ST_NCI_EVT_HOT_PLUG:
 258                 if (info->se_info.se_active) {
 259                         if (!ST_NCI_EVT_HOT_PLUG_IS_INHIBITED(skb)) {
 260                                 del_timer_sync(&info->se_info.se_active_timer);
 261                                 info->se_info.se_active = false;
 262                                 complete(&info->se_info.req_completion);
 263                         } else {
 264                                 mod_timer(&info->se_info.se_active_timer,
 265                                       jiffies +
 266                                       msecs_to_jiffies(ST_NCI_SE_TO_PIPES));
 267                         }
 268                 }
 269         break;
 270         default:
 271                 nfc_err(&ndev->nfc_dev->dev, "Unexpected event on admin gate\n");
 272         }
 273 }
 274
 275 static int st_nci_hci_apdu_reader_event_received(struct nci_dev *ndev,
 276                                                    u8 event,
 277                                                    struct sk_buff *skb)
 278 {
 279         int r = 0;
 280         struct st_nci_info *info = nci_get_drvdata(ndev);
 281
 282         pr_debug("apdu reader gate event: %x\n", event);
 283
 284         switch (event) {
 285         case ST_NCI_EVT_TRANSMIT_DATA:
 286                 del_timer_sync(&info->se_info.bwi_timer);
 287                 info->se_info.bwi_active = false;
 288                 info->se_info.cb(info->se_info.cb_context,
 289                                  skb->data, skb->len, 0);
 290         break;
 291         case ST_NCI_EVT_WTX_REQUEST:
 292                 mod_timer(&info->se_info.bwi_timer, jiffies +
 293                           msecs_to_jiffies(info->se_info.wt_timeout));
 294         break;
 295         default:
 296                 nfc_err(&ndev->nfc_dev->dev, "Unexpected event on apdu reader gate\n");
 297                 return 1;
 298         }
 299
 300         kfree_skb(skb);
 301         return r;
 302 }
 303
 304 /*
 305  * Returns:
 306  * <= 0: driver handled the event, skb consumed
 307  *    1: driver does not handle the event, please do standard processing
 308  */
 309 static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,
 310                                                 u8 host, u8 event,
 311                                                 struct sk_buff *skb)
 312 {
 313         int r = 0;
 314         struct device *dev = &ndev->nfc_dev->dev;
 315         struct nfc_evt_transaction *transaction;
 316
 317         pr_debug("connectivity gate event: %x\n", event);
 318
 319         switch (event) {
 320         case ST_NCI_EVT_CONNECTIVITY:
 321                 r = nfc_se_connectivity(ndev->nfc_dev, host);
 322         break;
 323         case ST_NCI_EVT_TRANSACTION:
 324                 /* According to specification etsi 102 622
 325                  * 11.2.2.4 EVT_TRANSACTION Table 52
 326                  * Description  Tag     Length
 327                  * AID          81      5 to 16
 328                  * PARAMETERS   82      0 to 255
 329                  */
 330                 if (skb->len < NFC_MIN_AID_LENGTH + 2 &&
 331                     skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)
 332                         return -EPROTO;
 333
 334                 transaction = devm_kzalloc(dev, skb->len - 2, GFP_KERNEL);
 335                 if (!transaction)
 336                         return -ENOMEM;
 337
 338                 transaction->aid_len = skb->data[1];
 339                 memcpy(transaction->aid, &skb->data[2], transaction->aid_len);
 340
 341                 /* Check next byte is PARAMETERS tag (82) */
 342                 if (skb->data[transaction->aid_len + 2] !=
 343                     NFC_EVT_TRANSACTION_PARAMS_TAG)
 344                         return -EPROTO;
 345
 346                 transaction->params_len = skb->data[transaction->aid_len + 3];
 347                 memcpy(transaction->params, skb->data +
