1 /*
2  * This file and its contents are supplied under the terms of the
3  * Common Development and Distribution License ("CDDL"), version 1.0.
4  * You may only use this file in accordance with the terms of version
5  * 1.0 of the CDDL.
6  *
7  * A full copy of the text of the CDDL should have accompanied this
8  * source.  A copy of the CDDL is also available via the Internet at
9  * http://www.illumos.org/license/CDDL.
10  */
11 
12 /*
13  * Copyright 2019, Joyent, Inc.
14  */
15 
16 /*
17  * USB CCID class driver
18  *
19  * Slot Detection
20  * --------------
21  *
22  * A CCID reader has one or more slots, each of which may or may not have a ICC
23  * (integrated circuit card) present. Some readers actually have a card that's
24  * permanently plugged in while other readers allow for cards to be inserted and
25  * removed. We model all CCID readers that don't have removable cards as ones
26  * that are removable, but never fire any events. Readers with removable cards
27  * are required to have an Interrupt-IN pipe.
28  *
29  * Each slot starts in an unknown state. After attaching we always kick off a
30  * discovery. When a change event comes in, that causes us to kick off a
31  * discovery again, though we focus it only on those endpoints that have noted a
32  * change. At attach time we logically mark that every endpoint has changed,
33  * allowing us to figure out what its actual state is. We don't rely on any
34  * initial Interrupt-IN polling to allow for the case where either the hardware
35  * doesn't report it or to better handle the devices without an Interrupt-IN
36  * entry. Just because we open up the Interrupt-IN pipe, hardware is not
37  * obligated to tell us, as the detaching and reattaching of a driver will not
38  * cause a power cycle.
39  *
40  * The Interrupt-IN exception callback may need to restart polling. In addition,
41  * we may fail to start or restart polling due to a transient issue. In cases
42  * where the attempt to start polling has failed, we try again in one second
43  * with a timeout.
44  *
45  * Discovery is run through a taskq. The various slots are checked serially. If
46  * a discovery is running when another change event comes in, we flag ourselves
47  * for a follow up run. This means that it's possible that we end up processing
48  * items early and that the follow up run is ignored.
49  *
50  * Two state flags are used to keep track of this dance: CCID_F_WORKER_REQUESTED
51  * and CCID_F_WORKER_RUNNING. The first is used to indicate that discovery is
52  * desired. The second is to indicate that it is actively running. When
53  * discovery is requested, the caller first checks the current flags. If neither
54  * flag is set, then it knows that it can kick off discovery. Regardless if it
55  * can kick off the taskq, it always sets requested. Once the taskq entry
56  * starts, it removes any DISCOVER_REQUESTED flags and sets DISCOVER_RUNNING. If
57  * at the end of discovery, we find that another request has been made, the
58  * discovery function will kick off another entry in the taskq.
59  *
60  * The one possible problem with this model is that it means that we aren't
61  * throttling the set of incoming requests with respect to taskq dispatches.
62  * However, because these are only driven by an Interrupt-IN pipe, it is hoped
63  * that the frequency will be rather reduced. If it turns out that that's not
64  * the case, we may need to use a timeout or another trick to ensure that only
65  * one discovery per tick or so is initialized. The main reason we don't just do
66  * that off the bat and add a delay is because of contactless cards which may
67  * need to be acted upon in a soft real-time fashion.
68  *
69  * Command Handling
70  * ----------------
71  *
72  * Commands are issued to a CCID reader on a Bulk-OUT pipe. Responses are
73  * generated as a series of one or more messages on a Bulk-IN pipe. To correlate
74  * these commands a sequence number is used. This sequence number is one byte
75  * and can be in the range [ CCID_SEQ_MIN, CCID_SEQ_MAX ]. To keep track of the
76  * allocated IDs we leverage an ID space.
77  *
78  * A CCID reader contains a number of slots. Each slot can be addressed
79  * separately as each slot represents a separate place that a card may be
80  * inserted or not. A given slot may only have a single outstanding command. A
81  * given CCID reader may only have a number of commands outstanding to the CCID
82  * device as a whole based on a value in the class descriptor (see the
83  * ccd_bMacCCIDBusySlots member of the ccid_class_descr_t).
