[linux-block.git] / net / nfc / llcp_commands.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Copyright (C) 2011  Intel Corporation. All rights reserved.
 */

#define pr_fmt(fmt) "llcp: %s: " fmt, __func__

#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/nfc.h>

#include <net/nfc/nfc.h>

#include "nfc.h"
#include "llcp.h"

static const u8 llcp_tlv_length[LLCP_TLV_MAX] = {
	0,
	1, /* VERSION */
	2, /* MIUX */
	2, /* WKS */
	1, /* LTO */
	1, /* RW */
	0, /* SN */
	1, /* OPT */
	0, /* SDREQ */
	2, /* SDRES */

};

static u8 llcp_tlv8(const u8 *tlv, u8 type)
{
	if (tlv[0] != type || tlv[1] != llcp_tlv_length[tlv[0]])
		return 0;

	return tlv[2];
}

static u16 llcp_tlv16(const u8 *tlv, u8 type)
{
	if (tlv[0] != type || tlv[1] != llcp_tlv_length[tlv[0]])
		return 0;

	return be16_to_cpu(*((__be16 *)(tlv + 2)));
}


static u8 llcp_tlv_version(const u8 *tlv)
{
	return llcp_tlv8(tlv, LLCP_TLV_VERSION);
}

static u16 llcp_tlv_miux(const u8 *tlv)
{
	return llcp_tlv16(tlv, LLCP_TLV_MIUX) & 0x7ff;
}

static u16 llcp_tlv_wks(const u8 *tlv)
{
	return llcp_tlv16(tlv, LLCP_TLV_WKS);
}

static u16 llcp_tlv_lto(const u8 *tlv)
{
	return llcp_tlv8(tlv, LLCP_TLV_LTO);
}

static u8 llcp_tlv_opt(const u8 *tlv)
{
	return llcp_tlv8(tlv, LLCP_TLV_OPT);
}

static u8 llcp_tlv_rw(const u8 *tlv)
{
	return llcp_tlv8(tlv, LLCP_TLV_RW) & 0xf;
}

u8 *nfc_llcp_build_tlv(u8 type, const u8 *value, u8 value_length, u8 *tlv_length)
{
	u8 *tlv, length;

	pr_debug("type %d\n", type);

	if (type >= LLCP_TLV_MAX)
		return NULL;

	length = llcp_tlv_length[type];
	if (length == 0 && value_length == 0)
		return NULL;
	else if (length == 0)
		length = value_length;

	*tlv_length = 2 + length;
	tlv = kzalloc(2 + length, GFP_KERNEL);
	if (tlv == NULL)
		return tlv;

	tlv[0] = type;
	tlv[1] = length;
	memcpy(tlv + 2, value, length);

	return tlv;
}

struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap)
{
	struct nfc_llcp_sdp_tlv *sdres;
	u8 value[2];

	sdres = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
	if (sdres == NULL)
		return NULL;

	value[0] = tid;
	value[1] = sap;

	sdres->tlv = nfc_llcp_build_tlv(LLCP_TLV_SDRES, value, 2,
					&sdres->tlv_len);
	if (sdres->tlv == NULL) {
		kfree(sdres);
		return NULL;
	}

	sdres->tid = tid;
	sdres->sap = sap;

	INIT_HLIST_NODE(&sdres->node);

	return sdres;
}

struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, const char *uri,
						  size_t uri_len)
{
	struct nfc_llcp_sdp_tlv *sdreq;

	pr_debug("uri: %s, len: %zu\n", uri, uri_len);

	/* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
	if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
		return NULL;

	sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
	if (sdreq == NULL)
		return NULL;

	sdreq->tlv_len = uri_len + 3;

	if (uri[uri_len - 1] == 0)
		sdreq->tlv_len--;

	sdreq->tlv = kzalloc(sdreq->tlv_len + 1, GFP_KERNEL);
	if (sdreq->tlv == NULL) {
		kfree(sdreq);
		return NULL;
	}

	sdreq->tlv[0] = LLCP_TLV_SDREQ;
	sdreq->tlv[1] = sdreq->tlv_len - 2;
	sdreq->tlv[2] = tid;

	sdreq->tid = tid;
	sdreq->uri = sdreq->tlv + 3;
	memcpy(sdreq->uri, uri, uri_len);

	sdreq->time = jiffies;

	INIT_HLIST_NODE(&sdreq->node);

	return sdreq;
}

void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp)
{
	kfree(sdp->tlv);
	kfree(sdp);
}

void nfc_llcp_free_sdp_tlv_list(struct hlist_head *head)
{
	struct nfc_llcp_sdp_tlv *sdp;
	struct hlist_node *n;

	hlist_for_each_entry_safe(sdp, n, head, node) {
		hlist_del(&sdp->node);

		nfc_llcp_free_sdp_tlv(sdp);
	}
}

int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
			  const u8 *tlv_array, u16 tlv_array_len)
{
	const u8 *tlv = tlv_array;
	u8 type, length, offset = 0;

	pr_debug("TLV array length %d\n", tlv_array_len);

	if (local == NULL)
		return -ENODEV;

	while (offset < tlv_array_len) {
		type = tlv[0];
		length = tlv[1];

		pr_debug("type 0x%x length %d\n", type, length);

		switch (type) {
		case LLCP_TLV_VERSION:
			local->remote_version = llcp_tlv_version(tlv);
			break;
		case LLCP_TLV_MIUX:
			local->remote_miu = llcp_tlv_miux(tlv) + 128;
			break;
		case LLCP_TLV_WKS:
			local->remote_wks = llcp_tlv_wks(tlv);
			break;
		case LLCP_TLV_LTO:
			local->remote_lto = llcp_tlv_lto(tlv) * 10;
			break;
		case LLCP_TLV_OPT:
			local->remote_opt = llcp_tlv_opt(tlv);
			break;
		default:
			pr_err("Invalid gt tlv value 0x%x\n", type);
			break;
		}

		offset += length + 2;
		tlv += length + 2;
	}

	pr_debug("version 0x%x miu %d lto %d opt 0x%x wks 0x%x\n",
		 local->remote_version, local->remote_miu,
		 local->remote_lto, local->remote_opt,
		 local->remote_wks);

	return 0;
}

int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
				  const u8 *tlv_array, u16 tlv_array_len)
{
	const u8 *tlv = tlv_array;
	u8 type, length, offset = 0;

	pr_debug("TLV array length %d\n", tlv_array_len);

	if (sock == NULL)
		return -ENOTCONN;

	while (offset < tlv_array_len) {
		type = tlv[0];
		length = tlv[1];

		pr_debug("type 0x%x length %d\n", type, length);

