plugins/nfctype3.c

   1 /*
   2  *
   3  *  neard - Near Field Communication manager
   4  *
   5  *  Copyright (C) 2011  Intel Corporation. All rights reserved.
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License version 2 as
   9  *  published by the Free Software Foundation.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  19  *
  20  */
  21
  22 #ifdef HAVE_CONFIG_H
  23 #include <config.h>
  24 #endif
  25
  26 #include <stdint.h>
  27 #include <errno.h>
  28 #include <stdbool.h>
  29 #include <string.h>
  30 #include <sys/socket.h>
  31
  32 #include <linux/socket.h>
  33
  34 #include <near/nfc_copy.h>
  35 #include <near/plugin.h>
  36 #include <near/log.h>
  37 #include <near/types.h>
  38 #include <near/adapter.h>
  39 #include <near/tag.h>
  40 #include <near/ndef.h>
  41 #include <near/tlv.h>
  42
  43 #define CMD_POLL                0x00
  44 #define RESP_POLL               0x01
  45
  46 #define CMD_REQUEST_SERVICE     0x02
  47 #define RESP_REQUEST_SERVICE    0x03
  48
  49 #define CMD_REQUEST_RESPONSE    0x04
  50 #define RESP_REQUEST_RESPONSE   0x05
  51
  52 #define CMD_READ_WO_ENCRYPT     0x06
  53 #define RESP_READ_WO_ENCRYPT    0x07
  54
  55 #define CMD_WRITE_WO_ENCRYPT    0x08
  56 #define RESP_WRITE_WO_ENCRYPT   0x09
  57
  58 #define CMD_REQUEST_SYS_CODE    0x0C
  59 #define RESP_REQUEST_SYS_CODE   0x0D
  60
  61 #define CMD_AUTHENTICATION_1    0x10
  62 #define RESP_AUTHENTICATION_1   0x11
  63
  64 #define CMD_AUTHENTICATION_2    0x12
  65 #define RESP_AUTHENTICATION_2   0x13
  66
  67 #define CMD_READ                0x14
  68 #define RESP_READ               0x15
  69
  70 #define CMD_WRITE               0x16
  71 #define RESP_WRITE              0x17
  72
  73 #define NFC_SERVICE_CODE        0x000B
  74 #define BLOCK_SIZE              16
  75 #define META_BLOCK_START        0
  76 #define DATA_BLOCK_START        1
  77
  78 #define LEN_ID                  0x08
  79 #define LEN_CMD                 0x01
  80 #define LEN_REPLY_CMD           0x02
  81 #define LEN_CMD_LEN             0x01
  82
  83 /* offsets */
  84 #define OFS_NFC_STATUS  0
  85 #define OFS_NFC_LEN     1
  86 #define OFS_CMD_RESP    2
  87 #define OFS_IDM         3
  88 #define OFS_CMD_DATA    (LEN_CMD_LEN + LEN_CMD + LEN_ID)
  89 #define OFS_READ_FLAG   12
  90 #define OFS_READ_DATA   14
  91 #define BLOCK_SIZE      16
  92 #define CHECKSUM_LEN    2
  93
  94 #define MAX_DATA_SIZE   254
  95
  96 #define NDEF_MAPPING_VERSION    0x10
  97 #define MAX_READ_BLOCKS_PER_CHECK       0x04
  98 #define MAX_WRITE_BLOCKS_PER_UPDATE     0x01
  99 #define MAX_BLOCKS_FOR_NDEF_DATA        0x000D
 100 #define ATTR_BLOCK_WRITE_FLAG   0x00
 101 #define ATTR_BLOCK_RW_FLAG      0x01
 102
 103 #define IC_TYPE_OFFSET  12
 104 #define SYSTEM_OPTION_OFFSET    17
 105 #define FELICA_LITE_MC_BLOCK    0x88
 106 #define FELICA_LITE_IC_TYPE     0xF0
 107 #define FELICA_LITE_S_IC_TYPE   0xF1
 108 #define FELICA_PLUG_IC_TYPE     0xE0
 109
 110 #define FELICA_LITE_AND_LITE_S_SYS_CODE 0x88B4
 111
 112 struct type3_cmd {
 113         uint8_t len;
 114         uint8_t cmd;
 115         uint8_t data[MAX_DATA_SIZE];
 116 } __attribute__((packed));
 117
 118 struct type3_tag {
 119         uint32_t adapter_idx;
 120         uint16_t current_block;
 121         uint8_t IDm[LEN_ID];
 122
 123         near_tag_io_cb cb;
 124         struct near_tag *tag;
 125 };
 126
 127 struct t3_cookie {
 128         uint32_t adapter_idx;
 129         uint32_t target_idx;
 130         near_tag_io_cb cb;
 131         uint8_t IDm[LEN_ID];
 132         uint8_t current_block;
 133         uint8_t attr[BLOCK_SIZE];
 134         struct near_ndef_message *ndef;
 135         uint8_t ic_type;
 136         uint8_t mc_block[BLOCK_SIZE];
 137 };
 138
 139 static int t3_cookie_release(int err, void *data)
 140 {
 141         struct t3_cookie *cookie = data;
 142
 143         DBG("%p", cookie);
 144
 145         if (!cookie)
 146                 return err;
 147
 148         if (cookie->cb)
 149                 cookie->cb(cookie->adapter_idx, cookie->target_idx, err);
 150
 151         if (cookie->ndef)