84  *
85  * To simplify the driver, we only support issuing a single command to a CCID
86  * reader at any given time. All commands that are outstanding are queued in a
87  * per-device list ccid_command_queue. The head of the queue is the current
88  * command that we believe is outstanding to the reader or will be shortly. The
89  * command is issued by sending a Bulk-OUT request with a CCID header. Once we
90  * have the Bulk-OUT request acknowledged, we begin sending Bulk-IN messages to
91  * the controller. Once the Bulk-IN message is acknowledged, then we complete
92  * the command and proceed to the next command. This is summarized in the
93  * following state machine:
94  *
95  *              +-----------------------------------------------------+
96  *              |                                                     |
97  *              |                        ccid_command_queue           |
98  *              |                    +---+---+---------+---+---+      |
99  *              v                    | h |   |         |   | t |      |
100  *  +-------------------------+      | e |   |         |   | a |      |
101  *  | ccid_command_dispatch() |<-----| a |   |   ...   |   | i |      |
102  *  +-----------+-------------+      | d |   |         |   | l |      |
103  *              |                    +---+---+---------+---+---+      |
104  *              v                                                     |
105  *  +-------------------------+      +-------------------------+      |
106  *  | usb_pipe_bulk_xfer()    |----->| ccid_dispatch_bulk_cb() |      |
107  *  | ccid_bulkout_pipe       |      +------------+------------+      |
108  *  +-------------------------+                   |                   |
109  *                                                |                   |
110  *              |                                 v                   |
111  *              |                    +-------------------------+      |
112  *              |                    | ccid_bulkin_schedule()  |      |
113  *              v                    +------------+------------+      |
114  *                                                |                   |
115  *     /--------------------\                     |                   |
116  *    /                      \                    v                   |
117  *    |  ###    CCID HW      |       +-------------------------+      |
118  *    |  ###                 |       | usb_pipe_bulk_xfer()    |      |
119  *    |                      | ----> | ccid_bulkin_pipe        |      |
120  *    |                      |       +------------+------------+      |
121  *    \                      /                    |                   |
122  *     \--------------------/                     |                   |
123  *                                                v                   |
124  *                                   +-------------------------+      |
125  *                                   | ccid_reply_bulk_cb()    |      |
126  *                                   +------------+------------+      |
127  *                                                |                   |
128  *                                                |                   |
129  *                                                v                   |
130  *                                   +-------------------------+      |
131  *                                   | ccid_command_complete() +------+
132  *                                   +-------------------------+
133  *
134  *
135  * APDU and TPDU Processing and Parameter Selection
136  * ------------------------------------------------
137  *
138  * Readers provide four different modes for us to be able to transmit data to
139  * and from the card. These are:
140  *
141  *   1. Character Mode
142  *   2. TPDU Mode
143  *   3. Short APDU Mode
144  *   4. Extended APDU Mode
145  *
146  * Readers either support mode 1, mode 2, mode 3, or mode 3 and 4. All readers
147  * that support extended APDUs support short APDUs. At this time, we do not
148  * support character mode or TPDU mode, and we use only short APDUs even for
149  * readers that support extended APDUs.
150  *
151  * The ICC and the reader need to be in agreement in order for them to be able
152  * to exchange information. The ICC indicates what it supports by replying to a
153  * power on command with an ATR (answer to reset). This data can be parsed to
154  * indicate which of two protocols the ICC supports. These protocols are
155  * referred to as:
156  *
157  *  o T=0
158  *  o T=1
159  *
160  * These protocols are defined in the ISO/IEC 7816-3:2006 specification. When a
161  * reader supports an APDU mode, then the driver does not have to worry about
162  * the underlying protocol and can just send an application data unit (APDU).
163  * Otherwise, the driver must take the application data (APDU) and transform it
164  * into the form required by the corresponding protocol.
165  *
166  * There are several parameters that need to be negotiated to ensure that the
167  * protocols work correctly. To negotiate these parameters and to select a
168  * protocol, the driver must construct a PPS (protocol and parameters structure)
169  * request and exchange that with the ICC. A reader may optionally take care of
170  * performing this and indicates its support for this in dwFeatures member of
171  * the USB class descriptor.
172  *
173  * In addition, the reader itself must often be told of these configuration
174  * changes through the means of a CCID_REQUEST_SET_PARAMS command. Once both of
175  * these have been performed, the reader and ICC can communicate to their hearts
176  * desire.
177  *
178  * Both the negotiation and the setting of the parameters can be performed
179  * automatically by the CCID reader. When the reader supports APDU exchanges,
180  * then it must support some aspects of this negotiation. Because of that, we
181  * never consider performing this and only support readers that offer this kind
182  * of automation.
183  *
184  * User I/O Basics
185  * ---------------
186  *
187  * A user performs I/O by writing APDUs (Application Protocol Data Units). A
188  * user issues a system call that ends up in write(9E) (write(2), writev(2),
189  * pwrite(2), pwritev(2), etc.). The user data is consumed by the CCID driver
190  * and a series of commands will then be issued to the device, depending on the
191  * protocol mode. The write(9E) call does not block for this to finish. Once
192  * write(9E) has returned, the user may block in a read(2) related system call
193  * or poll for POLLIN.
194  *
195  * A thread may not call read(9E) without having called write(9E). This model is
196  * due to the limited capability of hardware. Only a single command can be going
197  * on a given slot and due to the fact that many commands change the hardware
198  * state, we do not try to multiplex multiple calls to write() or read().
199  *
200  *
201  * User I/O, Transaction Ends, ICC removals, and Reader Removals
202  * -------------------------------------------------------------
203  *
204  * While the I/O model given to user land is somewhat simple, there are a lot of
205  * tricky pieces to get right because we are in a multi-threaded pre-emptible
206  * system. In general, there are four different levels of state that we need to
207  * keep track of:
208  *
209  *   1. User threads in I/O
210  *   2. Kernel protocol level support (T=1, apdu, etc.).
211  *   3. Slot/ICC state
212  *   4. CCID Reader state
213  *
214  * Of course, each level cares about the state above it. The kernel protocol
215  * level state (2) cares about the User threads in I/O (1). The same is true
216  * with the other levels caring about the levels above it. With this in mind
217  * there are three non-data path things that can go wrong:
218  *
219  *   A. The user can end a transaction (whether through an ioctl or close(9E)).