 348                        transaction->aid_len + 4, transaction->params_len);
 349
 350                 r = nfc_se_transaction(ndev->nfc_dev, host, transaction);
 351                 break;
 352         default:
 353                 nfc_err(&ndev->nfc_dev->dev, "Unexpected event on connectivity gate\n");
 354                 return 1;
 355         }
 356         kfree_skb(skb);
 357         return r;
 358 }
 359
 360 void st_nci_hci_event_received(struct nci_dev *ndev, u8 pipe,
 361                                  u8 event, struct sk_buff *skb)
 362 {
 363         u8 gate = ndev->hci_dev->pipes[pipe].gate;
 364         u8 host = ndev->hci_dev->pipes[pipe].host;
 365
 366         switch (gate) {
 367         case NCI_HCI_ADMIN_GATE:
 368                 st_nci_hci_admin_event_received(ndev, event, skb);
 369         break;
 370         case ST_NCI_APDU_READER_GATE:
 371                 st_nci_hci_apdu_reader_event_received(ndev, event, skb);
 372         break;
 373         case ST_NCI_CONNECTIVITY_GATE:
 374                 st_nci_hci_connectivity_event_received(ndev, host, event, skb);
 375         break;
 376         }
 377 }
 378 EXPORT_SYMBOL_GPL(st_nci_hci_event_received);
 379
 380 void st_nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe, u8 cmd,
 381                                struct sk_buff *skb)
 382 {
 383         struct st_nci_info *info = nci_get_drvdata(ndev);
 384         u8 gate = ndev->hci_dev->pipes[pipe].gate;
 385
 386         pr_debug("cmd: %x\n", cmd);
 387
 388         switch (cmd) {
 389         case NCI_HCI_ANY_OPEN_PIPE:
 390                 if (gate != ST_NCI_APDU_READER_GATE &&
 391                     ndev->hci_dev->pipes[pipe].host != ST_NCI_UICC_HOST_ID)
 392                         ndev->hci_dev->count_pipes++;
 393
 394                 if (ndev->hci_dev->count_pipes ==
 395                     ndev->hci_dev->expected_pipes) {
 396                         del_timer_sync(&info->se_info.se_active_timer);
 397                         info->se_info.se_active = false;
 398                         ndev->hci_dev->count_pipes = 0;
 399                         complete(&info->se_info.req_completion);
 400                 }
 401         break;
 402         }
 403 }
 404 EXPORT_SYMBOL_GPL(st_nci_hci_cmd_received);
 405
 406 static int st_nci_control_se(struct nci_dev *ndev, u8 se_idx,
 407                              u8 state)
 408 {
 409         struct st_nci_info *info = nci_get_drvdata(ndev);
 410         int r, i;
 411         struct sk_buff *sk_host_list;
 412         u8 host_id;
 413
 414         switch (se_idx) {
 415         case ST_NCI_UICC_HOST_ID:
 416                 ndev->hci_dev->count_pipes = 0;
 417                 ndev->hci_dev->expected_pipes = ST_NCI_SE_COUNT_PIPE_UICC;
 418                 break;
 419         case ST_NCI_ESE_HOST_ID:
 420                 ndev->hci_dev->count_pipes = 0;
 421                 ndev->hci_dev->expected_pipes = ST_NCI_SE_COUNT_PIPE_EMBEDDED;
 422                 break;
 423         default:
 424                 return -EINVAL;
 425         }
 426
 427         /*
 428          * Wait for an EVT_HOT_PLUG in order to
 429          * retrieve a relevant host list.
 430          */
 431         reinit_completion(&info->se_info.req_completion);
 432         r = nci_nfcee_mode_set(ndev, se_idx, state);
 433         if (r != NCI_STATUS_OK)
 434                 return r;
 435
 436         mod_timer(&info->se_info.se_active_timer, jiffies +
 437                 msecs_to_jiffies(ST_NCI_SE_TO_HOT_PLUG));
 438         info->se_info.se_active = true;
 439
 440         /* Ignore return value and check in any case the host_list */
 441         wait_for_completion_interruptible(&info->se_info.req_completion);
 442
 443         /* There might be some "collision" after receiving a HOT_PLUG event
 444          * This may cause the CLF to not answer to the next hci command.
 445          * There is no possible synchronization to prevent this.
 446          * Adding a small delay is the only way to solve the issue.