		switch (type) {
		case LLCP_TLV_MIUX:
			sock->remote_miu = llcp_tlv_miux(tlv) + 128;
			break;
		case LLCP_TLV_RW:
			sock->remote_rw = llcp_tlv_rw(tlv);
			break;
		case LLCP_TLV_SN:
			break;
		default:
			pr_err("Invalid gt tlv value 0x%x\n", type);
			break;
		}

		offset += length + 2;
		tlv += length + 2;
	}

	pr_debug("sock %p rw %d miu %d\n", sock,
		 sock->remote_rw, sock->remote_miu);

	return 0;
}

static struct sk_buff *llcp_add_header(struct sk_buff *pdu,
				       u8 dsap, u8 ssap, u8 ptype)
{
	u8 header[2];

	pr_debug("ptype 0x%x dsap 0x%x ssap 0x%x\n", ptype, dsap, ssap);

	header[0] = (u8)((dsap << 2) | (ptype >> 2));
	header[1] = (u8)((ptype << 6) | ssap);

	pr_debug("header 0x%x 0x%x\n", header[0], header[1]);

	skb_put_data(pdu, header, LLCP_HEADER_SIZE);

	return pdu;
}

static struct sk_buff *llcp_add_tlv(struct sk_buff *pdu, const u8 *tlv,
				    u8 tlv_length)
{
	/* XXX Add an skb length check */

	if (tlv == NULL)
		return NULL;

	skb_put_data(pdu, tlv, tlv_length);

	return pdu;
}

static struct sk_buff *llcp_allocate_pdu(struct nfc_llcp_sock *sock,
					 u8 cmd, u16 size)
{
	struct sk_buff *skb;
	int err;

	if (sock->ssap == 0)
		return NULL;

	skb = nfc_alloc_send_skb(sock->dev, &sock->sk, MSG_DONTWAIT,
				 size + LLCP_HEADER_SIZE, &err);
	if (skb == NULL) {
		pr_err("Could not allocate PDU\n");
		return NULL;
	}

	skb = llcp_add_header(skb, sock->dsap, sock->ssap, cmd);

	return skb;
}

int nfc_llcp_send_disconnect(struct nfc_llcp_sock *sock)
{
	struct sk_buff *skb;
	struct nfc_dev *dev;
	struct nfc_llcp_local *local;

	local = sock->local;
	if (local == NULL)
		return -ENODEV;

	dev = sock->dev;
	if (dev == NULL)
		return -ENODEV;

	skb = llcp_allocate_pdu(sock, LLCP_PDU_DISC, 0);
	if (skb == NULL)
		return -ENOMEM;

	skb_queue_tail(&local->tx_queue, skb);

	return 0;
}

int nfc_llcp_send_symm(struct nfc_dev *dev)
{
	struct sk_buff *skb;
	struct nfc_llcp_local *local;
	u16 size = 0;

	local = nfc_llcp_find_local(dev);
	if (local == NULL)
		return -ENODEV;

	size += LLCP_HEADER_SIZE;
	size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;

	skb = alloc_skb(size, GFP_KERNEL);
	if (skb == NULL)
		return -ENOMEM;

	skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);

	skb = llcp_add_header(skb, 0, 0, LLCP_PDU_SYMM);

	__net_timestamp(skb);

	nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_TX);

	return nfc_data_exchange(dev, local->target_idx, skb,
				 nfc_llcp_recv, local);
}

int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
{
	struct nfc_llcp_local *local;
	struct sk_buff *skb;
	const u8 *service_name_tlv = NULL;
	const u8 *miux_tlv = NULL;
	const u8 *rw_tlv = NULL;
	u8 service_name_tlv_length, miux_tlv_length,  rw_tlv_length, rw;
	int err;
	u16 size = 0;
	__be16 miux;

	local = sock->local;
	if (local == NULL)
		return -ENODEV;

	if (sock->service_name != NULL) {
		service_name_tlv = nfc_llcp_build_tlv(LLCP_TLV_SN,
						      sock->service_name,
						      sock->service_name_len,
						      &service_name_tlv_length);
		if (!service_name_tlv) {
			err = -ENOMEM;
			goto error_tlv;
		}
		size += service_name_tlv_length;
	}

	/* If the socket parameters are not set, use the local ones */
	miux = be16_to_cpu(sock->miux) > LLCP_MAX_MIUX ?
		local->miux : sock->miux;
	rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;

	miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
				      &miux_tlv_length);
	if (!miux_tlv) {
		err = -ENOMEM;
		goto error_tlv;
	}
	size += miux_tlv_length;

	rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
	if (!rw_tlv) {
		err = -ENOMEM;
		goto error_tlv;
	}
	size += rw_tlv_length;

	pr_debug("SKB size %d SN length %zu\n", size, sock->service_name_len);

	skb = llcp_allocate_pdu(sock, LLCP_PDU_CONNECT, size);
	if (skb == NULL) {
		err = -ENOMEM;
		goto error_tlv;
	}

	llcp_add_tlv(skb, service_name_tlv, service_name_tlv_length);
	llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
	llcp_add_tlv(skb, rw_tlv, rw_tlv_length);

	skb_queue_tail(&local->tx_queue, skb);

	err = 0;

error_tlv:
	if (err)
		pr_err("error %d\n", err);

	kfree(service_name_tlv);
	kfree(miux_tlv);
	kfree(rw_tlv);

	return err;
}

int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
{
	struct nfc_llcp_local *local;
	struct sk_buff *skb;
	const u8 *miux_tlv = NULL;
	const u8 *rw_tlv = NULL;
	u8 miux_tlv_length, rw_tlv_length, rw;
	int err;
	u16 size = 0;
	__be16 miux;

	local = sock->local;
	if (local == NULL)
		return -ENODEV;