 152                 g_free(cookie->ndef->data);
 153
 154         g_free(cookie->ndef);
 155         g_free(cookie);
 156         cookie = NULL;
 157
 158         return err;
 159 }
 160
 161 /* common: Initialize structure to write block */
 162 static void prepare_write_block(uint8_t *UID, struct type3_cmd *cmd,
 163                                         uint8_t block, uint8_t *data)
 164 {
 165         cmd->cmd = CMD_WRITE_WO_ENCRYPT;        /* command */
 166         memcpy(cmd->data, UID, LEN_ID);         /* IDm */
 167
 168         cmd->data[LEN_ID] = 1;                  /* number of services */
 169         cmd->data[LEN_ID + 1] = 0x09;           /* service 0x0009 */
 170         cmd->data[LEN_ID + 2] = 0x00;
 171
 172         cmd->data[LEN_ID + 3] = 0x01;           /* number of blocks */
 173         cmd->data[LEN_ID + 4] = 0x80;           /* 2 byte block number format */
 174         cmd->data[LEN_ID + 5] = block;          /* block number */
 175         memcpy(cmd->data + LEN_ID + 6, data, BLOCK_SIZE); /* data to write */
 176
 177         cmd->len = LEN_ID + LEN_CMD + LEN_CMD_LEN + 6 + BLOCK_SIZE;
 178 }
 179
 180 /* common: Initialize structure to read block */
 181 static void prepare_read_block(uint8_t cur_block,
 182                                 uint8_t *UID,
 183                                 struct type3_cmd *cmd)
 184 {
 185         cmd->cmd = CMD_READ_WO_ENCRYPT;                 /* command */
 186         memcpy(cmd->data, UID, LEN_ID);                 /* IDm */
 187
 188         cmd->data[LEN_ID] = 1;                          /* number of service */
 189         cmd->data[LEN_ID + 1] = 0x0B;                   /* service x000B */
 190         cmd->data[LEN_ID + 2] = 0x00;
 191
 192         cmd->data[LEN_ID + 3] = 0x01;                   /* number of block */
 193         cmd->data[LEN_ID + 4] = 0x80;                   /* 2 bytes block id*/
 194         cmd->data[LEN_ID + 5] = cur_block;              /* block number */
 195
 196         cmd->len = LEN_ID + LEN_CMD + LEN_CMD_LEN + 6;
 197 }
 198
 199 /* common: Simple checks on received frame */
 200 static int check_recv_frame(uint8_t *resp, uint8_t reply_code)
 201 {
 202         if (resp[OFS_NFC_STATUS] != 0) {
 203                 DBG("NFC Command failed: 0x%x", resp[OFS_NFC_STATUS]);
 204                 return -EIO;
 205         }
 206
 207         if (resp[OFS_CMD_RESP] != reply_code) {
 208                 DBG("Felica cmd failed: 0x%x", resp[OFS_CMD_RESP]);
 209                 return -EIO;
 210         }
 211
 212         return 0;
 213 }
 214
 215 static int data_recv(uint8_t *resp, int length, void *data)
 216 {
 217         struct type3_tag *tag = data;
 218         struct type3_cmd cmd;
 219         uint8_t *nfc_data;
 220         size_t current_length, length_read, data_length;
 221         uint32_t adapter_idx;
 222         uint32_t target_idx;
 223         int read_blocks;
 224         int err;
 225
 226         DBG("%d", length);
 227
 228         adapter_idx = near_tag_get_adapter_idx(tag->tag);
 229         target_idx = near_tag_get_target_idx(tag->tag);
 230
 231         if (length < 0) {
 232                 err = -EIO;
 233                 goto out_err;
 234         }
 235
 236         nfc_data = near_tag_get_data(tag->tag, &data_length);
 237         length_read = length - OFS_READ_DATA;
 238         current_length = tag->current_block * BLOCK_SIZE;
 239         if (current_length + (length - OFS_READ_DATA) > data_length)
 240                 length_read = data_length - current_length;
 241
 242         memcpy(nfc_data + current_length, resp + OFS_READ_DATA, length_read);
 243
 244         if (current_length + length_read >= data_length) {
 245                 GList *records;
 246
 247                 tag->current_block = 0;
 248
 249                 DBG("Done reading %zd bytes at %p", data_length, nfc_data);
 250                 records = near_ndef_parse_msg(nfc_data, data_length, NULL);
 251                 near_tag_add_records(tag->tag, records, tag->cb, 0);
 252
 253                 g_free(tag);
 254
 255                 return 0;
 256         }
 257