220  *   B. The ICC can be removed
221  *   C. The CCID device can be removed or reset at a USB level.
222  *
223  * Each of these has implications on the outstanding I/O and other states of
224  * the world. When events of type A occur, we need to clean up states 1 and 2.
225  * Then events of type B occur we need to clean up states 1-3. When events of
226  * type C occur we need to clean up states 1-4. The following discusses how we
227  * should clean up these different states:
228  *
229  * Cleaning up State 1:
230  *
231  *   To clean up the User threads in I/O there are three different cases to
232  *   consider. The first is cleaning up a thread that is in the middle of
233  *   write(9E). The second is cleaning up thread that is blocked in read(9E).
234  *   The third is dealing with threads that are stuck in chpoll(9E).
235  *
236  *   To handle the write case, we have a series of flags that is on the CCID
237  *   slot's I/O structure (ccid_io_t, cs_io on the ccid_slot_t). When a thread
238  *   begins its I/O it will set the CCID_IO_F_PREPARING flag. This flag is used
239  *   to indicate that there is a thread that is performing a write(9E), but it
240  *   is not holding the ccid_mutex because of the operations that it is taking.
241  *   Once it has finished, the thread will remove that flag and instead
242  *   CCID_IO_F_IN_PROGRESS will be set. If we find that the CCID_IO_F_PREPARING
243  *   flag is set, then we will need to wait for it to be removed before
244  *   continuing. The fact that there is an outstanding physical I/O will be
245  *   dealt with when we clean up state 2.
246  *
247  *   To handle the read case, we have a flag on the ccid_minor_t which indicates
248  *   that a thread is blocked on a condition variable (cm_read_cv), waiting for
249  *   the I/O to complete. The way this gets cleaned up varies a bit on each of
250  *   the different cases as each one will trigger a different error to the
251  *   thread. In all cases, the condition variable will be signaled. Then,
252  *   whenever the thread comes out of the condition variable it will always
253  *   check the state to see if it has been woken up because the transaction is
254  *   being closed, the ICC has been removed, or the reader is being
255  *   disconnected. In all such cases, the thread in read will end up receiving
256  *   an error (ECANCELED, ENXIO, and ENODEV respectively).
257  *
258  *   If we have hit the case that this needs to be cleaned up, then the
259  *   CCID_MINOR_F_READ_WAITING flag will be set on the ccid_minor_t's flags
260  *   member (cm_flags). In this case, the broader system must change the
261  *   corresponding system state flag for the appropriate condition, signal the
262  *   read cv, and then wait on an additional cv in the minor, the
263  *   ccid_iowait_cv).
264  *
265  *   Cleaning up the poll state is somewhat simpler. If any of the conditions
266  *   (A-C) occur, then we must flag POLLERR. In addition if B and C occur, then
267  *   we will flag POLLHUP at the same time. This will guarantee that any threads
268  *   in poll(9E) are woken up.
269  *
270  * Cleaning up State 2.
271  *
272  *   While the user I/O thread is a somewhat straightforward, the kernel
273  *   protocol level is a bit more complicated. The core problem is that when a
274  *   user issues a logical I/O through an APDU, that may result in a series of
275  *   one or more protocol level physical commands. The core crux of the issue
276  *   with cleaning up this state is twofold:
277  *
278  *     1. We don't want to block a user thread while I/O is outstanding
279  *     2. We need to take one of several steps to clean up the aforementioned
280  *        I/O
281  *
282  *   To try and deal with that, there are a number of different things that we
283  *   do. The first thing we do is that we clean up the user state based on the
284  *   notes in cleaning up in State 1. Importantly we need to _block_ on this
285  *   activity.
286  *
287  *   Once that is done, we need to proceed to step 2. Since we're doing only
288  *   APDU processing, this is as simple as waiting for that command to complete
289  *   and/or potentially issue an abort or reset.
290  *
291  *   While this is ongoing an additional flag (CCID_SLOT_F_NEED_IO_TEARDOWN)
292  *   will be set on the slot to make sure that we know that we can't issue new
293  *   I/O or that we can't proceed to the next transaction until this phase is
294  *   finished.
295  *
296  * Cleaning up State 3
297  *
298  *   When the ICC is removed, this is not dissimilar to the previous states. To
299  *   handle this we need to first make sure that state 1 and state 2 are
300  *   finished being cleaned up. We will have to _block_ on this from the worker
301  *   thread. The problem is that we have certain values such as the operations
302  *   vector, the ATR data, etc. that we need to make sure are still valid while
303  *   we're in the process of cleaning up state. Once all that is done and the
304  *   worker thread proceeds we will consider processing a new ICC insertion.
305  *   The one good side is that if the ICC was removed, then it should be simpler
306  *   to handle all of the outstanding I/O.
307  *
308  * Cleaning up State 4
309  *
310  *   When the reader is removed, then we need to clean up all the prior states.
311  *   However, this is somewhat simpler than the other cases, as once this
312  *   happens our detach endpoint will be called to clean up all of our
313  *   resources. Therefore, before we call detach, we need to explicitly clean up
314  *   state 1; however, we then at this time leave all the remaining state to be
315  *   cleaned up during detach(9E) as part of normal tear down.