	/* If the socket parameters are not set, use the local ones */
	miux = be16_to_cpu(sock->miux) > LLCP_MAX_MIUX ?
		local->miux : sock->miux;
	rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;

	miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
				      &miux_tlv_length);
	if (!miux_tlv) {
		err = -ENOMEM;
		goto error_tlv;
	}
	size += miux_tlv_length;

	rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
	if (!rw_tlv) {
		err = -ENOMEM;
		goto error_tlv;
	}
	size += rw_tlv_length;

	skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, size);
	if (skb == NULL) {
		err = -ENOMEM;
		goto error_tlv;
	}

	llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
	llcp_add_tlv(skb, rw_tlv, rw_tlv_length);

	skb_queue_tail(&local->tx_queue, skb);

	err = 0;

error_tlv:
	if (err)
		pr_err("error %d\n", err);

	kfree(miux_tlv);
	kfree(rw_tlv);

	return err;
}

static struct sk_buff *nfc_llcp_allocate_snl(struct nfc_llcp_local *local,
					     size_t tlv_length)
{
	struct sk_buff *skb;
	struct nfc_dev *dev;
	u16 size = 0;

	if (local == NULL)
		return ERR_PTR(-ENODEV);

	dev = local->dev;
	if (dev == NULL)
		return ERR_PTR(-ENODEV);

	size += LLCP_HEADER_SIZE;
	size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
	size += tlv_length;

	skb = alloc_skb(size, GFP_KERNEL);
	if (skb == NULL)
		return ERR_PTR(-ENOMEM);

	skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);

	skb = llcp_add_header(skb, LLCP_SAP_SDP, LLCP_SAP_SDP, LLCP_PDU_SNL);

	return skb;
}

int nfc_llcp_send_snl_sdres(struct nfc_llcp_local *local,
			    struct hlist_head *tlv_list, size_t tlvs_len)
{
	struct nfc_llcp_sdp_tlv *sdp;
	struct hlist_node *n;
	struct sk_buff *skb;

	skb = nfc_llcp_allocate_snl(local, tlvs_len);
	if (IS_ERR(skb))
		return PTR_ERR(skb);

	hlist_for_each_entry_safe(sdp, n, tlv_list, node) {
		skb_put_data(skb, sdp->tlv, sdp->tlv_len);

		hlist_del(&sdp->node);

		nfc_llcp_free_sdp_tlv(sdp);
	}

	skb_queue_tail(&local->tx_queue, skb);

	return 0;
}

int nfc_llcp_send_snl_sdreq(struct nfc_llcp_local *local,
			    struct hlist_head *tlv_list, size_t tlvs_len)
{
	struct nfc_llcp_sdp_tlv *sdreq;
	struct hlist_node *n;
	struct sk_buff *skb;

	skb = nfc_llcp_allocate_snl(local, tlvs_len);
	if (IS_ERR(skb))
		return PTR_ERR(skb);

	mutex_lock(&local->sdreq_lock);

	if (hlist_empty(&local->pending_sdreqs))
		mod_timer(&local->sdreq_timer,
			  jiffies + msecs_to_jiffies(3 * local->remote_lto));

	hlist_for_each_entry_safe(sdreq, n, tlv_list, node) {
		pr_debug("tid %d for %s\n", sdreq->tid, sdreq->uri);

		skb_put_data(skb, sdreq->tlv, sdreq->tlv_len);

		hlist_del(&sdreq->node);

		hlist_add_head(&sdreq->node, &local->pending_sdreqs);
	}

	mutex_unlock(&local->sdreq_lock);

	skb_queue_tail(&local->tx_queue, skb);

	return 0;
}

int nfc_llcp_send_dm(struct nfc_llcp_local *local, u8 ssap, u8 dsap, u8 reason)
{
	struct sk_buff *skb;
	struct nfc_dev *dev;
	u16 size = 1; /* Reason code */

	pr_debug("Sending DM reason 0x%x\n", reason);

	if (local == NULL)
		return -ENODEV;

	dev = local->dev;
	if (dev == NULL)
		return -ENODEV;

	size += LLCP_HEADER_SIZE;
	size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;

	skb = alloc_skb(size, GFP_KERNEL);
	if (skb == NULL)
		return -ENOMEM;

	skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);

	skb = llcp_add_header(skb, dsap, ssap, LLCP_PDU_DM);

	skb_put_data(skb, &reason, 1);

	skb_queue_head(&local->tx_queue, skb);

	return 0;
}

int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
			  struct msghdr *msg, size_t len)
{
	struct sk_buff *pdu;
	struct sock *sk = &sock->sk;
	struct nfc_llcp_local *local;
	size_t frag_len = 0, remaining_len;
	u8 *msg_data, *msg_ptr;
	u16 remote_miu;

	pr_debug("Send I frame len %zd\n", len);

	local = sock->local;
	if (local == NULL)
		return -ENODEV;

	/* Remote is ready but has not acknowledged our frames */
	if((sock->remote_ready &&
	    skb_queue_len(&sock->tx_pending_queue) >= sock->remote_rw &&
	    skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
		pr_err("Pending queue is full %d frames\n",
		       skb_queue_len(&sock->tx_pending_queue));
		return -ENOBUFS;
	}

	/* Remote is not ready and we've been queueing enough frames */
	if ((!sock->remote_ready &&
	     skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
		pr_err("Tx queue is full %d frames\n",
		       skb_queue_len(&sock->tx_queue));
		return -ENOBUFS;
	}

	msg_data = kmalloc(len, GFP_USER | __GFP_NOWARN);
	if (msg_data == NULL)
		return -ENOMEM;

	if (memcpy_from_msg(msg_data, msg, len)) {
		kfree(msg_data);
		return -EFAULT;
	}

	remaining_len = len;
	msg_ptr = msg_data;

	do {
		remote_miu = sock->remote_miu > LLCP_MAX_MIU ?
				LLCP_DEFAULT_MIU : sock->remote_miu;

		frag_len = min_t(size_t, remote_miu, remaining_len);

		pr_debug("Fragment %zd bytes remaining %zd",
			 frag_len, remaining_len);

		pdu = llcp_allocate_pdu(sock, LLCP_PDU_I,
					frag_len + LLCP_SEQUENCE_SIZE);
		if (pdu == NULL) {
			kfree(msg_data);
			return -ENOMEM;
		}

		skb_put(pdu, LLCP_SEQUENCE_SIZE);

		if (likely(frag_len > 0))
			skb_put_data(pdu, msg_ptr, frag_len);

		skb_queue_tail(&sock->tx_queue, pdu);

		lock_sock(sk);

		nfc_llcp_queue_i_frames(sock);

		release_sock(sk);

		remaining_len -= frag_len;
		msg_ptr += frag_len;
	} while (remaining_len > 0);

	kfree(msg_data);

	return len;
}

int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,
			   struct msghdr *msg, size_t len)
{
	struct sk_buff *pdu;
	struct nfc_llcp_local *local;
	size_t frag_len = 0, remaining_len;
	u8 *msg_ptr, *msg_data;
	u16 remote_miu;
	int err;

	pr_debug("Send UI frame len %zd\n", len);

	local = sock->local;
	if (local == NULL)
		return -ENODEV;

	msg_data = kmalloc(len, GFP_USER | __GFP_NOWARN);
	if (msg_data == NULL)
		return -ENOMEM;

	if (memcpy_from_msg(msg_data, msg, len)) {
		kfree(msg_data);
		return -EFAULT;
	}

	remaining_len = len;
	msg_ptr = msg_data;

	do {
		remote_miu = sock->remote_miu > LLCP_MAX_MIU ?
				local->remote_miu : sock->remote_miu;

		frag_len = min_t(size_t, remote_miu, remaining_len);

		pr_debug("Fragment %zd bytes remaining %zd",
			 frag_len, remaining_len);

		pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, 0,
					 frag_len + LLCP_HEADER_SIZE, &err);
		if (pdu == NULL) {
			pr_err("Could not allocate PDU (error=%d)\n", err);
			len -= remaining_len;
			if (len == 0)
				len = err;
			break;
		}

		pdu = llcp_add_header(pdu, dsap, ssap, LLCP_PDU_UI);

		if (likely(frag_len > 0))
			skb_put_data(pdu, msg_ptr, frag_len);

