plugins/nfctype3.c

   1 /*
   2  *
   3  *  neard - Near Field Communication manager
   4  *
   5  *  Copyright (C) 2011  Intel Corporation. All rights reserved.
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License version 2 as
   9  *  published by the Free Software Foundation.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  19  *
  20  */
  21
  22 #ifdef HAVE_CONFIG_H
  23 #include <config.h>
  24 #endif
  25
  26 #include <stdint.h>
  27 #include <errno.h>
  28 #include <string.h>
  29 #include <sys/socket.h>
  30
  31 #include <linux/socket.h>
  32 #include <linux/nfc.h>
  33
  34 #include <near/plugin.h>
  35 #include <near/log.h>
  36 #include <near/types.h>
  37 #include <near/adapter.h>
  38 #include <near/tag.h>
  39 #include <near/ndef.h>
  40 #include <near/tlv.h>
  41
  42 #define CMD_POLL                0x00
  43 #define RESP_POLL               0x01
  44
  45 #define CMD_REQUEST_SERVICE     0x02
  46 #define RESP_REQUEST_SERVICE    0x03
  47
  48 #define CMD_REQUEST_RESPONSE    0x04
  49 #define RESP_REQUEST_RESPONSE   0x05
  50
  51 #define CMD_READ_WO_ENCRYPT     0x06
  52 #define RESP_READ_WO_ENCRYPT    0x07
  53
  54 #define CMD_WRITE_WO_ENCRYPT    0x08
  55 #define RESP_WRITE_WO_ENCRYPT   0x09
  56
  57 #define CMD_REQUEST_SYS_CODE    0x0C
  58 #define RESP_REQUEST_SYS_CODE   0x0D
  59
  60 #define CMD_AUTHENTICATION_1    0x10
  61 #define RESP_AUTHENTICATION_1   0x11
  62
  63 #define CMD_AUTHENTICATION_2    0x12
  64 #define RESP_AUTHENTICATION_2   0x13
  65
  66 #define CMD_READ                0x14
  67 #define RESP_READ               0x15
  68
  69 #define CMD_WRITE               0x16
  70 #define RESP_WRITE              0x17
  71
  72 #define NFC_SERVICE_CODE        0x000B
  73 #define BLOCK_SIZE              16
  74 #define META_BLOCK_START        0
  75 #define DATA_BLOCK_START        1
  76
  77 #define LEN_ID                  0x08
  78 #define LEN_CMD                 0x01
  79 #define LEN_REPLY_CMD           0x02
  80 #define LEN_CMD_LEN             0x01
  81
  82 /* offsets */
  83 #define OFS_NFC_STATUS  0
  84 #define OFS_NFC_LEN     1
  85 #define OFS_CMD_RESP    2
  86 #define OFS_IDM         3
  87 #define OFS_CMD_DATA    (LEN_CMD_LEN + LEN_CMD + LEN_ID)
  88 #define OFS_READ_FLAG   12
  89 #define OFS_READ_DATA   14
  90 #define BLOCK_SIZE      16
  91 #define CHECKSUM_LEN    2
  92
  93 #define MAX_DATA_SIZE   254
  94
  95 #define NDEF_MAPPING_VERSION    0x10
  96 #define MAX_READ_BLOCKS_PER_CHECK       0x04
  97 #define MAX_WRITE_BLOCKS_PER_UPDATE     0x01
  98 #define MAX_BLOCKS_FOR_NDEF_DATA        0x000D
  99 #define ATTR_BLOCK_WRITE_FLAG   0x00
 100 #define ATTR_BLOCK_RW_FLAG      0x01
 101
 102 #define IC_TYPE_OFFSET  12
 103 #define SYSTEM_OPTION_OFFSET    17
 104 #define FELICA_LITE_MC_BLOCK    0x88
 105 #define FELICA_LITE_IC_TYPE     0xF0
 106 #define FELICA_LITE_S_IC_TYPE   0xF1
 107 #define FELICA_PLUG_IC_TYPE     0xE0
 108
 109 #define FELICA_LITE_AND_LITE_S_SYS_CODE 0x88B4
 110
 111 struct type3_cmd {
 112         uint8_t len;
 113         uint8_t cmd;
 114         uint8_t data[MAX_DATA_SIZE];
 115 } __attribute__((packed));
 116
 117 struct type3_tag {
 118         uint32_t adapter_idx;
 119         uint16_t current_block;
 120         uint8_t IDm[LEN_ID];
 121
 122         near_tag_io_cb cb;
 123         struct near_tag *tag;
 124 };
 125
 126 struct t3_cookie {
 127         uint32_t adapter_idx;
 128         uint32_t target_idx;
 129         near_tag_io_cb cb;
 130         uint8_t IDm[LEN_ID];
 131         uint8_t current_block;
 132         uint8_t attr[BLOCK_SIZE];
 133         struct near_ndef_message *ndef;
 134         uint8_t ic_type;
 135         uint8_t mc_block[BLOCK_SIZE];
 136 };
 137
 138 static int t3_cookie_release(int err, void *data)
 139 {
 140         struct t3_cookie *cookie = data;
 141
 142         DBG("%p", cookie);
 143
 144         if (cookie == NULL)
 145                 return err;
 146
 147         if (cookie->ndef != NULL)
 148                 g_free(cookie->ndef->data);
 149
 150         g_free(cookie->ndef);
 151         g_free(cookie);
 152         cookie = NULL;
 153
 154         return err;
 155 }
 156
 157 /* common: Initialize structure to write block */
 158 static void prepare_write_block(uint8_t *UID, struct type3_cmd *cmd,