 258         /* Read the next block */
 259         read_blocks = length / BLOCK_SIZE;
 260         tag->current_block += read_blocks;
 261
 262         prepare_read_block(DATA_BLOCK_START + tag->current_block,
 263                                 tag->IDm, &cmd);
 264
 265         err = near_adapter_send(adapter_idx, (uint8_t *) &cmd, cmd.len,
 266                                 data_recv, tag, NULL);
 267
 268         if (err < 0)
 269                 goto out_err;
 270
 271         return 0;
 272
 273 out_err:
 274         if (err < 0 && tag->cb)
 275                 tag->cb(adapter_idx, target_idx, err);
 276
 277         g_free(tag);
 278
 279         return err;
 280 }
 281
 282 static int data_read(struct type3_tag *tag)
 283 {
 284         struct type3_cmd cmd;
 285         uint32_t adapter_idx;
 286
 287         DBG("");
 288
 289         tag->current_block = 0;
 290
 291         prepare_read_block(DATA_BLOCK_START + tag->current_block,
 292                                                         tag->IDm, &cmd);
 293
 294         adapter_idx = near_tag_get_adapter_idx(tag->tag);
 295
 296         return near_adapter_send(adapter_idx,
 297                                         (uint8_t *) &cmd, cmd.len,
 298                                         data_recv, tag, NULL);
 299 }
 300
 301 /* Read block 0 to retrieve the data length */
 302 static int nfctype3_recv_block_0(uint8_t *resp, int length, void *data)
 303 {
 304         struct t3_cookie *cookie = data;
 305         int err = 0;
 306         struct near_tag *tag;
 307         struct type3_tag *t3_tag = NULL;
 308         uint32_t ndef_data_length;
 309
 310         DBG("%d", length);
 311
 312         if (length < 0) {
 313                 err = -EIO;
 314                 goto out_err;
 315         }
 316
 317         err = check_recv_frame(resp, RESP_READ_WO_ENCRYPT);
 318         if (err < 0)
 319                 goto out_err;
 320
 321         if (resp[OFS_READ_FLAG] != 0) {
 322                 DBG("Status 0x%x", resp[OFS_READ_FLAG]);
 323                 err = -EIO;
 324                 goto out_err;
 325         }
 326
 327         /* Block 0:[11 - 13]: length is a 3 bytes value */
 328         ndef_data_length =  resp[OFS_READ_DATA + 11] * 0x100;
 329         ndef_data_length += resp[OFS_READ_DATA + 12];
 330         ndef_data_length *= 0x100;
 331         ndef_data_length += resp[OFS_READ_DATA + 13];
 332
 333         /* Add data to the tag */
 334         err = near_tag_add_data(cookie->adapter_idx, cookie->target_idx,
 335                                         NULL, ndef_data_length);
 336         if (err < 0)
 337                 goto out_err;
 338
 339         tag = near_tag_get_tag(cookie->adapter_idx, cookie->target_idx);
 340         if (!tag) {
 341                 err = -ENOMEM;
 342                 goto out_err;
 343         }
 344
 345         /* Block 0:[10]: RW Flag. 1 for RW */
 346         if (resp[OFS_READ_DATA + 10] == 0)
 347                 near_tag_set_ro(tag, TRUE);
 348         else
 349                 near_tag_set_ro(tag, FALSE);
 350
 351         t3_tag = g_try_malloc0(sizeof(struct type3_tag));
 352         if (!t3_tag) {
 353                 err = -ENOMEM;
 354                 goto out_err;
 355         }
 356
 357         memcpy(t3_tag->IDm, cookie->IDm, LEN_ID);
 358
 359         near_tag_set_idm(tag, cookie->IDm, LEN_ID);
 360         near_tag_set_attr_block(tag, resp + OFS_READ_DATA, BLOCK_SIZE);
 361         near_tag_set_blank(tag, FALSE);
 362         near_tag_set_ic_type(tag, cookie->ic_type);
 363
 364         t3_tag->adapter_idx = cookie->adapter_idx;
 365         t3_tag->cb = cookie->cb;
 366         t3_tag->tag = tag;
 367
 368         err = data_read(t3_tag);
 369
 370         /*
 371          * As reading isn't complete,
 372          * callback shouldn't be called while freeing the cookie
 373          */
 374         if (err >= 0)
 375                 cookie->cb = NULL;
 376
 377 out_err:
 378         if (err < 0)
 379                 g_free(t3_tag);
 380
 381         return t3_cookie_release(err, cookie);
 382 }
 383