316  */
317 
318 #include <sys/modctl.h>
319 #include <sys/errno.h>
320 #include <sys/conf.h>
321 #include <sys/ddi.h>
322 #include <sys/sunddi.h>
323 #include <sys/cmn_err.h>
324 #include <sys/sysmacros.h>
325 #include <sys/stream.h>
326 #include <sys/strsun.h>
327 #include <sys/strsubr.h>
328 #include <sys/filio.h>
329 
330 #define	USBDRV_MAJOR_VER	2
331 #define	USBDRV_MINOR_VER	0
332 #include <sys/usb/usba.h>
333 #include <sys/usb/usba/usbai_private.h>
334 #include <sys/usb/clients/ccid/ccid.h>
335 #include <sys/usb/clients/ccid/uccid.h>
336 
337 #include <atr.h>
338 
339 /*
340  * Set the amount of parallelism we'll want to have from kernel threads which
341  * are processing CCID requests. This is used to size the number of asynchronous
342  * requests in the pipe policy. A single command can only ever be outstanding to
343  * a single slot. However, multiple slots may potentially be able to be
344  * scheduled in parallel. However, we don't actually support this at all and
345  * we'll only ever issue a single command. This basically covers the ability to
346  * have some other asynchronous operation outstanding if needed.
347  */
348 #define	CCID_NUM_ASYNC_REQS	2
349 
350 /*
351  * This is the number of Bulk-IN requests that we will have cached per CCID
352  * device. While many commands will generate a single response, the commands
353  * also have the ability to generate time extensions, which means that we'll
354  * want to be able to schedule another Bulk-IN request immediately. If we run
355  * out, we will attempt to refill said cache and will not fail commands
356  * needlessly.
357  */
358 #define	CCID_BULK_NALLOCED		16
359 
360 /*
361  * This is a time in seconds for the bulk-out command to run and be submitted.
362  */
363 #define	CCID_BULK_OUT_TIMEOUT	5
364 #define	CCID_BULK_IN_TIMEOUT	5
365 
366 /*
367  * There are two different Interrupt-IN packets that we might receive. The
368  * first, RDR_to_PC_HardwareError, is a fixed four byte packet. However, the
369  * other one, RDR_to_PC_NotifySlotChange, varies in size as it has two bits per
370  * potential slot plus one byte that's always used. The maximum number of slots
371  * in a device is 256. This means there can be up to 64 bytes worth of data plus
372  * the extra byte, so 65 bytes.
373  */
374 #define	CCID_INTR_RESPONSE_SIZE	65
375 
376 /*
377  * Minimum and maximum minor ids. We treat the maximum valid 32-bit minor as
378  * what we can use due to issues in some file systems and the minors that they
379  * can use. We reserved zero as an invalid minor number to make it easier to
380  * tell if things have been initialized or not.
381  */
382 #define	CCID_MINOR_MIN		1
383 #define	CCID_MINOR_MAX		MAXMIN32
384 #define	CCID_MINOR_INVALID	0
385 
386 /*
387  * This value represents the minimum size value that we require in the CCID
388  * class descriptor's dwMaxCCIDMessageLength member. We got to 64 bytes based on
389  * the required size of a bulk transfer packet size. Especially as many CCID
390  * devices are these class of speeds. The specification does require that the
391  * minimum size of the dwMaxCCIDMessageLength member is at least the size of its
392  * bulk endpoint packet size.
393  */
394 #define	CCID_MIN_MESSAGE_LENGTH	64
395 
396 /*
397  * Required forward declarations.
398  */
399 struct ccid;
400 struct ccid_slot;
401 struct ccid_minor;
402 struct ccid_command;
403 
404 /*
405  * This structure is used to map between the global set of minor numbers and the
406  * things represented by them.
407  *
408  * We have two different kinds of  minor nodes. The first are CCID slots. The
409  * second are cloned opens of those slots. Each of these items has a
410  * ccid_minor_idx_t embedded in them that is used to index them in an AVL tree.
411  * Given that the number of entries that should be present here is unlikely to
412  * be terribly large at any given time, it is hoped that an AVL tree will
413  * suffice for now.