 447          */
 448         if (info->se_info.se_status->is_ese_present &&
 449             info->se_info.se_status->is_uicc_present)
 450                 usleep_range(15000, 20000);
 451
 452         r = nci_hci_get_param(ndev, NCI_HCI_ADMIN_GATE,
 453                         NCI_HCI_ADMIN_PARAM_HOST_LIST, &sk_host_list);
 454         if (r != NCI_HCI_ANY_OK)
 455                 return r;
 456
 457         for (i = 0; i < sk_host_list->len &&
 458                 sk_host_list->data[i] != se_idx; i++)
 459                 ;
 460         host_id = sk_host_list->data[i];
 461         kfree_skb(sk_host_list);
 462         if (state == ST_NCI_SE_MODE_ON && host_id == se_idx)
 463                 return se_idx;
 464         else if (state == ST_NCI_SE_MODE_OFF && host_id != se_idx)
 465                 return se_idx;
 466
 467         return -1;
 468 }
 469
 470 int st_nci_disable_se(struct nci_dev *ndev, u32 se_idx)
 471 {
 472         int r;
 473
 474         pr_debug("st_nci_disable_se\n");
 475
 476         /*
 477          * According to upper layer, se_idx == NFC_SE_UICC when
 478          * info->se_info.se_status->is_uicc_enable is true should never happen
 479          * Same for eSE.
 480          */
 481         r = st_nci_control_se(ndev, se_idx, ST_NCI_SE_MODE_OFF);
 482         if (r < 0) {
 483                 /* Do best effort to release SWP */
 484                 if (se_idx == NFC_SE_EMBEDDED) {
 485                         r = nci_hci_send_event(ndev, ST_NCI_APDU_READER_GATE,
 486                                         ST_NCI_EVT_SE_END_OF_APDU_TRANSFER,
 487                                         NULL, 0);
 488                 }
 489                 return r;
 490         }
 491
 492         return 0;
 493 }
 494 EXPORT_SYMBOL_GPL(st_nci_disable_se);
 495
 496 int st_nci_enable_se(struct nci_dev *ndev, u32 se_idx)
 497 {
 498         int r;
 499
 500         pr_debug("st_nci_enable_se\n");
 501
 502         /*
 503          * According to upper layer, se_idx == NFC_SE_UICC when
 504          * info->se_info.se_status->is_uicc_enable is true should never happen.
 505          * Same for eSE.
 506          */
 507         r = st_nci_control_se(ndev, se_idx, ST_NCI_SE_MODE_ON);
 508         if (r == ST_NCI_ESE_HOST_ID) {
 509                 st_nci_se_get_atr(ndev);
 510                 r = nci_hci_send_event(ndev, ST_NCI_APDU_READER_GATE,
 511                                 ST_NCI_EVT_SE_SOFT_RESET, NULL, 0);
 512         }
 513
 514         if (r < 0) {
 515                 /*
 516                  * The activation procedure failed, the secure element
 517                  * is not connected. Remove from the list.
 518                  */
 519                 nfc_remove_se(ndev->nfc_dev, se_idx);
 520                 return r;
 521         }
 522
 523         return 0;
 524 }
 525 EXPORT_SYMBOL_GPL(st_nci_enable_se);
 526
 527 static int st_nci_hci_network_init(struct nci_dev *ndev)
 528 {
 529         struct st_nci_info *info = nci_get_drvdata(ndev);
 530         struct core_conn_create_dest_spec_params *dest_params;
 531         struct dest_spec_params spec_params;
 532         struct nci_conn_info    *conn_info;
 533         int r, dev_num;
 534
 535         dest_params =
 536                 kzalloc(sizeof(struct core_conn_create_dest_spec_params) +
 537                         sizeof(struct dest_spec_params), GFP_KERNEL);
 538         if (dest_params == NULL) {
 539                 r = -ENOMEM;
 540                 goto exit;
 541         }
 542
 543         dest_params->type = NCI_DESTINATION_SPECIFIC_PARAM_NFCEE_TYPE;
 544         dest_params->length = sizeof(struct dest_spec_params);
 545         spec_params.id = ndev->hci_dev->nfcee_id;
 546         spec_params.protocol = NCI_NFCEE_INTERFACE_HCI_ACCESS;
 547         memcpy(dest_params->value, &spec_params,
 548                sizeof(struct dest_spec_params));
 549         r = nci_core_conn_create(ndev, NCI_DESTINATION_NFCEE, 1,
 550                                  sizeof(struct core_conn_create_dest_spec_params) +
 551                                  sizeof(struct dest_spec_params),
 552                                  dest_params);
 553         if (r != NCI_STATUS_OK)
 554                 goto free_dest_params;
 555
 556         conn_info = ndev->hci_dev->conn_info;
 557         if (!conn_info)
 558                 goto free_dest_params;
 559