 384 static int poll_ndef_system_code(uint8_t *resp, int length, void *data)
 385 {
 386         struct t3_cookie *cookie = data;
 387         int err = 0;
 388         struct type3_cmd cmd;
 389
 390         DBG("length: %d", length);
 391
 392         if (length < 0) {
 393                 err = -EIO;
 394                 goto out_err;
 395         }
 396
 397         err = check_recv_frame(resp, RESP_POLL);
 398         if (err < 0)
 399                 goto out_err;
 400
 401         prepare_read_block(META_BLOCK_START, cookie->IDm, &cmd);
 402
 403         err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 404                                 cmd.len, nfctype3_recv_block_0, cookie, NULL);
 405         if (err < 0)
 406                 goto out_err;
 407
 408         return 0;
 409
 410 out_err:
 411         return t3_cookie_release(err, cookie);
 412 }
 413
 414 static int check_sys_op_in_mc_block(uint8_t *resp, int length, void *data)
 415 {
 416         struct type3_cmd cmd;
 417         struct near_tag *tag;
 418         struct t3_cookie *cookie = data;
 419         int err = 0;
 420
 421         DBG("length %d", length);
 422
 423         if (length < 0) {
 424                 err = -EIO;
 425                 goto out_err;
 426         }
 427
 428         err = check_recv_frame(resp, RESP_READ_WO_ENCRYPT);
 429         if (err < 0)
 430                 goto out_err;
 431
 432         if (resp[SYSTEM_OPTION_OFFSET] == 0x00) {
 433                 DBG("Blank tag detected");
 434
 435                 err = near_tag_add_data(cookie->adapter_idx,
 436                                         cookie->target_idx,
 437                                         NULL, 1 /* dummy length */);
 438                 if (err < 0)
 439                         goto out_err;
 440
 441                 tag = near_tag_get_tag(cookie->adapter_idx,
 442                                         cookie->target_idx);
 443                 if (!tag) {
 444                         err = -ENOMEM;
 445                 goto out_err;
 446                 }
 447
 448                 near_tag_set_idm(tag, cookie->IDm, LEN_ID);
 449                 near_tag_set_ic_type(tag, cookie->ic_type);
 450                 near_tag_set_blank(tag, TRUE);
 451
 452                 return t3_cookie_release(0, cookie);
 453         } else {
 454                 /* CMD POLL */
 455                 cmd.cmd  = CMD_POLL;    /* POLL command */
 456                 cmd.data[0] = 0x12;     /* System code (NFC SC) */
 457                 cmd.data[1] = 0xFC;
 458                 cmd.data[2] = 01;       /* request code */
 459                 cmd.data[3] = 0x00;     /* time slot */
 460                 /* data len + 2 bytes */
 461                 cmd.len = LEN_CMD + LEN_CMD_LEN + 4 ;
 462
 463                 err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 464                         cmd.len , poll_ndef_system_code, cookie, NULL);
 465         }
 466
 467         if (err < 0)
 468                 goto out_err;
 469
 470         return 0;
 471
 472 out_err:
 473         return t3_cookie_release(err, cookie);
 474 }
 475
 476 static int receive_system_code(uint8_t *resp, int length, void *data)
 477 {
 478         struct t3_cookie *cookie = data;
 479         int err = 0;
 480         struct type3_cmd cmd;
 481
 482         DBG("length: %d", length);
 483
 484         if (length < 0) {
 485                 err = -EIO;
 486                 goto out_err;
 487         }
 488
 489         err = check_recv_frame(resp, RESP_POLL);
 490         if (err < 0)
 491                 goto out_err;
 492
 493         cookie->ic_type = resp[IC_TYPE_OFFSET];
 494         memcpy(cookie->IDm, resp + OFS_IDM, LEN_ID);
 495
 496         switch (resp[IC_TYPE_OFFSET]) {
 497         case FELICA_LITE_IC_TYPE:
 498                 prepare_read_block(FELICA_LITE_MC_BLOCK, cookie->IDm, &cmd);
 499                 err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 500                                         cmd.len, check_sys_op_in_mc_block,
 501                                         cookie, NULL);
 502                 break;