414  */
415 typedef struct ccid_minor_idx {
416 	id_t cmi_minor;
417 	avl_node_t cmi_avl;
418 	boolean_t cmi_isslot;
419 	union {
420 		struct ccid_slot *cmi_slot;
421 		struct ccid_minor *cmi_user;
422 	} cmi_data;
423 } ccid_minor_idx_t;
424 
425 typedef enum ccid_minor_flags {
426 	CCID_MINOR_F_WAITING		= 1 << 0,
427 	CCID_MINOR_F_HAS_EXCL		= 1 << 1,
428 	CCID_MINOR_F_TXN_RESET		= 1 << 2,
429 	CCID_MINOR_F_READ_WAITING	= 1 << 3,
430 	CCID_MINOR_F_WRITABLE		= 1 << 4,
431 } ccid_minor_flags_t;
432 
433 typedef struct ccid_minor {
434 	ccid_minor_idx_t	cm_idx;		/* write-once */
435 	cred_t			*cm_opener;	/* write-once */
436 	struct ccid_slot	*cm_slot;	/* write-once */
437 	list_node_t		cm_minor_list;
438 	list_node_t		cm_excl_list;
439 	kcondvar_t		cm_read_cv;
440 	kcondvar_t		cm_iowait_cv;
441 	kcondvar_t		cm_excl_cv;
442 	ccid_minor_flags_t	cm_flags;
443 	struct pollhead		cm_pollhead;
444 } ccid_minor_t;
445 
446 typedef enum ccid_slot_flags {
447 	CCID_SLOT_F_CHANGED		= 1 << 0,
448 	CCID_SLOT_F_INTR_GONE		= 1 << 1,
449 	CCID_SLOT_F_INTR_ADD		= 1 << 2,
450 	CCID_SLOT_F_PRESENT		= 1 << 3,
451 	CCID_SLOT_F_ACTIVE		= 1 << 4,
452 	CCID_SLOT_F_NEED_TXN_RESET	= 1 << 5,
453 	CCID_SLOT_F_NEED_IO_TEARDOWN	= 1 << 6,
454 	CCID_SLOT_F_INTR_OVERCURRENT	= 1 << 7,
455 } ccid_slot_flags_t;
456 
457 #define	CCID_SLOT_F_INTR_MASK	(CCID_SLOT_F_CHANGED | CCID_SLOT_F_INTR_GONE | \
458     CCID_SLOT_F_INTR_ADD)
459 #define	CCID_SLOT_F_WORK_MASK	(CCID_SLOT_F_INTR_MASK | \
460     CCID_SLOT_F_NEED_TXN_RESET | CCID_SLOT_F_INTR_OVERCURRENT)
461 #define	CCID_SLOT_F_NOEXCL_MASK	(CCID_SLOT_F_NEED_TXN_RESET | \
462     CCID_SLOT_F_NEED_IO_TEARDOWN)
463 
464 typedef void (*icc_init_func_t)(struct ccid *, struct ccid_slot *);
465 typedef int (*icc_transmit_func_t)(struct ccid *, struct ccid_slot *);
466 typedef void (*icc_complete_func_t)(struct ccid *, struct ccid_slot *,
467     struct ccid_command *);
468 typedef void (*icc_teardown_func_t)(struct ccid *, struct ccid_slot *, int);
469 typedef void (*icc_fini_func_t)(struct ccid *, struct ccid_slot *);
470 
471 typedef struct ccid_icc {
472 	atr_data_t		*icc_atr_data;
473 	atr_protocol_t		icc_protocols;
474 	atr_protocol_t		icc_cur_protocol;
475 	ccid_params_t		icc_params;
476 	icc_init_func_t		icc_init;
477 	icc_transmit_func_t	icc_tx;
478 	icc_complete_func_t	icc_complete;
479 	icc_teardown_func_t	icc_teardown;
480 	icc_fini_func_t		icc_fini;
481 } ccid_icc_t;
482 
483 /*
484  * Structure used to take care of and map I/O requests and things. This may not
485  * make sense as we develop the T=0 and T=1 code.
486  */
487 typedef enum ccid_io_flags {
488 	/*
489 	 * This flag is used during the period that a thread has started calling
490 	 * into ccid_write(9E), but before it has finished queuing up the write.
491 	 * This blocks pollout or another thread in write.
492 	 */
493 	CCID_IO_F_PREPARING	= 1 << 0,
494 	/*
495 	 * This flag is used once a ccid_write() ICC tx function has
496 	 * successfully completed. While this is set, the device is not
497 	 * writable; however, it is legal to call ccid_read() and block. This
498 	 * flag will remain set until the actual write is done. This indicates
499 	 * that the transmission protocol has finished.
500 	 */
501 	CCID_IO_F_IN_PROGRESS	= 1 << 1,
502 	/*
503 	 * This flag is used to indicate that the logical I/O has completed in
504 	 * one way or the other and that a reader can consume data. When this
505 	 * flag is set, then POLLIN | POLLRDNORM should be signaled. Until the
506 	 * I/O is consumed via ccid_read(), calls to ccid_write() will fail with
507 	 * EBUSY. When this flag is set, the kernel protocol level should be
508 	 * idle and it should be safe to tear down.
509 	 */
510 	CCID_IO_F_DONE		= 1 << 2,
511 } ccid_io_flags_t;
512 
513 /*
514  * If any of the flags in the POLLOUT group are set, then the device is not
515  * writeable. The same distinction isn't true for POLLIN. We are only readable
516  * if CCID_IO_F_DONE is set. However, you are allowed to call read as soon as
517  * CCID_IO_F_IN_PROGRESS is set.