 560         ndev->hci_dev->init_data.gate_count = ARRAY_SIZE(st_nci_gates);
 561         memcpy(ndev->hci_dev->init_data.gates, st_nci_gates,
 562                sizeof(st_nci_gates));
 563
 564         /*
 565          * Session id must include the driver name + i2c bus addr
 566          * persistent info to discriminate 2 identical chips
 567          */
 568         dev_num = find_first_zero_bit(dev_mask, ST_NCI_NUM_DEVICES);
 569         if (dev_num >= ST_NCI_NUM_DEVICES) {
 570                 r = -ENODEV;
 571                 goto free_dest_params;
 572         }
 573
 574         scnprintf(ndev->hci_dev->init_data.session_id,
 575                   sizeof(ndev->hci_dev->init_data.session_id),
 576                   "%s%2x", "ST21BH", dev_num);
 577
 578         r = nci_hci_dev_session_init(ndev);
 579         if (r != NCI_HCI_ANY_OK)
 580                 goto free_dest_params;
 581
 582         /*
 583          * In factory mode, we prevent secure elements activation
 584          * by disabling nfcee on the current HCI connection id.
 585          * HCI will be used here only for proprietary commands.
 586          */
 587         if (test_bit(ST_NCI_FACTORY_MODE, &info->flags))
 588                 r = nci_nfcee_mode_set(ndev,
 589                                        ndev->hci_dev->conn_info->dest_params->id,
 590                                        NCI_NFCEE_DISABLE);
 591         else
 592                 r = nci_nfcee_mode_set(ndev,
 593                                        ndev->hci_dev->conn_info->dest_params->id,
 594                                        NCI_NFCEE_ENABLE);
 595
 596 free_dest_params:
 597         kfree(dest_params);
 598
 599 exit:
 600         return r;
 601 }
 602
 603 int st_nci_discover_se(struct nci_dev *ndev)
 604 {
 605         u8 white_list[2];
 606         int r, wl_size = 0;
 607         int se_count = 0;
 608         struct st_nci_info *info = nci_get_drvdata(ndev);
 609
 610         pr_debug("st_nci_discover_se\n");
 611
 612         r = st_nci_hci_network_init(ndev);
 613         if (r != 0)
 614                 return r;
 615
 616         if (test_bit(ST_NCI_FACTORY_MODE, &info->flags))
 617                 return 0;
 618
 619         if (info->se_info.se_status->is_uicc_present)
 620                 white_list[wl_size++] = ST_NCI_UICC_HOST_ID;
 621         if (info->se_info.se_status->is_ese_present)
 622                 white_list[wl_size++] = ST_NCI_ESE_HOST_ID;
 623
 624         if (wl_size) {
 625                 r = nci_hci_set_param(ndev, NCI_HCI_ADMIN_GATE,
 626                                       NCI_HCI_ADMIN_PARAM_WHITELIST,
 627                                       white_list, wl_size);
 628                 if (r != NCI_HCI_ANY_OK)
 629                         return r;
 630         }
 631
 632         if (info->se_info.se_status->is_uicc_present) {
 633                 nfc_add_se(ndev->nfc_dev, ST_NCI_UICC_HOST_ID, NFC_SE_UICC);
 634                 se_count++;
 635         }
 636
 637         if (info->se_info.se_status->is_ese_present) {
 638                 nfc_add_se(ndev->nfc_dev, ST_NCI_ESE_HOST_ID, NFC_SE_EMBEDDED);
 639                 se_count++;
 640         }
 641
 642         return !se_count;
 643 }
 644 EXPORT_SYMBOL_GPL(st_nci_discover_se);
 645
 646 int st_nci_se_io(struct nci_dev *ndev, u32 se_idx,
 647                        u8 *apdu, size_t apdu_length,
 648                        se_io_cb_t cb, void *cb_context)
 649 {
 650         struct st_nci_info *info = nci_get_drvdata(ndev);
 651
 652         pr_debug("\n");
 653
 654         switch (se_idx) {
 655         case ST_NCI_ESE_HOST_ID:
 656                 info->se_info.cb = cb;
 657                 info->se_info.cb_context = cb_context;
 658                 mod_timer(&info->se_info.bwi_timer, jiffies +
 659                           msecs_to_jiffies(info->se_info.wt_timeout));
 660                 info->se_info.bwi_active = true;
 661                 return nci_hci_send_event(ndev, ST_NCI_APDU_READER_GATE,
 662                                         ST_NCI_EVT_TRANSMIT_DATA, apdu,
 663                                         apdu_length);
 664         default:
 665                 return -ENODEV;
 666         }
 667 }
 668 EXPORT_SYMBOL(st_nci_se_io);
 669
 670 static void st_nci_se_wt_timeout(struct timer_list *t)
 671 {
 672         /*
 673          * No answer from the secure element
 674          * within the defined timeout.