 159                                         uint8_t block, uint8_t *data)
 160 {
 161         cmd->cmd = CMD_WRITE_WO_ENCRYPT;        /* command */
 162         memcpy(cmd->data, UID, LEN_ID);         /* IDm */
 163
 164         cmd->data[LEN_ID] = 1;                  /* number of services */
 165         cmd->data[LEN_ID + 1] = 0x09;           /* service 0x0009 */
 166         cmd->data[LEN_ID + 2] = 0x00;
 167
 168         cmd->data[LEN_ID + 3] = 0x01;           /* number of blocks */
 169         cmd->data[LEN_ID + 4] = 0x80;           /* 2 byte block number format */
 170         cmd->data[LEN_ID + 5] = block;          /* block number */
 171         memcpy(cmd->data + LEN_ID + 6, data, BLOCK_SIZE); /* data to write */
 172
 173         cmd->len = LEN_ID + LEN_CMD + LEN_CMD_LEN + 6 + BLOCK_SIZE;
 174 }
 175
 176 /* common: Initialize structure to read block */
 177 static void prepare_read_block(uint8_t cur_block,
 178                                 uint8_t *UID,
 179                                 struct type3_cmd *cmd)
 180 {
 181         cmd->cmd = CMD_READ_WO_ENCRYPT;                 /* command */
 182         memcpy(cmd->data, UID, LEN_ID);                 /* IDm */
 183
 184         cmd->data[LEN_ID] = 1;                          /* number of service */
 185         cmd->data[LEN_ID + 1] = 0x0B;                   /* service x000B */
 186         cmd->data[LEN_ID + 2] = 0x00;
 187
 188         cmd->data[LEN_ID + 3] = 0x01;                   /* number of block */
 189         cmd->data[LEN_ID + 4] = 0x80;                   /* 2 bytes block id*/
 190         cmd->data[LEN_ID + 5] = cur_block;              /* block number */
 191
 192         cmd->len = LEN_ID + LEN_CMD + LEN_CMD_LEN + 6;
 193 }
 194
 195 /* common: Simple checks on received frame */
 196 static int check_recv_frame(uint8_t *resp, uint8_t reply_code)
 197 {
 198         int err = 0;
 199
 200         if (resp[OFS_NFC_STATUS] != 0) {
 201                 DBG("NFC Command failed: 0x%x", resp[OFS_NFC_STATUS]);
 202                 err = -EIO;
 203         }
 204
 205         if (resp[OFS_CMD_RESP] != reply_code) {
 206                 DBG("Felica cmd failed: 0x%x", resp[OFS_CMD_RESP]);
 207                 err = -EIO;
 208         }
 209
 210         return err;
 211 }
 212
 213 static int data_recv(uint8_t *resp, int length, void *data)
 214 {
 215         struct type3_tag *tag = data;
 216         struct type3_cmd cmd;
 217         uint8_t *nfc_data;
 218         size_t current_length, length_read, data_length;
 219         uint32_t adapter_idx;
 220         uint32_t target_idx;
 221         int read_blocks;
 222         int err;
 223
 224         DBG("%d", length);
 225
 226         adapter_idx = near_tag_get_adapter_idx(tag->tag);
 227         target_idx = near_tag_get_target_idx(tag->tag);
 228
 229         if (length < 0) {
 230                 err = -EIO;
 231                 goto out_err;
 232         }
 233
 234         nfc_data = near_tag_get_data(tag->tag, &data_length);
 235         length_read = length - OFS_READ_DATA;
 236         current_length = tag->current_block * BLOCK_SIZE;
 237         if (current_length + (length - OFS_READ_DATA) > data_length)
 238                 length_read = data_length - current_length;
 239
 240         memcpy(nfc_data + current_length, resp + OFS_READ_DATA, length_read);
 241
 242         if (current_length + length_read >= data_length) {
 243                 GList *records;
 244
 245                 tag->current_block = 0;
 246
 247                 DBG("Done reading %zd bytes at %p", data_length, nfc_data);
 248                 records = near_ndef_parse(nfc_data, data_length);
 249                 near_tag_add_records(tag->tag, records, tag->cb, 0);
 250
 251                 g_free(tag);
 252
 253                 return 0;
 254         }
 255
 256         /* Read the next block */
 257         read_blocks = length / BLOCK_SIZE;
 258         tag->current_block += read_blocks;
 259
 260         prepare_read_block(DATA_BLOCK_START + tag->current_block,
 261                                 tag->IDm, &cmd);
 262
 263         err = near_adapter_send(adapter_idx, (uint8_t *) &cmd, cmd.len,
 264                                 data_recv, tag);
 265
 266         if (err < 0)
 267                 goto out_err;
 268