 503
 504         default:
 505                 /* CMD POLL */
 506                 cmd.cmd  = CMD_POLL;    /* POLL command */
 507                 cmd.data[0] = 0x12;     /* System code (NFC SC) */
 508                 cmd.data[1] = 0xFC;
 509                 cmd.data[2] = 01;       /* request code */
 510                 cmd.data[3] = 0x00;     /* time slot */
 511                 /* data len + 2 bytes */
 512                 cmd.len = LEN_CMD + LEN_CMD_LEN + 4 ;
 513
 514                 err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 515                                         cmd.len, poll_ndef_system_code, cookie,
 516                                         NULL);
 517         }
 518
 519         if (err < 0)
 520                 goto out_err;
 521
 522         return 0;
 523
 524 out_err:
 525         return t3_cookie_release(err, cookie);
 526 }
 527
 528 static int nfctype3_read(uint32_t adapter_idx,
 529                                 uint32_t target_idx, near_tag_io_cb cb)
 530 {
 531         struct type3_cmd cmd;
 532         struct t3_cookie *cookie;
 533
 534         DBG("");
 535
 536         /* CMD POLL */
 537         cmd.cmd  = CMD_POLL;    /* POLL command */
 538         cmd.data[0] = 0xFF;     /* System code */
 539         cmd.data[1] = 0xFF;
 540         cmd.data[2] = 01;       /* request code */
 541         cmd.data[3] = 0x00;     /* time slot */
 542
 543         /* data len + 2 bytes */
 544         cmd.len = LEN_CMD + LEN_CMD_LEN + 4;
 545
 546         cookie = g_try_malloc0(sizeof(struct t3_cookie));
 547         if (!cookie)
 548                 return -ENOMEM;
 549
 550         cookie->adapter_idx = adapter_idx;
 551         cookie->target_idx = target_idx;
 552         cookie->cb = cb;
 553
 554         return near_adapter_send(adapter_idx, (uint8_t *) &cmd, cmd.len,
 555                                         receive_system_code, cookie,
 556                                         t3_cookie_release);
 557 }
 558
 559 static int update_attr_block_cb(uint8_t *resp, int length, void *data)
 560 {
 561         struct t3_cookie *cookie = data;
 562         int err;
 563
 564         DBG("");
 565
 566         if (length < 0) {
 567                 err = -EIO;
 568                 goto out_err;
 569         }
 570
 571         err = check_recv_frame(resp, RESP_WRITE_WO_ENCRYPT);
 572         if (err < 0)
 573                 goto out_err;
 574
 575         DBG("Done writing");
 576
 577 out_err:
 578         return t3_cookie_release(err, cookie);
 579 }
 580
 581 static int update_attr_block(struct t3_cookie *cookie)
 582 {
 583         struct type3_cmd cmd;
 584         uint16_t checksum;
 585         uint8_t i;
 586
 587         DBG("");
 588
 589         cookie->attr[9] = 0x00; /* writing data completed */
 590         cookie->attr[11] = (uint8_t) (cookie->ndef->length >> 16);
 591         cookie->attr[12] = (uint8_t) (cookie->ndef->length >> 8);
 592         cookie->attr[13] = (uint8_t) cookie->ndef->length;
 593         checksum = 0;
 594
 595         for (i = 0; i < (BLOCK_SIZE - CHECKSUM_LEN); i++)
 596                 checksum += cookie->attr[i];
 597
 598         cookie->attr[14] = (uint8_t) (checksum >> 8);
 599         cookie->attr[15] = (uint8_t) checksum;
 600
 601         prepare_write_block(cookie->IDm, &cmd, 0, cookie->attr);
 602
 603         return near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd, cmd.len,
 604                                         update_attr_block_cb, cookie,
 605                                         t3_cookie_release);
 606 }
 607
 608 static int data_write_resp(uint8_t *resp, int length, void *data)
 609 {
 610         struct t3_cookie *cookie = data;
 611         struct type3_cmd cmd;
 612         uint8_t padding[BLOCK_SIZE] = {0};
 613         int err;
 614
 615         DBG("");
 616
 617         if (length < 0) {
 618                 err = -EIO;
 619                 goto out_err;
 620         }
 621
 622         err = check_recv_frame(resp, RESP_WRITE_WO_ENCRYPT);
 623         if (err < 0)
 624                 goto out_err;
 625