518  */
519 #define	CCID_IO_F_POLLOUT_FLAGS	(CCID_IO_F_PREPARING | CCID_IO_F_IN_PROGRESS | \
520     CCID_IO_F_DONE)
521 #define	CCID_IO_F_ALL_FLAGS	(CCID_IO_F_PREPARING | CCID_IO_F_IN_PROGRESS | \
522     CCID_IO_F_DONE | CCID_IO_F_ABANDONED)
523 
524 typedef struct ccid_io {
525 	ccid_io_flags_t	ci_flags;
526 	size_t		ci_ilen;
527 	uint8_t		ci_ibuf[CCID_APDU_LEN_MAX];
528 	mblk_t		*ci_omp;
529 	kcondvar_t	ci_cv;
530 	struct ccid_command *ci_command;
531 	int		ci_errno;
532 	mblk_t		*ci_data;
533 } ccid_io_t;
534 
535 typedef struct ccid_slot {
536 	ccid_minor_idx_t	cs_idx;		/* WO */
537 	uint_t			cs_slotno;	/* WO */
538 	struct ccid		*cs_ccid;	/* WO */
539 	ccid_slot_flags_t	cs_flags;
540 	ccid_class_voltage_t	cs_voltage;
541 	mblk_t			*cs_atr;
542 	struct ccid_command	*cs_command;
543 	ccid_minor_t		*cs_excl_minor;
544 	list_t			cs_excl_waiters;
545 	list_t			cs_minors;
546 	ccid_icc_t		cs_icc;
547 	ccid_io_t		cs_io;
548 } ccid_slot_t;
549 
550 typedef enum ccid_attach_state {
551 	CCID_ATTACH_USB_CLIENT	= 1 << 0,
552 	CCID_ATTACH_MUTEX_INIT	= 1 << 1,
553 	CCID_ATTACH_TASKQ	= 1 << 2,
554 	CCID_ATTACH_CMD_LIST	= 1 << 3,
555 	CCID_ATTACH_OPEN_PIPES	= 1 << 4,
556 	CCID_ATTACH_SEQ_IDS	= 1 << 5,
557 	CCID_ATTACH_SLOTS	= 1 << 6,
558 	CCID_ATTACH_HOTPLUG_CB	= 1 << 7,
559 	CCID_ATTACH_INTR_ACTIVE	= 1 << 8,
560 	CCID_ATTACH_MINORS	= 1 << 9,
561 } ccid_attach_state_t;
562 
563 typedef enum ccid_flags {
564 	CCID_F_HAS_INTR		= 1 << 0,
565 	CCID_F_NEEDS_PPS	= 1 << 1,
566 	CCID_F_NEEDS_PARAMS	= 1 << 2,
567 	CCID_F_NEEDS_DATAFREQ	= 1 << 3,
568 	CCID_F_DETACHING	= 1 << 5,
569 	CCID_F_WORKER_REQUESTED	= 1 << 6,
570 	CCID_F_WORKER_RUNNING	= 1 << 7,
571 	CCID_F_DISCONNECTED	= 1 << 8
572 } ccid_flags_t;
573 
574 #define	CCID_F_DEV_GONE_MASK	(CCID_F_DETACHING | CCID_F_DISCONNECTED)
575 #define	CCID_F_WORKER_MASK	(CCID_F_WORKER_REQUESTED | \
576     CCID_F_WORKER_RUNNING)
577 
578 typedef struct ccid_stats {
579 	uint64_t	cst_intr_errs;
580 	uint64_t	cst_intr_restart;
581 	uint64_t	cst_intr_unknown;
582 	uint64_t	cst_intr_slot_change;
583 	uint64_t	cst_intr_hwerr;
584 	uint64_t	cst_intr_inval;
585 	uint64_t	cst_ndiscover;
586 	hrtime_t	cst_lastdiscover;
587 } ccid_stats_t;
588 
589 typedef struct ccid {
590 	dev_info_t		*ccid_dip;
591 	kmutex_t		ccid_mutex;
592 	ccid_attach_state_t	ccid_attach;
593 	ccid_flags_t		ccid_flags;
594 	id_space_t		*ccid_seqs;
595 	ddi_taskq_t		*ccid_taskq;
596 	usb_client_dev_data_t	*ccid_dev_data;
597 	ccid_class_descr_t	ccid_class;		/* WO */
598 	usb_ep_xdescr_t		ccid_bulkin_xdesc;	/* WO */
599 	usb_pipe_handle_t	ccid_bulkin_pipe;	/* WO */
600 	usb_ep_xdescr_t		ccid_bulkout_xdesc;	/* WO */
601 	usb_pipe_handle_t	ccid_bulkout_pipe;	/* WO */
602 	usb_ep_xdescr_t		ccid_intrin_xdesc;	/* WO */
603 	usb_pipe_handle_t	ccid_intrin_pipe;	/* WO */
604 	usb_pipe_handle_t	ccid_control_pipe;	/* WO */
605 	uint_t			ccid_nslots;		/* WO */
606 	size_t			ccid_bufsize;		/* WO */
607 	ccid_slot_t		*ccid_slots;
608 	timeout_id_t		ccid_poll_timeout;
609 	ccid_stats_t		ccid_stats;
610 	list_t			ccid_command_queue;
611 	list_t			ccid_complete_queue;
612 	usb_bulk_req_t		*ccid_bulkin_cache[CCID_BULK_NALLOCED];
613 	uint_t			ccid_bulkin_alloced;
614 	usb_bulk_req_t		*ccid_bulkin_dispatched;
615 } ccid_t;
616 
617 /*
618  * Command structure for an individual CCID command that we issue to a
619  * controller. Note that the command caches a copy of some of the data that's
620  * normally inside the CCID header in host-endian fashion.