 269         return 0;
 270
 271 out_err:
 272         if (err < 0 && tag->cb)
 273                 tag->cb(adapter_idx, target_idx, err);
 274
 275         g_free(tag);
 276
 277         return err;
 278 }
 279
 280 static int data_read(struct type3_tag *tag)
 281 {
 282         struct type3_cmd cmd;
 283         uint32_t adapter_idx;
 284
 285         DBG("");
 286
 287         tag->current_block = 0;
 288
 289         prepare_read_block(DATA_BLOCK_START + tag->current_block,
 290                                                         tag->IDm, &cmd );
 291
 292         adapter_idx = near_tag_get_adapter_idx(tag->tag);
 293
 294         return near_adapter_send(adapter_idx,
 295                                         (uint8_t *) &cmd, cmd.len,
 296                                         data_recv, tag);
 297 }
 298
 299 /* Read block 0 to retrieve the data length */
 300 static int nfctype3_recv_block_0(uint8_t *resp, int length, void *data)
 301 {
 302         struct t3_cookie *cookie = data;
 303         int err = 0;
 304         struct near_tag *tag;
 305         struct type3_tag *t3_tag = NULL;
 306         uint32_t ndef_data_length;
 307
 308         DBG("%d", length);
 309
 310         if (length < 0) {
 311                 err = -EIO;
 312                 goto out_err;
 313         }
 314
 315         err = check_recv_frame(resp, RESP_READ_WO_ENCRYPT);
 316         if (err < 0)
 317                 goto out_err;
 318
 319         if (resp[OFS_READ_FLAG] != 0) {
 320                 DBG("Status 0x%x", resp[OFS_READ_FLAG]);
 321                 err = -EIO;
 322                 goto out_err;
 323         }
 324
 325         /* Block 0:[11 - 13]: length is a 3 bytes value */
 326         ndef_data_length =  resp[OFS_READ_DATA + 11] * 0x100;
 327         ndef_data_length += resp[OFS_READ_DATA + 12];
 328         ndef_data_length *= 0x100;
 329         ndef_data_length += resp[OFS_READ_DATA + 13];
 330
 331         /* Add data to the tag */
 332         err = near_tag_add_data(cookie->adapter_idx, cookie->target_idx,
 333                                         NULL, ndef_data_length);
 334         if (err < 0)
 335                 goto out_err;
 336
 337         tag = near_tag_get_tag(cookie->adapter_idx, cookie->target_idx);
 338         if (tag == NULL) {
 339                 err = -ENOMEM;
 340                 goto out_err;
 341         }
 342
 343         /* Block 0:[10]: RW Flag. 1 for RW */
 344         if (resp[OFS_READ_DATA + 10] == 0)
 345                 near_tag_set_ro(tag, TRUE);
 346         else
 347                 near_tag_set_ro(tag, FALSE);
 348
 349         t3_tag = g_try_malloc0(sizeof(struct type3_tag));
 350         if (t3_tag == NULL) {
 351                 err = -ENOMEM;
 352                 goto out_err;
 353         }
 354
 355         memcpy(t3_tag->IDm, cookie->IDm, LEN_ID);
 356
 357         near_tag_set_idm(tag, cookie->IDm, LEN_ID);
 358         near_tag_set_attr_block(tag, resp + OFS_READ_DATA, BLOCK_SIZE);
 359         near_tag_set_blank(tag, FALSE);
 360         near_tag_set_ic_type(tag, cookie->ic_type);
 361
 362         t3_tag->adapter_idx = cookie->adapter_idx;
 363         t3_tag->cb = cookie->cb;
 364         t3_tag->tag = tag;
 365
 366         err = data_read(t3_tag);
 367
 368 out_err:
 369         if (err < 0) {
 370                 if (cookie->cb)
 371                         cookie->cb(cookie->adapter_idx, cookie->target_idx,
 372                                                                         err);
 373
 374                 g_free(t3_tag);
 375         }
 376
 377         return t3_cookie_release(err, cookie);
 378 }
 379
 380 static int poll_ndef_system_code(uint8_t *resp, int length, void *data)
 381 {
 382         struct t3_cookie *cookie = data;
 383         int err = 0;
 384         struct type3_cmd cmd;
 385
 386         DBG("length: %d", length);
 387
 388         if (length < 0) {
 389                 err = -EIO;
 390                 goto out_err;
 391         }
 392
 393         err = check_recv_frame(resp, RESP_POLL);
 394         if (err < 0)
 395                 goto out_err;
 396
 397         prepare_read_block(META_BLOCK_START, cookie->IDm, &cmd);
 398
 399         err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 400                                 cmd.len, nfctype3_recv_block_0, cookie);