 626         if (cookie->ndef->offset >= cookie->ndef->length) {
 627                 err = update_attr_block(cookie);
 628                 if (err < 0)
 629                         goto out_err;
 630
 631                 return 0;
 632         }
 633
 634         if ((cookie->ndef->length - cookie->ndef->offset) <
 635                         BLOCK_SIZE) {
 636                 memcpy(padding, cookie->ndef->data + cookie->ndef->offset,
 637                                 cookie->ndef->length - cookie->ndef->offset);
 638                 prepare_write_block(cookie->IDm, &cmd,
 639                                         cookie->current_block, padding);
 640         } else {
 641                 prepare_write_block(cookie->IDm, &cmd, cookie->current_block,
 642                                 cookie->ndef->data + cookie->ndef->offset);
 643         }
 644
 645         cookie->current_block++;
 646         cookie->ndef->offset += BLOCK_SIZE;
 647
 648         err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd, cmd.len,
 649                                                 data_write_resp, cookie, NULL);
 650         if (err < 0)
 651                 goto out_err;
 652
 653         return 0;
 654
 655 out_err:
 656         return t3_cookie_release(err, cookie);
 657 }
 658
 659 static int data_write(uint32_t adapter_idx, uint32_t target_idx,
 660                                 struct near_ndef_message *ndef,
 661                                 struct near_tag *tag,
 662                                 near_tag_io_cb cb)
 663 {
 664         struct t3_cookie *cookie;
 665         struct type3_cmd cmd;
 666         uint16_t checksum, nmaxb;
 667         uint8_t i, len = 0;
 668         uint8_t *idm, *attr;
 669         int err;
 670
 671         DBG("");
 672
 673         cookie = g_try_malloc0(sizeof(struct t3_cookie));
 674
 675         if (!cookie) {
 676                 err = -ENOMEM;
 677
 678                 if (cb)
 679                         cb(adapter_idx, target_idx, err);
 680
 681                 return err;
 682         }
 683
 684         cookie->adapter_idx = adapter_idx;
 685         cookie->target_idx = target_idx;
 686         cookie->ndef = ndef;
 687         cookie->cb = cb;
 688         cookie->current_block = 0;
 689
 690         idm = near_tag_get_idm(tag, &len);
 691         if (!idm)
 692                 return t3_cookie_release(-EINVAL, cookie);
 693
 694         memcpy(cookie->IDm, idm, len);
 695
 696         attr = near_tag_get_attr_block(tag, &len);
 697         if (!attr)
 698                 return t3_cookie_release(-EINVAL, cookie);
 699
 700         memcpy(cookie->attr, attr, len);
 701         nmaxb = (((uint16_t) (cookie->attr[3])) << 8) | cookie->attr[4];
 702
 703         if (cookie->ndef->length > (nmaxb * BLOCK_SIZE)) {
 704                 near_error("not enough space on tag");
 705
 706                 return t3_cookie_release(-ENOSPC, cookie);
 707         }
 708
 709         cookie->attr[9] = 0x0F; /* writing data in progress */
 710         checksum = 0;
 711
 712         for (i = 0; i < 14; i++)
 713                 checksum += cookie->attr[i];
 714
 715         cookie->attr[14] = (uint8_t) (checksum >> 8);
 716         cookie->attr[15] = (uint8_t) checksum;
 717
 718         prepare_write_block(cookie->IDm, &cmd, cookie->current_block,
 719                                                         cookie->attr);
 720         cookie->current_block++;
 721
 722         return near_adapter_send(adapter_idx, (uint8_t *) &cmd, cmd.len,
 723                                         data_write_resp, cookie,
 724                                         t3_cookie_release);
 725 }
 726
 727 static int nfctype3_write(uint32_t adapter_idx, uint32_t target_idx,
 728                                 struct near_ndef_message *ndef,
 729                                 near_tag_io_cb cb)
 730 {
 731         struct near_tag *tag;
 732         int err;
 733
 734         DBG("");
 735
 736         if (!ndef || !cb) {
 737                 err = -EINVAL;
 738                 goto out_err;
 739         }
 740
 741         tag = near_tag_get_tag(adapter_idx, target_idx);