		/* No need to check for the peer RW for UI frames */
		skb_queue_tail(&local->tx_queue, pdu);

		remaining_len -= frag_len;
		msg_ptr += frag_len;
	} while (remaining_len > 0);

	kfree(msg_data);

	return len;
}

int nfc_llcp_send_rr(struct nfc_llcp_sock *sock)
{
	struct sk_buff *skb;
	struct nfc_llcp_local *local;

	pr_debug("Send rr nr %d\n", sock->recv_n);

	local = sock->local;
	if (local == NULL)
		return -ENODEV;

	skb = llcp_allocate_pdu(sock, LLCP_PDU_RR, LLCP_SEQUENCE_SIZE);
	if (skb == NULL)
		return -ENOMEM;

	skb_put(skb, LLCP_SEQUENCE_SIZE);

	skb->data[2] = sock->recv_n;

	skb_queue_head(&local->tx_queue, skb);

	return 0;
}
Commit	Line	Data
1ccea77e	1	// SPDX-License-Identifier: GPL-2.0-or-later
d646960f SO	2	/*
d646960f SO	3	* Copyright (C) 2011 Intel Corporation. All rights reserved.
d646960f SO	4	*/
	5
	6	#define pr_fmt(fmt) "llcp: %s: " fmt, __func__
	7
	8	#include <linux/init.h>
	9	#include <linux/kernel.h>
	10	#include <linux/module.h>
	11	#include <linux/nfc.h>
	12
	13	#include <net/nfc/nfc.h>
	14
30cc4587	15	#include "nfc.h"
d646960f SO	16	#include "llcp.h"
d646960f SO	17
3df40eb3	18	static const u8 llcp_tlv_length[LLCP_TLV_MAX] = {
d646960f SO	19	0,
	20	1, /* VERSION */
	21	2, /* MIUX */
	22	2, /* WKS */
	23	1, /* LTO */
	24	1, /* RW */
	25	0, /* SN */
	26	1, /* OPT */
	27	0, /* SDREQ */
	28	2, /* SDRES */
	29
	30	};
	31
3df40eb3	32	static u8 llcp_tlv8(const u8 *tlv, u8 type)
d646960f SO	33	{
	34	if (tlv[0] != type \|\| tlv[1] != llcp_tlv_length[tlv[0]])
	35	return 0;
	36
	37	return tlv[2];
	38	}
	39
3df40eb3	40	static u16 llcp_tlv16(const u8 *tlv, u8 type)
d646960f SO	41	{
	42	if (tlv[0] != type \|\| tlv[1] != llcp_tlv_length[tlv[0]])
	43	return 0;
	44
	45	return be16_to_cpu(((__be16 )(tlv + 2)));
	46	}
	47
	48
3df40eb3	49	static u8 llcp_tlv_version(const u8 *tlv)
d646960f SO	50	{
	51	return llcp_tlv8(tlv, LLCP_TLV_VERSION);
	52	}
	53
3df40eb3	54	static u16 llcp_tlv_miux(const u8 *tlv)
d646960f	55	{
76762b73	56	return llcp_tlv16(tlv, LLCP_TLV_MIUX) & 0x7ff;
d646960f SO	57	}
d646960f SO	58
3df40eb3	59	static u16 llcp_tlv_wks(const u8 *tlv)
d646960f SO	60	{
	61	return llcp_tlv16(tlv, LLCP_TLV_WKS);
	62	}
	63
3df40eb3	64	static u16 llcp_tlv_lto(const u8 *tlv)
d646960f SO	65	{
	66	return llcp_tlv8(tlv, LLCP_TLV_LTO);
	67	}
	68
3df40eb3	69	static u8 llcp_tlv_opt(const u8 *tlv)
d646960f SO	70	{
	71	return llcp_tlv8(tlv, LLCP_TLV_OPT);
	72	}
	73
3df40eb3	74	static u8 llcp_tlv_rw(const u8 *tlv)
d646960f SO	75	{
	76	return llcp_tlv8(tlv, LLCP_TLV_RW) & 0xf;
	77	}
	78
3df40eb3	79	u8 nfc_llcp_build_tlv(u8 type, const u8 value, u8 value_length, u8 *tlv_length)
d646960f SO	80	{
	81	u8 *tlv, length;
	82
	83	pr_debug("type %d\n", type);
	84
	85	if (type >= LLCP_TLV_MAX)
	86	return NULL;
	87
	88	length = llcp_tlv_length[type];
	89	if (length == 0 && value_length == 0)
	90	return NULL;
324b0af6	91	else if (length == 0)
d646960f SO	92	length = value_length;
	93
	94	*tlv_length = 2 + length;
	95	tlv = kzalloc(2 + length, GFP_KERNEL);
	96	if (tlv == NULL)
	97	return tlv;
	98
	99	tlv[0] = type;
	100	tlv[1] = length;
	101	memcpy(tlv + 2, value, length);
	102
	103	return tlv;
	104	}
	105
e0ae7bac TE	106	struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap)
	107	{
	108	struct nfc_llcp_sdp_tlv *sdres;
	109	u8 value[2];
	110
	111	sdres = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
	112	if (sdres == NULL)
	113	return NULL;
	114
	115	value[0] = tid;
	116	value[1] = sap;
	117
	118	sdres->tlv = nfc_llcp_build_tlv(LLCP_TLV_SDRES, value, 2,
	119	&sdres->tlv_len);
	120	if (sdres->tlv == NULL) {
	121	kfree(sdres);
	122	return NULL;
	123	}
	124
	125	sdres->tid = tid;
	126	sdres->sap = sap;
	127
	128	INIT_HLIST_NODE(&sdres->node);
	129
	130	return sdres;
	131	}
	132
3df40eb3	133	struct nfc_llcp_sdp_tlv nfc_llcp_build_sdreq_tlv(u8 tid, const char uri,
d9b8d8e1 TE	134	size_t uri_len)
	135	{
	136	struct nfc_llcp_sdp_tlv *sdreq;
	137
	138	pr_debug("uri: %s, len: %zu\n", uri, uri_len);
	139
fe9c8426 KC	140	/* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
	141	if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
	142	return NULL;
	143
d9b8d8e1 TE	144	sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
	145	if (sdreq == NULL)
	146	return NULL;
	147
	148	sdreq->tlv_len = uri_len + 3;
	149
	150	if (uri[uri_len - 1] == 0)
	151	sdreq->tlv_len--;
	152
	153	sdreq->tlv = kzalloc(sdreq->tlv_len + 1, GFP_KERNEL);
	154	if (sdreq->tlv == NULL) {
	155	kfree(sdreq);
	156	return NULL;
	157	}
	158
	159	sdreq->tlv[0] = LLCP_TLV_SDREQ;
	160	sdreq->tlv[1] = sdreq->tlv_len - 2;