 401         if (err < 0)
 402                 goto out_err;
 403
 404         return 0;
 405
 406 out_err:
 407         if (err < 0 && cookie->cb)
 408                 cookie->cb(cookie->adapter_idx,
 409                                 cookie->target_idx, err);
 410
 411         return t3_cookie_release(err, cookie);
 412 }
 413
 414 static int check_sys_op_in_mc_block(uint8_t *resp, int length, void *data)
 415 {
 416         struct type3_cmd cmd;
 417         struct near_tag *tag;
 418         struct t3_cookie *cookie = data;
 419         int err = 0;
 420
 421         DBG("length %d", length);
 422
 423         if (length < 0) {
 424                 err = -EIO;
 425                 goto out_err;
 426         }
 427
 428         err = check_recv_frame(resp, RESP_READ_WO_ENCRYPT);
 429         if (err < 0)
 430                 goto out_err;
 431
 432         if (resp[SYSTEM_OPTION_OFFSET] == 0x00) {
 433                 DBG("Blank tag detected");
 434
 435                 err = near_tag_add_data(cookie->adapter_idx,
 436                                         cookie->target_idx,
 437                                         NULL, 1 /* dummy length */);
 438                 if (err < 0)
 439                         goto out_err;
 440
 441                 tag = near_tag_get_tag(cookie->adapter_idx,
 442                                         cookie->target_idx);
 443                 if (tag == NULL) {
 444                         err = -ENOMEM;
 445                 goto out_err;
 446                 }
 447
 448                 near_tag_set_idm(tag, cookie->IDm, LEN_ID);
 449                 near_tag_set_ic_type(tag, cookie->ic_type);
 450                 near_tag_set_blank(tag, TRUE);
 451
 452                 if (cookie->cb)
 453                         cookie->cb(cookie->adapter_idx,
 454                                         cookie->target_idx, 0);
 455
 456                 return t3_cookie_release(0, cookie);
 457         } else {
 458                 /* CMD POLL */
 459                 cmd.cmd  = CMD_POLL;    /* POLL command */
 460                 cmd.data[0] = 0x12;     /* System code (NFC SC) */
 461                 cmd.data[1] = 0xFC;
 462                 cmd.data[2] = 01;       /* request code */
 463                 cmd.data[3] = 0x00;     /* time slot */
 464                 /* data len + 2 bytes */
 465                 cmd.len = LEN_CMD + LEN_CMD_LEN + 4 ;
 466
 467                 err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 468                         cmd.len , poll_ndef_system_code, cookie);
 469         }
 470
 471         if (err < 0)
 472                 goto out_err;
 473
 474         return 0;
 475
 476 out_err:
 477         if (err < 0 && cookie->cb)
 478                 cookie->cb(cookie->adapter_idx, cookie->target_idx, err);
 479
 480         return t3_cookie_release(err, cookie);
 481 }
 482
 483 static int receive_system_code(uint8_t *resp, int length, void *data)
 484 {
 485         struct t3_cookie *cookie = data;
 486         int err = 0;
 487         struct type3_cmd cmd;
 488         uint16_t system_code;
 489
 490         DBG("length: %d", length);
 491
 492         if (length < 0) {
 493                 err = -EIO;
 494                 goto out_err;
 495         }
 496
 497         err = check_recv_frame(resp, RESP_POLL);
 498         if (err < 0)
 499                 goto out_err;
 500
 501         cookie->ic_type = resp[IC_TYPE_OFFSET];
 502         memcpy(cookie->IDm, resp + OFS_IDM, LEN_ID);
 503         system_code = ((uint16_t) (resp[length - 2])) << 8;
 504         system_code |= resp[length - 1];
 505
 506         switch (resp[IC_TYPE_OFFSET]) {
 507         case FELICA_LITE_IC_TYPE:
 508                 prepare_read_block(FELICA_LITE_MC_BLOCK, cookie->IDm, &cmd);
 509                 err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 510                                         cmd.len, check_sys_op_in_mc_block,
 511                                         cookie);
 512                 break;
 513
 514         case FELICA_LITE_S_IC_TYPE:
 515         case FELICA_PLUG_IC_TYPE:
 516                 /* CMD POLL */
 517                 cmd.cmd  = CMD_POLL;    /* POLL command */
 518                 cmd.data[0] = 0x12;     /* System code (NFC SC) */