 742         if (!tag) {
 743                 err = -EINVAL;
 744                 goto out_err;
 745         }
 746
 747         err = data_write(adapter_idx, target_idx, ndef, tag, cb);
 748
 749 out_err:
 750         if (cb && err < 0)
 751                 cb(adapter_idx, target_idx, err);
 752
 753         return err;
 754 }
 755
 756 static int check_presence(uint8_t *resp, int length, void *data)
 757 {
 758         struct t3_cookie *cookie = data;
 759         int err = 0;
 760
 761         DBG("length %d", length);
 762
 763         if (length < 0)
 764                 err = -EIO;
 765
 766         return t3_cookie_release(err, cookie);
 767 }
 768
 769 static int nfctype3_check_presence(uint32_t adapter_idx,
 770                                 uint32_t target_idx, near_tag_io_cb cb)
 771 {
 772         struct type3_cmd cmd;
 773         struct t3_cookie *cookie;
 774
 775         DBG("");
 776
 777         /* CMD POLL */
 778         cmd.cmd  = CMD_POLL;    /* POLL command */
 779         cmd.data[0] = 0xFF;     /* System code */
 780         cmd.data[1] = 0xFF;
 781         cmd.data[2] = 01;       /* request code */
 782         cmd.data[3] = 0x00;     /* time slot */
 783
 784         /* data len + 2 bytes */
 785         cmd.len = LEN_CMD + LEN_CMD_LEN + 4 ;
 786
 787         cookie = g_try_malloc0(sizeof(struct t3_cookie));
 788         if (!cookie)
 789                 return -ENOMEM;
 790
 791         cookie->adapter_idx = adapter_idx;
 792         cookie->target_idx = target_idx;
 793         cookie->cb = cb;
 794
 795         return near_adapter_send(adapter_idx, (uint8_t *) &cmd,
 796                                 cmd.len, check_presence, cookie,
 797                                 t3_cookie_release);
 798 }
 799
 800 static int format_resp(uint8_t *resp, int length, void *data)
 801 {
 802         struct near_tag *tag;
 803         struct t3_cookie *cookie = data;
 804         int err;
 805
 806         DBG("");
 807
 808         if (length < 0) {
 809                 err = -EIO;
 810                 goto out_err;
 811         }
 812
 813         err = check_recv_frame(resp, RESP_WRITE_WO_ENCRYPT);
 814         if (err < 0)
 815                 goto out_err;
 816
 817         tag = near_tag_get_tag(cookie->adapter_idx, cookie->target_idx);
 818         if (!tag) {
 819                 err = -ENOMEM;
 820                 goto out_err;
 821         }
 822
 823         near_tag_set_ro(tag, FALSE);
 824         near_tag_set_idm(tag, cookie->IDm, LEN_ID);
 825         near_tag_set_attr_block(tag, cookie->attr, BLOCK_SIZE);
 826         near_tag_set_blank(tag, FALSE);
 827
 828         DBG("Formatting is done");
 829
 830 out_err:
 831         return t3_cookie_release(err, cookie);
 832 }
 833
 834 static int write_attr_block(uint8_t *resp, int length , void *data)
 835 {
 836         struct type3_cmd cmd;
 837         struct t3_cookie *cookie = data;
 838         int err, i;
 839         uint16_t checksum = 0;
 840
 841         DBG("length %d", length);
 842
 843         if (length < 0) {
 844                 err = -EIO;
 845                 goto out_err;
 846         }
 847
 848         err = check_recv_frame(resp, RESP_WRITE_WO_ENCRYPT);
 849         if (err < 0)
 850                 goto out_err;
 851
 852         cookie->attr[0] = NDEF_MAPPING_VERSION;
 853         cookie->attr[1] = MAX_READ_BLOCKS_PER_CHECK;
 854         cookie->attr[2] = MAX_WRITE_BLOCKS_PER_UPDATE;
 855         cookie->attr[3] = (uint8_t) (MAX_BLOCKS_FOR_NDEF_DATA >> 8);
 856         cookie->attr[4] = (uint8_t) (MAX_BLOCKS_FOR_NDEF_DATA);
 857         cookie->attr[5] = 0;
 858         cookie->attr[6] = 0;
 859         cookie->attr[7] = 0;
 860         cookie->attr[8] = 0;
 861         cookie->attr[9] = ATTR_BLOCK_WRITE_FLAG;
 862         cookie->attr[10] = ATTR_BLOCK_RW_FLAG;
 863         cookie->attr[11] = 0;
 864         cookie->attr[12] = 0;
 865         cookie->attr[13] = 0;
 866
 867         for (i = 0; i < (BLOCK_SIZE - CHECKSUM_LEN); i++)
 868                 checksum += cookie->attr[i];
 869
 870         cookie->attr[14] = (uint8_t) (checksum >> 8);