	161	sdreq->tlv[2] = tid;
	162
	163	sdreq->tid = tid;
	164	sdreq->uri = sdreq->tlv + 3;
	165	memcpy(sdreq->uri, uri, uri_len);
	166
40213fa8 TE	167	sdreq->time = jiffies;
40213fa8 TE	168
d9b8d8e1 TE	169	INIT_HLIST_NODE(&sdreq->node);
	170
	171	return sdreq;
	172	}
	173
e0ae7bac TE	174	void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp)
	175	{
	176	kfree(sdp->tlv);
	177	kfree(sdp);
	178	}
	179
d9b8d8e1 TE	180	void nfc_llcp_free_sdp_tlv_list(struct hlist_head *head)
	181	{
	182	struct nfc_llcp_sdp_tlv *sdp;
	183	struct hlist_node *n;
	184
	185	hlist_for_each_entry_safe(sdp, n, head, node) {
	186	hlist_del(&sdp->node);
	187
	188	nfc_llcp_free_sdp_tlv(sdp);
	189	}
	190	}
	191
7a06e586	192	int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
3df40eb3	193	const u8 *tlv_array, u16 tlv_array_len)
d646960f	194	{
3df40eb3 KK	195	const u8 *tlv = tlv_array;
3df40eb3 KK	196	u8 type, length, offset = 0;
d646960f SO	197
	198	pr_debug("TLV array length %d\n", tlv_array_len);
	199
	200	if (local == NULL)
	201	return -ENODEV;
	202
	203	while (offset < tlv_array_len) {
	204	type = tlv[0];
	205	length = tlv[1];
	206
	207	pr_debug("type 0x%x length %d\n", type, length);
	208
	209	switch (type) {
	210	case LLCP_TLV_VERSION:
	211	local->remote_version = llcp_tlv_version(tlv);
	212	break;
	213	case LLCP_TLV_MIUX:
	214	local->remote_miu = llcp_tlv_miux(tlv) + 128;
	215	break;
	216	case LLCP_TLV_WKS:
	217	local->remote_wks = llcp_tlv_wks(tlv);
	218	break;
	219	case LLCP_TLV_LTO:
	220	local->remote_lto = llcp_tlv_lto(tlv) * 10;
	221	break;
	222	case LLCP_TLV_OPT:
	223	local->remote_opt = llcp_tlv_opt(tlv);
	224	break;
7a06e586 SO	225	default:
	226	pr_err("Invalid gt tlv value 0x%x\n", type);
	227	break;
	228	}
	229
	230	offset += length + 2;
	231	tlv += length + 2;
	232	}
	233
	234	pr_debug("version 0x%x miu %d lto %d opt 0x%x wks 0x%x\n",
	235	local->remote_version, local->remote_miu,
	236	local->remote_lto, local->remote_opt,
	237	local->remote_wks);
	238
	239	return 0;
	240	}
	241
	242	int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
3df40eb3	243	const u8 *tlv_array, u16 tlv_array_len)
7a06e586	244	{
3df40eb3 KK	245	const u8 *tlv = tlv_array;
3df40eb3 KK	246	u8 type, length, offset = 0;
7a06e586 SO	247
	248	pr_debug("TLV array length %d\n", tlv_array_len);
	249
	250	if (sock == NULL)
	251	return -ENOTCONN;
	252
	253	while (offset < tlv_array_len) {
	254	type = tlv[0];
	255	length = tlv[1];
	256
	257	pr_debug("type 0x%x length %d\n", type, length);
	258
	259	switch (type) {
93d7e490	260	case LLCP_TLV_MIUX:
e4306bec	261	sock->remote_miu = llcp_tlv_miux(tlv) + 128;
93d7e490	262	break;
d646960f	263	case LLCP_TLV_RW:
e4306bec	264	sock->remote_rw = llcp_tlv_rw(tlv);
d646960f	265	break;
9dda50f4 SO	266	case LLCP_TLV_SN:
9dda50f4 SO	267	break;
d646960f SO	268	default:
	269	pr_err("Invalid gt tlv value 0x%x\n", type);
	270	break;
	271	}
	272
	273	offset += length + 2;
	274	tlv += length + 2;
	275	}
	276
e4306bec SO	277	pr_debug("sock %p rw %d miu %d\n", sock,
e4306bec SO	278	sock->remote_rw, sock->remote_miu);
d646960f SO	279
	280	return 0;
	281	}
	282
	283	static struct sk_buff llcp_add_header(struct sk_buff pdu,
427a2eb1	284	u8 dsap, u8 ssap, u8 ptype)
d646960f SO	285	{
	286	u8 header[2];
	287
	288	pr_debug("ptype 0x%x dsap 0x%x ssap 0x%x\n", ptype, dsap, ssap);
	289
	290	header[0] = (u8)((dsap << 2) \| (ptype >> 2));
	291	header[1] = (u8)((ptype << 6) \| ssap);
	292
	293	pr_debug("header 0x%x 0x%x\n", header[0], header[1]);
	294
59ae1d12	295	skb_put_data(pdu, header, LLCP_HEADER_SIZE);
d646960f SO	296
	297	return pdu;
	298	}
	299
3df40eb3	300	static struct sk_buff llcp_add_tlv(struct sk_buff pdu, const u8 *tlv,
427a2eb1	301	u8 tlv_length)
d646960f SO	302	{
	303	/* XXX Add an skb length check */
	304
	305	if (tlv == NULL)
	306	return NULL;
	307
59ae1d12	308	skb_put_data(pdu, tlv, tlv_length);
d646960f SO	309
	310	return pdu;
	311	}
	312
	313	static struct sk_buff llcp_allocate_pdu(struct nfc_llcp_sock sock,
427a2eb1	314	u8 cmd, u16 size)
d646960f SO	315	{
	316	struct sk_buff *skb;
	317	int err;
	318
	319	if (sock->ssap == 0)
	320	return NULL;
	321
	322	skb = nfc_alloc_send_skb(sock->dev, &sock->sk, MSG_DONTWAIT,
427a2eb1	323	size + LLCP_HEADER_SIZE, &err);
d646960f SO	324	if (skb == NULL) {
	325	pr_err("Could not allocate PDU\n");
	326	return NULL;
	327	}
	328
	329	skb = llcp_add_header(skb, sock->dsap, sock->ssap, cmd);
	330
	331	return skb;
	332	}
	333
58e3dd15	334	int nfc_llcp_send_disconnect(struct nfc_llcp_sock *sock)
d646960f SO	335	{
	336	struct sk_buff *skb;
	337	struct nfc_dev *dev;