 519                 cmd.data[1] = 0xFC;
 520                 cmd.data[2] = 01;       /* request code */
 521                 cmd.data[3] = 0x00;     /* time slot */
 522                 /* data len + 2 bytes */
 523                 cmd.len = LEN_CMD + LEN_CMD_LEN + 4 ;
 524
 525                 err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 526                                         cmd.len, poll_ndef_system_code, cookie);
 527         }
 528
 529         if (err < 0)
 530                 goto out_err;
 531
 532         return 0;
 533
 534 out_err:
 535         if (err < 0 && cookie->cb)
 536                 cookie->cb(cookie->adapter_idx, cookie->target_idx, err);
 537
 538         return t3_cookie_release(err, cookie);
 539 }
 540
 541 static int nfctype3_read(uint32_t adapter_idx,
 542                                 uint32_t target_idx, near_tag_io_cb cb)
 543 {
 544         struct type3_cmd cmd;
 545         struct t3_cookie *cookie;
 546         int err;
 547
 548         DBG("");
 549
 550         /* CMD POLL */
 551         cmd.cmd  = CMD_POLL;    /* POLL command */
 552         cmd.data[0] = 0xFF;     /* System code */
 553         cmd.data[1] = 0xFF;
 554         cmd.data[2] = 01;       /* request code */
 555         cmd.data[3] = 0x00;     /* time slot */
 556
 557         /* data len + 2 bytes */
 558         cmd.len = LEN_CMD + LEN_CMD_LEN + 4;
 559
 560         cookie = g_try_malloc0(sizeof(struct t3_cookie));
 561         if (cookie == NULL)
 562                 return -ENOMEM;
 563
 564         cookie->adapter_idx = adapter_idx;
 565         cookie->target_idx = target_idx;
 566         cookie->cb = cb;
 567
 568         err = near_adapter_send(adapter_idx, (uint8_t *) &cmd,
 569                                 cmd.len, receive_system_code, cookie);
 570         if (err < 0)
 571                 g_free(cookie);
 572
 573         return err;
 574 }
 575
 576 static int update_attr_block_cb(uint8_t *resp, int length, void *data)
 577 {
 578         struct t3_cookie *cookie = data;
 579         int err;
 580
 581         DBG("");
 582
 583         if (length < 0) {
 584                 err = -EIO;
 585                 goto out_err;
 586         }
 587
 588         err = check_recv_frame(resp, RESP_WRITE_WO_ENCRYPT);
 589         if (err < 0)
 590                 goto out_err;
 591
 592         DBG("Done writing");
 593
 594 out_err:
 595         if (cookie->cb)
 596                 cookie->cb(cookie->adapter_idx, cookie->target_idx, err);
 597
 598         return t3_cookie_release(err, cookie);
 599 }
 600
 601 static int update_attr_block(struct t3_cookie *cookie)
 602 {
 603         struct type3_cmd cmd;
 604         uint16_t checksum;
 605         uint8_t i;
 606
 607         DBG("");
 608
 609         cookie->attr[9] = 0x00; /* writing data completed */
 610         cookie->attr[11] = (uint8_t) (cookie->ndef->length >> 16);
 611         cookie->attr[12] = (uint8_t) (cookie->ndef->length >> 8);
 612         cookie->attr[13] = (uint8_t) cookie->ndef->length;
 613         checksum = 0;
 614
 615         for (i = 0; i < (BLOCK_SIZE - CHECKSUM_LEN); i++)
 616                 checksum += cookie->attr[i];
 617
 618         cookie->attr[14] = (uint8_t) (checksum >> 8);
 619         cookie->attr[15] = (uint8_t) checksum;
 620
 621         prepare_write_block(cookie->IDm, &cmd, 0, cookie->attr);
 622
 623         return near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd, cmd.len,
 624                                                 update_attr_block_cb, cookie);
 625 }
 626
 627 static int data_write_resp(uint8_t *resp, int length, void *data)
 628 {
 629         struct t3_cookie *cookie = data;
 630         struct type3_cmd cmd;
 631         uint8_t padding[BLOCK_SIZE] = {0};
 632         int err;
 633
 634         DBG("");
 635
 636         if (length < 0) {
 637                 err = -EIO;
 638                 goto out_err;
 639         }
 640
 641         err = check_recv_frame(resp, RESP_WRITE_WO_ENCRYPT);
 642         if (err < 0)
 643                 goto out_err;
 644
 645         if (cookie->ndef->offset >= cookie->ndef->length) {
 646                 err = update_attr_block(cookie);
 647                 if (err < 0)
 648                         goto out_err;
 649