621  */
622 typedef enum ccid_command_state {
623 	CCID_COMMAND_ALLOCATED	= 0x0,
624 	CCID_COMMAND_QUEUED,
625 	CCID_COMMAND_DISPATCHED,
626 	CCID_COMMAND_REPLYING,
627 	CCID_COMMAND_COMPLETE,
628 	CCID_COMMAND_TRANSPORT_ERROR,
629 	CCID_COMMAND_CCID_ABORTED
630 } ccid_command_state_t;
631 
632 typedef enum ccid_command_flags {
633 	CCID_COMMAND_F_USER	= 1 << 0,
634 } ccid_command_flags_t;
635 
636 typedef struct ccid_command {
637 	list_node_t		cc_list_node;
638 	kcondvar_t		cc_cv;
639 	uint8_t			cc_mtype;
640 	ccid_response_code_t	cc_rtype;
641 	uint8_t			cc_slot;
642 	ccid_command_state_t	cc_state;
643 	ccid_command_flags_t	cc_flags;
644 	int			cc_usb;
645 	usb_cr_t		cc_usbcr;
646 	size_t			cc_reqlen;
647 	id_t			cc_seq;
648 	usb_bulk_req_t		*cc_ubrp;
649 	ccid_t			*cc_ccid;
650 	hrtime_t		cc_queue_time;
651 	hrtime_t		cc_dispatch_time;
652 	hrtime_t		cc_dispatch_cb_time;
653 	hrtime_t		cc_response_time;
654 	hrtime_t		cc_completion_time;
655 	mblk_t			*cc_response;
656 } ccid_command_t;
657 
658 /*
659  * ddi_soft_state(9F) pointer. This is used for instances of a CCID controller.
660  */
661 static void *ccid_softstate;
662 
663 /*
664  * This is used to keep track of our minor nodes.
665  */
666 static kmutex_t ccid_idxlock;
667 static avl_tree_t ccid_idx;
668 static id_space_t *ccid_minors;
669 
670 /*
671  * Required Forwards
672  */
673 static void ccid_intr_poll_init(ccid_t *);
674 static void ccid_worker_request(ccid_t *);
675 static void ccid_command_dispatch(ccid_t *);
676 static void ccid_command_free(ccid_command_t *);
677 static int ccid_bulkin_schedule(ccid_t *);
678 static void ccid_command_bcopy(ccid_command_t *, const void *, size_t);
679 
680 static int ccid_write_apdu(ccid_t *, ccid_slot_t *);
681 static void ccid_complete_apdu(ccid_t *, ccid_slot_t *, ccid_command_t *);
682 static void ccid_teardown_apdu(ccid_t *, ccid_slot_t *, int);
683 
684 
685 static int
ccid_idx_comparator(const void * l,const void * r)686 ccid_idx_comparator(const void *l, const void *r)
687 {
688 	const ccid_minor_idx_t *lc = l, *rc = r;
689 
690 	if (lc->cmi_minor > rc->cmi_minor)
691 		return (1);
692 	if (lc->cmi_minor < rc->cmi_minor)
693 		return (-1);
694 	return (0);
695 }
696 
697 static void
ccid_error(ccid_t * ccid,const char * fmt,...)698 ccid_error(ccid_t *ccid, const char *fmt, ...)
699 {
700 	va_list ap;
701 
702 	va_start(ap, fmt);
703 	if (ccid != NULL) {
704 		vdev_err(ccid->ccid_dip, CE_WARN, fmt, ap);
705 	} else {
706 		vcmn_err(CE_WARN, fmt, ap);
707 	}
708 	va_end(ap);
709 }
710 
711 static void
ccid_minor_idx_free(ccid_minor_idx_t * idx)712 ccid_minor_idx_free(ccid_minor_idx_t *idx)
713 {
714 	ccid_minor_idx_t *ip;
715 
716 	VERIFY3S(idx->cmi_minor, !=, CCID_MINOR_INVALID);
717 	mutex_enter(&ccid_idxlock);
718 	ip = avl_find(&ccid_idx, idx, NULL);
719 	VERIFY3P(idx, ==, ip);
720 	avl_remove(&ccid_idx, idx);
721 	id_free(ccid_minors, idx->cmi_minor);
722 	idx->cmi_minor = CCID_MINOR_INVALID;
723 	mutex_exit(&ccid_idxlock);
724 }
725 
726 static boolean_t
ccid_minor_idx_alloc(ccid_minor_idx_t * idx,boolean_t sleep)727 ccid_minor_idx_alloc(ccid_minor_idx_t *idx, boolean_t sleep)
728 {
729 	id_t id;
730 
731 	mutex_enter(&ccid_idxlock);
732 	if (sleep) {
733 		id = id_alloc(ccid_minors);
734 	} else {
735 		id = id_alloc_nosleep(ccid_minors);
736 	}
737 	if (id == -1) {
738 		mutex_exit(&ccid_idxlock);
739 		return (B_FALSE);
740 	}
741 	idx->cmi_minor = id;
742 	avl_add(&ccid_idx, idx);
743 	mutex_exit(&ccid_idxlock);
744 
745 	return (B_TRUE);
746 }
747 
748 static ccid_minor_idx_t *
ccid_minor_find(minor_t m)749 ccid_minor_find(minor_t m)
750 {
751 	ccid_minor_idx_t i = { 0 };
752 	ccid_minor_idx_t *ret;
753 
754 	i.cmi_minor = m;
755 	mutex_enter(&ccid_idxlock);
756 	ret = avl_find(&ccid_idx, &i, NULL);
757 	mutex_exit(&ccid_idxlock);
758 
759 	return (ret);
760 }
761 
762 static ccid_minor_idx_t *
ccid_minor_find_user(minor_t m)763 ccid_minor_find_user(minor_t m)