	338	struct nfc_llcp_local *local;
d646960f	339
d646960f SO	340	local = sock->local;
	341	if (local == NULL)
	342	return -ENODEV;
	343
	344	dev = sock->dev;
	345	if (dev == NULL)
	346	return -ENODEV;
	347
92223906	348	skb = llcp_allocate_pdu(sock, LLCP_PDU_DISC, 0);
d646960f SO	349	if (skb == NULL)
	350	return -ENOMEM;
	351
d646960f SO	352	skb_queue_tail(&local->tx_queue, skb);
	353
	354	return 0;
	355	}
	356
	357	int nfc_llcp_send_symm(struct nfc_dev *dev)
	358	{
	359	struct sk_buff *skb;
	360	struct nfc_llcp_local *local;
	361	u16 size = 0;
	362
d646960f SO	363	local = nfc_llcp_find_local(dev);
	364	if (local == NULL)
	365	return -ENODEV;
	366
	367	size += LLCP_HEADER_SIZE;
	368	size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
	369
	370	skb = alloc_skb(size, GFP_KERNEL);
	371	if (skb == NULL)
	372	return -ENOMEM;
	373
	374	skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
	375
	376	skb = llcp_add_header(skb, 0, 0, LLCP_PDU_SYMM);
	377
2c2d45bd TE	378	__net_timestamp(skb);
2c2d45bd TE	379
57be1f3f	380	nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_TX);
4463523b	381
d646960f	382	return nfc_data_exchange(dev, local->target_idx, skb,
427a2eb1	383	nfc_llcp_recv, local);
d646960f SO	384	}
	385
	386	int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
	387	{
	388	struct nfc_llcp_local *local;
	389	struct sk_buff *skb;
3df40eb3 KK	390	const u8 *service_name_tlv = NULL;
	391	const u8 *miux_tlv = NULL;
	392	const u8 *rw_tlv = NULL;
	393	u8 service_name_tlv_length, miux_tlv_length, rw_tlv_length, rw;
d646960f	394	int err;
e5b53c0a CR	395	u16 size = 0;
e5b53c0a CR	396	__be16 miux;
d646960f	397
d646960f SO	398	local = sock->local;
	399	if (local == NULL)
	400	return -ENODEV;
	401
	402	if (sock->service_name != NULL) {
	403	service_name_tlv = nfc_llcp_build_tlv(LLCP_TLV_SN,
427a2eb1 SO	404	sock->service_name,
	405	sock->service_name_len,
	406	&service_name_tlv_length);
58bdd544 Y	407	if (!service_name_tlv) {
	408	err = -ENOMEM;
	409	goto error_tlv;
	410	}
d646960f SO	411	size += service_name_tlv_length;
	412	}
	413
06d44f80	414	/* If the socket parameters are not set, use the local ones */
5eef6669 SO	415	miux = be16_to_cpu(sock->miux) > LLCP_MAX_MIUX ?
5eef6669 SO	416	local->miux : sock->miux;
06d44f80 SO	417	rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;
	418
	419	miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
427a2eb1	420	&miux_tlv_length);
58bdd544 Y	421	if (!miux_tlv) {
	422	err = -ENOMEM;
	423	goto error_tlv;
	424	}
eda21f16 SO	425	size += miux_tlv_length;
eda21f16 SO	426
06d44f80	427	rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
58bdd544 Y	428	if (!rw_tlv) {
	429	err = -ENOMEM;
	430	goto error_tlv;
	431	}
eda21f16 SO	432	size += rw_tlv_length;
eda21f16 SO	433
d646960f SO	434	pr_debug("SKB size %d SN length %zu\n", size, sock->service_name_len);
	435
	436	skb = llcp_allocate_pdu(sock, LLCP_PDU_CONNECT, size);
	437	if (skb == NULL) {
	438	err = -ENOMEM;
	439	goto error_tlv;
	440	}
	441
de9e5aeb TE	442	llcp_add_tlv(skb, service_name_tlv, service_name_tlv_length);
	443	llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
	444	llcp_add_tlv(skb, rw_tlv, rw_tlv_length);
eda21f16	445
d646960f SO	446	skb_queue_tail(&local->tx_queue, skb);
d646960f SO	447
256f3ee3	448	err = 0;
d646960f SO	449
d646960f SO	450	error_tlv:
256f3ee3 TE	451	if (err)
256f3ee3 TE	452	pr_err("error %d\n", err);
d646960f SO	453
d646960f SO	454	kfree(service_name_tlv);
eda21f16 SO	455	kfree(miux_tlv);
eda21f16 SO	456	kfree(rw_tlv);
d646960f SO	457
	458	return err;
	459	}
	460
	461	int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
	462	{
	463	struct nfc_llcp_local *local;
	464	struct sk_buff *skb;
3df40eb3 KK	465	const u8 *miux_tlv = NULL;
	466	const u8 *rw_tlv = NULL;
	467	u8 miux_tlv_length, rw_tlv_length, rw;
eda21f16	468	int err;
e5b53c0a CR	469	u16 size = 0;
e5b53c0a CR	470	__be16 miux;
d646960f	471
d646960f SO	472	local = sock->local;
	473	if (local == NULL)
	474	return -ENODEV;
	475
06d44f80	476	/* If the socket parameters are not set, use the local ones */
5eef6669 SO	477	miux = be16_to_cpu(sock->miux) > LLCP_MAX_MIUX ?
5eef6669 SO	478	local->miux : sock->miux;
06d44f80 SO	479	rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;
	480
	481	miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
427a2eb1	482	&miux_tlv_length);
58bdd544 Y	483	if (!miux_tlv) {
	484	err = -ENOMEM;
	485	goto error_tlv;
	486	}
eda21f16 SO	487	size += miux_tlv_length;
eda21f16 SO	488
06d44f80	489	rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
58bdd544 Y	490	if (!rw_tlv) {