 650                 return 0;
 651         }
 652
 653         if ((cookie->ndef->length - cookie->ndef->offset) <
 654                         BLOCK_SIZE) {
 655                 memcpy(padding, cookie->ndef->data + cookie->ndef->offset,
 656                                 cookie->ndef->length - cookie->ndef->offset);
 657                 prepare_write_block(cookie->IDm, &cmd,
 658                                         cookie->current_block, padding);
 659         } else {
 660                 prepare_write_block(cookie->IDm, &cmd, cookie->current_block,
 661                                 cookie->ndef->data + cookie->ndef->offset);
 662         }
 663
 664         cookie->current_block++;
 665         cookie->ndef->offset += BLOCK_SIZE;
 666
 667         err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd, cmd.len,
 668                                                 data_write_resp, cookie);
 669         if (err < 0)
 670                 goto out_err;
 671
 672         return 0;
 673
 674 out_err:
 675         if (err < 0 && cookie->cb)
 676                 cookie->cb(cookie->adapter_idx, cookie->target_idx, err);
 677
 678         return t3_cookie_release(err, cookie);
 679 }
 680
 681 static int data_write(uint32_t adapter_idx, uint32_t target_idx,
 682                                 struct near_ndef_message *ndef,
 683                                 struct near_tag *tag,
 684                                 near_tag_io_cb cb)
 685 {
 686         struct t3_cookie *cookie;
 687         struct type3_cmd cmd;
 688         uint16_t checksum, nmaxb;
 689         uint8_t i, len = 0;
 690         uint8_t *idm, *attr;
 691         int err;
 692
 693         DBG("");
 694
 695         cookie = g_try_malloc0(sizeof(struct t3_cookie));
 696         if (cookie == NULL) {
 697                 err = -ENOMEM;
 698                 goto out_err;
 699         }
 700
 701         cookie->adapter_idx = adapter_idx;
 702         cookie->target_idx = target_idx;
 703         cookie->ndef = ndef;
 704         cookie->cb = cb;
 705         cookie->current_block = 0;
 706
 707         idm = near_tag_get_idm(tag, &len);
 708         if (idm == NULL) {
 709                 err = -EINVAL;
 710                 goto out_err;
 711         }
 712
 713         memcpy(cookie->IDm, idm, len);
 714
 715         attr = near_tag_get_attr_block(tag, &len);
 716         if (attr == NULL) {
 717                 err = -EINVAL;
 718                 goto out_err;
 719         }
 720
 721         memcpy(cookie->attr, attr, len);
 722         nmaxb = (((uint16_t) (cookie->attr[3])) << 8) | cookie->attr[4];
 723
 724         if (cookie->ndef->length > (nmaxb * BLOCK_SIZE)) {
 725                 near_error("not enough space on tag");
 726                 err = -ENOSPC;
 727                 goto out_err;
 728         }
 729
 730         cookie->attr[9] = 0x0F; /* writing data in progress */
 731         checksum = 0;
 732
 733         for (i = 0; i < 14; i++)
 734                 checksum += cookie->attr[i];
 735
 736         cookie->attr[14] = (uint8_t) (checksum >> 8);
 737         cookie->attr[15] = (uint8_t) checksum;
 738
 739         prepare_write_block(cookie->IDm, &cmd, cookie->current_block,
 740                                                         cookie->attr);
 741         cookie->current_block++;
 742
 743         err = near_adapter_send(adapter_idx, (uint8_t *) &cmd, cmd.len,
 744                                                 data_write_resp, cookie);
 745         if (err < 0)
 746                 goto out_err;
 747
 748         return 0;
 749
 750 out_err:
 751         return t3_cookie_release(err, cookie);
 752 }
 753
 754 static int nfctype3_write(uint32_t adapter_idx, uint32_t target_idx,
 755                                 struct near_ndef_message *ndef,
 756                                 near_tag_io_cb cb)
 757 {
 758         struct near_tag *tag;
 759
 760         DBG("");
 761
 762         if (ndef == NULL || cb == NULL)
 763                 return -EINVAL;
 764
 765         tag = near_tag_get_tag(adapter_idx, target_idx);
 766         if (tag == NULL)
 767                 return -EINVAL;
 768
 769         return data_write(adapter_idx, target_idx, ndef, tag, cb);
 770 }
 771
 772 static int check_presence(uint8_t *resp, int length, void *data)