 871         cookie->attr[15] = (uint8_t) checksum;
 872
 873         prepare_write_block(cookie->IDm, &cmd, META_BLOCK_START,
 874                                                 cookie->attr);
 875
 876         err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 877                                 cmd.len, format_resp, cookie, NULL);
 878         if (err < 0)
 879                 goto out_err;
 880
 881         return 0;
 882
 883 out_err:
 884         return t3_cookie_release(err, cookie);
 885 }
 886
 887 static int write_mc_block(uint8_t *resp, int length, void *data)
 888 {
 889         struct type3_cmd cmd;
 890         struct t3_cookie *cookie = data;
 891         int err;
 892
 893         DBG("length %d", length);
 894
 895         if (length < 0) {
 896                 err = -EIO;
 897                 goto out_err;
 898         }
 899
 900         err = check_recv_frame(resp, RESP_READ_WO_ENCRYPT);
 901         if (err < 0)
 902                 goto out_err;
 903
 904         if (resp[OFS_READ_FLAG] != 0) {
 905                 DBG("Status 0x%x", resp[OFS_READ_FLAG]);
 906                 err = -EIO;
 907                 goto out_err;
 908         }
 909
 910         memcpy(cookie->mc_block, resp + 14, BLOCK_SIZE);
 911         /*
 912          * By updating Byte3 to 01h means making Felica Lite
 913          * compatible with NDEF.
 914          */
 915         cookie->mc_block[3] = 1;
 916         prepare_write_block(cookie->IDm, &cmd, FELICA_LITE_MC_BLOCK,
 917                                 cookie->mc_block);
 918         err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 919                                 cmd.len, write_attr_block, cookie, NULL);
 920         if (err < 0)
 921                 goto out_err;
 922
 923         return 0;
 924
 925 out_err:
 926         return t3_cookie_release(err, cookie);
 927 }
 928
 929 static int nfctype3_format(uint32_t adapter_idx,
 930                                 uint32_t target_idx, near_tag_io_cb cb)
 931 {
 932         struct type3_cmd cmd;
 933         struct near_tag *tag;
 934         struct t3_cookie *cookie;
 935         uint8_t ic_type;
 936         uint8_t *idm, len;
 937
 938         DBG("");
 939
 940         tag = near_tag_get_tag(adapter_idx, target_idx);
 941         if (!tag)
 942                 return -ENOMEM;
 943
 944         ic_type = near_tag_get_ic_type(tag);
 945         if (ic_type != FELICA_LITE_IC_TYPE)
 946                 return -EOPNOTSUPP;
 947
 948         cookie = g_try_malloc0(sizeof(struct t3_cookie));
 949         if (!cookie)
 950                 return -ENOMEM;
 951
 952         cookie->adapter_idx = adapter_idx;
 953         cookie->target_idx = target_idx;
 954         cookie->cb = cb;
 955         cookie->ic_type = ic_type;
 956
 957         idm = near_tag_get_idm(tag, &len);
 958         if (!idm)
 959                 return t3_cookie_release(-EINVAL, cookie);
 960
 961         memcpy(cookie->IDm, idm, len);
 962
 963         prepare_read_block(FELICA_LITE_MC_BLOCK, cookie->IDm, &cmd);
 964
 965         return near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd, cmd.len,
 966                                         write_mc_block, cookie,
 967                                         t3_cookie_release);
 968
 969 }
 970
 971 static struct near_tag_driver type1_driver = {
 972         .type           = NFC_PROTO_FELICA,
 973         .priority       = NEAR_TAG_PRIORITY_DEFAULT,
 974         .read           = nfctype3_read,
 975         .write          = nfctype3_write,
 976         .format         = nfctype3_format,
 977         .check_presence = nfctype3_check_presence,
 978 };
 979
 980 static int nfctype3_init(void)
 981 {
 982         DBG("");
 983
 984         return near_tag_driver_register(&type1_driver);
 985 }
 986
 987 static void nfctype3_exit(void)
 988 {
 989         DBG("");
 990
 991         near_tag_driver_unregister(&type1_driver);
 992 }
 993
 994 NEAR_PLUGIN_DEFINE(nfctype3, "NFC Forum Type 3 tags support", VERSION,
 995                         NEAR_PLUGIN_PRIORITY_HIGH, nfctype3_init, nfctype3_exit)