	491	err = -ENOMEM;
	492	goto error_tlv;
	493	}
eda21f16 SO	494	size += rw_tlv_length;
	495
	496	skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, size);
	497	if (skb == NULL) {
	498	err = -ENOMEM;
	499	goto error_tlv;
	500	}
	501
de9e5aeb TE	502	llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
de9e5aeb TE	503	llcp_add_tlv(skb, rw_tlv, rw_tlv_length);
d646960f SO	504
	505	skb_queue_tail(&local->tx_queue, skb);
	506
256f3ee3	507	err = 0;
eda21f16 SO	508
eda21f16 SO	509	error_tlv:
256f3ee3 TE	510	if (err)
256f3ee3 TE	511	pr_err("error %d\n", err);
eda21f16 SO	512
	513	kfree(miux_tlv);
	514	kfree(rw_tlv);
	515
	516	return err;
d646960f SO	517	}
d646960f SO	518
e0ae7bac TE	519	static struct sk_buff nfc_llcp_allocate_snl(struct nfc_llcp_local local,
e0ae7bac TE	520	size_t tlv_length)
c43bb03d SO	521	{
	522	struct sk_buff *skb;
	523	struct nfc_dev *dev;
c43bb03d SO	524	u16 size = 0;
c43bb03d SO	525
c43bb03d	526	if (local == NULL)
e0ae7bac	527	return ERR_PTR(-ENODEV);
c43bb03d SO	528
	529	dev = local->dev;
	530	if (dev == NULL)
e0ae7bac	531	return ERR_PTR(-ENODEV);
c43bb03d SO	532
	533	size += LLCP_HEADER_SIZE;
	534	size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
e0ae7bac	535	size += tlv_length;
c43bb03d SO	536
c43bb03d SO	537	skb = alloc_skb(size, GFP_KERNEL);
e0ae7bac TE	538	if (skb == NULL)
e0ae7bac TE	539	return ERR_PTR(-ENOMEM);
c43bb03d SO	540
	541	skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
	542
	543	skb = llcp_add_header(skb, LLCP_SAP_SDP, LLCP_SAP_SDP, LLCP_PDU_SNL);
	544
e0ae7bac TE	545	return skb;
e0ae7bac TE	546	}
c43bb03d	547
e0ae7bac TE	548	int nfc_llcp_send_snl_sdres(struct nfc_llcp_local *local,
	549	struct hlist_head *tlv_list, size_t tlvs_len)
	550	{
	551	struct nfc_llcp_sdp_tlv *sdp;
	552	struct hlist_node *n;
	553	struct sk_buff *skb;
	554
	555	skb = nfc_llcp_allocate_snl(local, tlvs_len);
	556	if (IS_ERR(skb))
	557	return PTR_ERR(skb);
	558
	559	hlist_for_each_entry_safe(sdp, n, tlv_list, node) {
59ae1d12	560	skb_put_data(skb, sdp->tlv, sdp->tlv_len);
c43bb03d	561
e0ae7bac TE	562	hlist_del(&sdp->node);
	563
	564	nfc_llcp_free_sdp_tlv(sdp);
	565	}
	566
	567	skb_queue_tail(&local->tx_queue, skb);
c43bb03d SO	568
	569	return 0;
	570	}
	571
d9b8d8e1 TE	572	int nfc_llcp_send_snl_sdreq(struct nfc_llcp_local *local,
	573	struct hlist_head *tlv_list, size_t tlvs_len)
	574	{
	575	struct nfc_llcp_sdp_tlv *sdreq;
	576	struct hlist_node *n;
	577	struct sk_buff *skb;
	578
	579	skb = nfc_llcp_allocate_snl(local, tlvs_len);
	580	if (IS_ERR(skb))
	581	return PTR_ERR(skb);
	582
	583	mutex_lock(&local->sdreq_lock);
	584
40213fa8 TE	585	if (hlist_empty(&local->pending_sdreqs))
	586	mod_timer(&local->sdreq_timer,
	587	jiffies + msecs_to_jiffies(3 * local->remote_lto));
	588
d9b8d8e1 TE	589	hlist_for_each_entry_safe(sdreq, n, tlv_list, node) {
	590	pr_debug("tid %d for %s\n", sdreq->tid, sdreq->uri);
	591
59ae1d12	592	skb_put_data(skb, sdreq->tlv, sdreq->tlv_len);
d9b8d8e1 TE	593
	594	hlist_del(&sdreq->node);
	595
	596	hlist_add_head(&sdreq->node, &local->pending_sdreqs);
	597	}
	598
	599	mutex_unlock(&local->sdreq_lock);
	600
	601	skb_queue_tail(&local->tx_queue, skb);
	602
	603	return 0;
	604	}
	605
d646960f SO	606	int nfc_llcp_send_dm(struct nfc_llcp_local *local, u8 ssap, u8 dsap, u8 reason)
	607	{
	608	struct sk_buff *skb;
	609	struct nfc_dev *dev;
	610	u16 size = 1; /* Reason code */
	611
	612	pr_debug("Sending DM reason 0x%x\n", reason);
	613
	614	if (local == NULL)
	615	return -ENODEV;
	616
	617	dev = local->dev;
	618	if (dev == NULL)
	619	return -ENODEV;
	620
	621	size += LLCP_HEADER_SIZE;
	622	size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
	623
	624	skb = alloc_skb(size, GFP_KERNEL);
	625	if (skb == NULL)
	626	return -ENOMEM;
	627
	628	skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
	629
ffc29315	630	skb = llcp_add_header(skb, dsap, ssap, LLCP_PDU_DM);
d646960f	631
59ae1d12	632	skb_put_data(skb, &reason, 1);
d646960f SO	633
	634	skb_queue_head(&local->tx_queue, skb);
	635
	636	return 0;
	637	}
	638
53a0ac2e	639	int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
427a2eb1	640	struct msghdr *msg, size_t len)
53a0ac2e SO	641	{
53a0ac2e SO	642	struct sk_buff *pdu;
e65b0f46 SO	643	struct sock *sk = &sock->sk;
	644	struct nfc_llcp_local *local;
	645	size_t frag_len = 0, remaining_len;
	646	u8 msg_data, msg_ptr;
66cbfa10	647	u16 remote_miu;
53a0ac2e	648
e65b0f46	649	pr_debug("Send I frame len %zd\n", len);
53a0ac2e	650
e65b0f46 SO	651	local = sock->local;
	652	if (local == NULL)
	653	return -ENODEV;
53a0ac2e	654