 773 {
 774         struct t3_cookie *cookie = data;
 775         int err = 0;
 776
 777         DBG("length %d", length);
 778
 779         if (length < 0)
 780                 err = -EIO;
 781
 782         if (cookie->cb)
 783                 cookie->cb(cookie->adapter_idx,
 784                                 cookie->target_idx, err);
 785
 786         return t3_cookie_release(err, cookie);
 787 }
 788
 789 static int nfctype3_check_presence(uint32_t adapter_idx,
 790                                 uint32_t target_idx, near_tag_io_cb cb)
 791 {
 792         struct type3_cmd cmd;
 793         struct t3_cookie *cookie;
 794         int err;
 795
 796         DBG("");
 797
 798         /* CMD POLL */
 799         cmd.cmd  = CMD_POLL;    /* POLL command */
 800         cmd.data[0] = 0xFF;     /* System code */
 801         cmd.data[1] = 0xFF;
 802         cmd.data[2] = 01;       /* request code */
 803         cmd.data[3] = 0x00;     /* time slot */
 804
 805         /* data len + 2 bytes */
 806         cmd.len = LEN_CMD + LEN_CMD_LEN + 4 ;
 807
 808         cookie = g_try_malloc0(sizeof(struct t3_cookie));
 809         if (cookie == NULL)
 810                 return -ENOMEM;
 811
 812         cookie->adapter_idx = adapter_idx;
 813         cookie->target_idx = target_idx;
 814         cookie->cb = cb;
 815
 816         err = near_adapter_send(adapter_idx, (uint8_t *) &cmd,
 817                                 cmd.len, check_presence, cookie);
 818
 819         if (err < 0)
 820                 goto out_err;
 821
 822         return 0;
 823
 824 out_err:
 825         return t3_cookie_release(err, cookie);
 826 }
 827
 828 static int format_resp(uint8_t *resp, int length, void *data)
 829 {
 830         struct near_tag *tag;
 831         struct t3_cookie *cookie = data;
 832         int err;
 833
 834         DBG("");
 835
 836         if (length < 0) {
 837                 err = -EIO;
 838                 goto out_err;
 839         }
 840
 841         err = check_recv_frame(resp, RESP_WRITE_WO_ENCRYPT);
 842         if (err < 0)
 843                 goto out_err;
 844
 845         tag = near_tag_get_tag(cookie->adapter_idx, cookie->target_idx);
 846         if (tag == NULL) {
 847                 err = -ENOMEM;
 848                 goto out_err;
 849         }
 850
 851         near_tag_set_ro(tag, FALSE);
 852         near_tag_set_idm(tag, cookie->IDm, LEN_ID);
 853         near_tag_set_attr_block(tag, cookie->attr, BLOCK_SIZE);
 854         near_tag_set_blank(tag, FALSE);
 855
 856         DBG("Formatting is done");
 857
 858 out_err:
 859         if (cookie->cb)
 860                 cookie->cb(cookie->adapter_idx, cookie->target_idx, err);
 861
 862         return t3_cookie_release(err, cookie);
 863 }
 864
 865 static int write_attr_block(uint8_t *resp, int length , void *data)
 866 {
 867         struct type3_cmd cmd;
 868         struct t3_cookie *cookie = data;
 869         int err, i;
 870         uint16_t checksum = 0;
 871
 872         DBG("length %d", length);
 873
 874         if (length < 0) {
 875                 err = -EIO;
 876                 goto out_err;
 877         }
 878
 879         err = check_recv_frame(resp, RESP_WRITE_WO_ENCRYPT);
 880         if (err < 0)
 881                 goto out_err;
 882
 883         cookie->attr[0] = NDEF_MAPPING_VERSION;
 884         cookie->attr[1] = MAX_READ_BLOCKS_PER_CHECK;
 885         cookie->attr[2] = MAX_WRITE_BLOCKS_PER_UPDATE;
 886         cookie->attr[3] = (uint8_t) (MAX_BLOCKS_FOR_NDEF_DATA >> 8);
 887         cookie->attr[4] = (uint8_t) (MAX_BLOCKS_FOR_NDEF_DATA);
 888         cookie->attr[5] = 0;
 889         cookie->attr[6] = 0;
 890         cookie->attr[7] = 0;
 891         cookie->attr[8] = 0;
 892         cookie->attr[9] = ATTR_BLOCK_WRITE_FLAG;
 893         cookie->attr[10] = ATTR_BLOCK_RW_FLAG;
 894         cookie->attr[11] = 0;
 895         cookie->attr[12] = 0;
 896         cookie->attr[13] = 0;
 897
 898         for (i = 0; i < (BLOCK_SIZE - CHECKSUM_LEN); i++)
 899                 checksum += cookie->attr[i];
 900
 901         cookie->attr[14] = (uint8_t) (checksum >> 8);
 902         cookie->attr[15] = (uint8_t) checksum;
 903
 904         prepare_write_block(cookie->IDm, &cmd, META_BLOCK_START,
 905                                                 cookie->attr);