 675          * Let's send a reset request as recovery procedure.
 676          * According to the situation, we first try to send a software reset
 677          * to the secure element. If the next command is still not
 678          * answering in time, we send to the CLF a secure element hardware
 679          * reset request.
 680          */
 681         /* hardware reset managed through VCC_UICC_OUT power supply */
 682         u8 param = 0x01;
 683         struct st_nci_info *info = from_timer(info, t, se_info.bwi_timer);
 684
 685         pr_debug("\n");
 686
 687         info->se_info.bwi_active = false;
 688
 689         if (!info->se_info.xch_error) {
 690                 info->se_info.xch_error = true;
 691                 nci_hci_send_event(info->ndlc->ndev, ST_NCI_APDU_READER_GATE,
 692                                 ST_NCI_EVT_SE_SOFT_RESET, NULL, 0);
 693         } else {
 694                 info->se_info.xch_error = false;
 695                 nci_hci_send_event(info->ndlc->ndev, ST_NCI_DEVICE_MGNT_GATE,
 696                                 ST_NCI_EVT_SE_HARD_RESET, &param, 1);
 697         }
 698         info->se_info.cb(info->se_info.cb_context, NULL, 0, -ETIME);
 699 }
 700
 701 static void st_nci_se_activation_timeout(struct timer_list *t)
 702 {
 703         struct st_nci_info *info = from_timer(info, t,
 704                                               se_info.se_active_timer);
 705
 706         pr_debug("\n");
 707
 708         info->se_info.se_active = false;
 709
 710         complete(&info->se_info.req_completion);
 711 }
 712
 713 int st_nci_se_init(struct nci_dev *ndev, struct st_nci_se_status *se_status)
 714 {
 715         struct st_nci_info *info = nci_get_drvdata(ndev);
 716
 717         init_completion(&info->se_info.req_completion);
 718         /* initialize timers */
 719         timer_setup(&info->se_info.bwi_timer, st_nci_se_wt_timeout, 0);
 720         info->se_info.bwi_active = false;
 721
 722         timer_setup(&info->se_info.se_active_timer,
 723                     st_nci_se_activation_timeout, 0);
 724         info->se_info.se_active = false;
 725
 726         info->se_info.xch_error = false;
 727
 728         info->se_info.wt_timeout =
 729                 ST_NCI_BWI_TO_TIMEOUT(ST_NCI_ATR_DEFAULT_BWI);
 730
 731         info->se_info.se_status = se_status;
 732
 733         return 0;
 734 }
 735 EXPORT_SYMBOL(st_nci_se_init);
 736
 737 void st_nci_se_deinit(struct nci_dev *ndev)
 738 {
 739         struct st_nci_info *info = nci_get_drvdata(ndev);
 740
 741         if (info->se_info.bwi_active)
 742                 del_timer_sync(&info->se_info.bwi_timer);
 743         if (info->se_info.se_active)
 744                 del_timer_sync(&info->se_info.se_active_timer);
 745
 746         info->se_info.se_active = false;
 747         info->se_info.bwi_active = false;
 748 }
 749 EXPORT_SYMBOL(st_nci_se_deinit);
 750