dd2bf43f SO	655	/* Remote is ready but has not acknowledged our frames */
dd2bf43f SO	656	if((sock->remote_ready &&
e4306bec SO	657	skb_queue_len(&sock->tx_pending_queue) >= sock->remote_rw &&
e4306bec SO	658	skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
dd2bf43f SO	659	pr_err("Pending queue is full %d frames\n",
	660	skb_queue_len(&sock->tx_pending_queue));
	661	return -ENOBUFS;
	662	}
	663
	664	/* Remote is not ready and we've been queueing enough frames */
	665	if ((!sock->remote_ready &&
e4306bec	666	skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
dd2bf43f SO	667	pr_err("Tx queue is full %d frames\n",
	668	skb_queue_len(&sock->tx_queue));
	669	return -ENOBUFS;
	670	}
	671
81ca7835	672	msg_data = kmalloc(len, GFP_USER \| __GFP_NOWARN);
e65b0f46 SO	673	if (msg_data == NULL)
e65b0f46 SO	674	return -ENOMEM;
53a0ac2e	675
6ce8e9ce	676	if (memcpy_from_msg(msg_data, msg, len)) {
427a2eb1 SO	677	kfree(msg_data);
427a2eb1 SO	678	return -EFAULT;
53a0ac2e SO	679	}
53a0ac2e SO	680
e65b0f46 SO	681	remaining_len = len;
	682	msg_ptr = msg_data;
	683
0b23d666	684	do {
66cbfa10	685	remote_miu = sock->remote_miu > LLCP_MAX_MIU ?
11bfb1c4	686	LLCP_DEFAULT_MIU : sock->remote_miu;
66cbfa10 TE	687
66cbfa10 TE	688	frag_len = min_t(size_t, remote_miu, remaining_len);
53a0ac2e	689
e65b0f46 SO	690	pr_debug("Fragment %zd bytes remaining %zd",
e65b0f46 SO	691	frag_len, remaining_len);
53a0ac2e	692
e65b0f46 SO	693	pdu = llcp_allocate_pdu(sock, LLCP_PDU_I,
e65b0f46 SO	694	frag_len + LLCP_SEQUENCE_SIZE);
43d53c29 SJ	695	if (pdu == NULL) {
43d53c29 SJ	696	kfree(msg_data);
e65b0f46	697	return -ENOMEM;
43d53c29	698	}
e65b0f46 SO	699
	700	skb_put(pdu, LLCP_SEQUENCE_SIZE);
	701
0b23d666	702	if (likely(frag_len > 0))
59ae1d12	703	skb_put_data(pdu, msg_ptr, frag_len);
e65b0f46	704
bdbc59b3	705	skb_queue_tail(&sock->tx_queue, pdu);
e65b0f46 SO	706
	707	lock_sock(sk);
	708
	709	nfc_llcp_queue_i_frames(sock);
	710
	711	release_sock(sk);
	712
	713	remaining_len -= frag_len;
b4838d12	714	msg_ptr += frag_len;
0b23d666	715	} while (remaining_len > 0);
53a0ac2e	716
e65b0f46	717	kfree(msg_data);
53a0ac2e	718
43472fff	719	return len;
53a0ac2e	720	}
d094afa1	721
94f418a2 SO	722	int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,
	723	struct msghdr *msg, size_t len)
	724	{
	725	struct sk_buff *pdu;
	726	struct nfc_llcp_local *local;
	727	size_t frag_len = 0, remaining_len;
6e950fd2	728	u8 msg_ptr, msg_data;
66cbfa10	729	u16 remote_miu;
94f418a2 SO	730	int err;
	731
	732	pr_debug("Send UI frame len %zd\n", len);
	733
	734	local = sock->local;
	735	if (local == NULL)
	736	return -ENODEV;
	737
81ca7835	738	msg_data = kmalloc(len, GFP_USER \| __GFP_NOWARN);
6e950fd2 SO	739	if (msg_data == NULL)
	740	return -ENOMEM;
	741
6ce8e9ce	742	if (memcpy_from_msg(msg_data, msg, len)) {
6e950fd2 SO	743	kfree(msg_data);
	744	return -EFAULT;
	745	}
	746
94f418a2	747	remaining_len = len;
6e950fd2	748	msg_ptr = msg_data;
94f418a2	749
0b23d666	750	do {
66cbfa10 TE	751	remote_miu = sock->remote_miu > LLCP_MAX_MIU ?
	752	local->remote_miu : sock->remote_miu;
	753
	754	frag_len = min_t(size_t, remote_miu, remaining_len);
94f418a2 SO	755
	756	pr_debug("Fragment %zd bytes remaining %zd",
	757	frag_len, remaining_len);
	758
3bc53be9	759	pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, 0,
94f418a2 SO	760	frag_len + LLCP_HEADER_SIZE, &err);
94f418a2 SO	761	if (pdu == NULL) {
3bc53be9 TH	762	pr_err("Could not allocate PDU (error=%d)\n", err);
	763	len -= remaining_len;
	764	if (len == 0)
	765	len = err;
	766	break;
94f418a2 SO	767	}
	768
	769	pdu = llcp_add_header(pdu, dsap, ssap, LLCP_PDU_UI);
	770
0b23d666	771	if (likely(frag_len > 0))
59ae1d12	772	skb_put_data(pdu, msg_ptr, frag_len);
94f418a2 SO	773
	774	/* No need to check for the peer RW for UI frames */
	775	skb_queue_tail(&local->tx_queue, pdu);
	776
	777	remaining_len -= frag_len;
	778	msg_ptr += frag_len;
0b23d666	779	} while (remaining_len > 0);
94f418a2	780
6e950fd2 SO	781	kfree(msg_data);
6e950fd2 SO	782
94f418a2 SO	783	return len;
	784	}
	785
d094afa1 SO	786	int nfc_llcp_send_rr(struct nfc_llcp_sock *sock)
	787	{
	788	struct sk_buff *skb;
	789	struct nfc_llcp_local *local;
	790
	791	pr_debug("Send rr nr %d\n", sock->recv_n);
	792
	793	local = sock->local;
	794	if (local == NULL)
	795	return -ENODEV;
	796
	797	skb = llcp_allocate_pdu(sock, LLCP_PDU_RR, LLCP_SEQUENCE_SIZE);
	798	if (skb == NULL)
	799	return -ENOMEM;
	800
	801	skb_put(skb, LLCP_SEQUENCE_SIZE);
	802
279cf174	803	skb->data[2] = sock->recv_n;
d094afa1 SO	804
	805	skb_queue_head(&local->tx_queue, skb);
	806
	807	return 0;
	808	}