 906
 907         err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 908                                 cmd.len, format_resp, cookie);
 909         if (err < 0)
 910                 goto out_err;
 911
 912         return 0;
 913
 914 out_err:
 915         if (err < 0 && cookie->cb)
 916                 cookie->cb(cookie->adapter_idx, cookie->target_idx, err);
 917
 918         return t3_cookie_release(err, cookie);
 919 }
 920
 921 static int write_mc_block(uint8_t *resp, int length, void *data)
 922 {
 923         struct type3_cmd cmd;
 924         struct t3_cookie *cookie = data;
 925         int err;
 926
 927         DBG("length %d", length);
 928
 929         if (length < 0) {
 930                 err = -EIO;
 931                 goto out_err;
 932         }
 933
 934         err = check_recv_frame(resp, RESP_READ_WO_ENCRYPT);
 935         if (err < 0)
 936                 goto out_err;
 937
 938         if (resp[OFS_READ_FLAG] != 0) {
 939                 DBG("Status 0x%x", resp[OFS_READ_FLAG]);
 940                 err = -EIO;
 941                 goto out_err;
 942         }
 943
 944         memcpy(cookie->mc_block, resp + 14, BLOCK_SIZE);
 945         /*
 946          * By updating Byte3 to 01h means making Felica Lite
 947          * compatible with NDEF.
 948          */
 949         cookie->mc_block[3] = 1;
 950         prepare_write_block(cookie->IDm, &cmd, FELICA_LITE_MC_BLOCK,
 951                                 cookie->mc_block);
 952         err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
 953                                 cmd.len, write_attr_block, cookie);
 954         if (err < 0)
 955                 goto out_err;
 956
 957         return 0;
 958
 959 out_err:
 960         if (err < 0 && cookie->cb)
 961                 cookie->cb(cookie->adapter_idx, cookie->target_idx, err);
 962
 963         return t3_cookie_release(err, cookie);
 964 }
 965
 966 static int nfctype3_format(uint32_t adapter_idx,
 967                                 uint32_t target_idx, near_tag_io_cb cb)
 968 {
 969         struct type3_cmd cmd;
 970         struct near_tag *tag;
 971         struct t3_cookie *cookie;
 972         uint8_t ic_type;
 973         uint8_t *idm, len;
 974         int err;
 975
 976         DBG("");
 977
 978         tag = near_tag_get_tag(adapter_idx, target_idx);
 979         if (tag == NULL)
 980                 return -ENOMEM;
 981
 982         ic_type = near_tag_get_ic_type(tag);
 983         if (ic_type != FELICA_LITE_IC_TYPE)
 984                 return -EOPNOTSUPP;
 985
 986         cookie = g_try_malloc0(sizeof(struct t3_cookie));
 987         if (cookie == NULL)
 988                 return -ENOMEM;
 989
 990         cookie->adapter_idx = adapter_idx;
 991         cookie->target_idx = target_idx;
 992         cookie->cb = cb;
 993         cookie->ic_type = ic_type;
 994
 995         idm = near_tag_get_idm(tag, &len);
 996         if (idm == NULL) {
 997                 err = -EINVAL;
 998                 goto out_err;
 999         }
1000
1001         memcpy(cookie->IDm, idm, len);
1002
1003         prepare_read_block(FELICA_LITE_MC_BLOCK, cookie->IDm, &cmd);
1004         err = near_adapter_send(cookie->adapter_idx, (uint8_t *) &cmd,
1005                                 cmd.len, write_mc_block, cookie);
1006         if (err < 0)
1007                 goto out_err;
1008
1009         return 0;
1010
1011 out_err:
1012         return t3_cookie_release(err, cookie);
1013 }
1014
1015 static struct near_tag_driver type1_driver = {
1016         .type           = NFC_PROTO_FELICA,
1017         .priority       = NEAR_TAG_PRIORITY_DEFAULT,
1018         .read           = nfctype3_read,
1019         .write          = nfctype3_write,
1020         .format         = nfctype3_format,
1021         .check_presence = nfctype3_check_presence,
1022 };
1023
1024 static int nfctype3_init(void)
1025 {
1026         DBG("");
1027
1028         return near_tag_driver_register(&type1_driver);
1029 }
1030
1031 static void nfctype3_exit(void)
1032 {
1033         DBG("");
1034
1035         near_tag_driver_unregister(&type1_driver);
1036 }
1037
1038 NEAR_PLUGIN_DEFINE(nfctype3, "NFC Forum Type 3 tags support", VERSION,
1039                         NEAR_PLUGIN_PRIORITY_HIGH, nfctype3_init, nfctype3_exit)