764 {
765 	ccid_minor_idx_t *idx;
766 
767 	idx = ccid_minor_find(m);
768 	if (idx == NULL) {
769 		return (NULL);
770 	}
771 	VERIFY0(idx->cmi_isslot);
772 	return (idx);
773 }
774 
775 static void
ccid_clear_io(ccid_io_t * io)776 ccid_clear_io(ccid_io_t *io)
777 {
778 	freemsg(io->ci_data);
779 	io->ci_data = NULL;
780 	io->ci_errno = 0;
781 	io->ci_flags &= ~CCID_IO_F_DONE;
782 	io->ci_ilen = 0;
783 	bzero(io->ci_ibuf, sizeof (io->ci_ibuf));
784 }
785 
786 /*
787  * Check if the conditions are met to signal the next exclusive holder. For this
788  * to be true, there should be no one holding it. In addition, there must be
789  * someone in the queue waiting. Finally, we want to make sure that the ICC, if
790  * present, is in a state where it could handle these kinds of issues. That
791  * means that we shouldn't have an outstanding I/O question or warm reset
792  * ongoing. However, we must not block this on the condition of an ICC being
793  * present. But, if the reader has been disconnected, don't signal anyone.
794  */
795 static void
ccid_slot_excl_maybe_signal(ccid_slot_t * slot)796 ccid_slot_excl_maybe_signal(ccid_slot_t *slot)
797 {
798 	ccid_minor_t *cmp;
799 
800 	VERIFY(MUTEX_HELD(&slot->cs_ccid->ccid_mutex));
801 
802 	if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0)
803 		return;
804 	if (slot->cs_excl_minor != NULL)
805 		return;
806 	if ((slot->cs_flags & CCID_SLOT_F_NOEXCL_MASK) != 0)
807 		return;
808 	cmp = list_head(&slot->cs_excl_waiters);
809 	if (cmp == NULL)
810 		return;
811 	cv_signal(&cmp->cm_excl_cv);
812 }
813 
814 static void
ccid_slot_excl_rele(ccid_slot_t * slot)815 ccid_slot_excl_rele(ccid_slot_t *slot)
816 {
817 	ccid_minor_t *cmp;
818 	ccid_t *ccid = slot->cs_ccid;
819 
820 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
821 	VERIFY3P(slot->cs_excl_minor, !=, NULL);
822 
823 	cmp = slot->cs_excl_minor;
824 
825 	/*
826 	 * If we have an outstanding command left by the user when they've
827 	 * closed the slot, we need to clean up this command. We need to call
828 	 * the protocol specific handler here to determine what to do. If the
829 	 * command has completed, but the user has never called read, then it
830 	 * will simply clean it up. Otherwise it will indicate that there is
831 	 * some amount of external state still ongoing to take care of and clean
832 	 * up later.
833 	 */
834 	if (slot->cs_icc.icc_teardown != NULL) {
835 		slot->cs_icc.icc_teardown(ccid, slot, ECANCELED);
836 	}
837 
838 	/*
839 	 * There may either be a thread blocked in read or in the process of
840 	 * preparing a write. In either case, we need to make sure that they're
841 	 * woken up or finish, before we finish tear down.
842 	 */
843 	while ((cmp->cm_flags & CCID_MINOR_F_READ_WAITING) != 0 ||
844 	    (slot->cs_io.ci_flags & CCID_IO_F_PREPARING) != 0) {
845 		cv_wait(&cmp->cm_iowait_cv, &ccid->ccid_mutex);
846 	}
847 
848 	/*
849 	 * At this point, we hold the lock and there should be no other threads
850 	 * that are past the basic sanity checks. So at this point, note that
851 	 * this minor no longer has exclusive access (causing other read/write
852 	 * calls to fail) and start the process of cleaning up the outstanding
853 	 * I/O on the slot. It is OK that at this point the thread may try to
854 	 * obtain exclusive access again. It will end up blocking on everything
855 	 * else.
856 	 */
857 	cmp->cm_flags &= ~CCID_MINOR_F_HAS_EXCL;
858 	slot->cs_excl_minor = NULL;
859 
860 	/*
861 	 * If at this point, we have an I/O that's noted as being done, but no
862 	 * one blocked in read, then we need to clean that up. The ICC teardown
863 	 * function is only designed to take care of in-flight I/Os.
864 	 */
865 	if ((slot->cs_io.ci_flags & CCID_IO_F_DONE) != 0)
866 		ccid_clear_io(&slot->cs_io);
867 
868 	/*
869 	 * Regardless of when we're polling, we need to go through and error
870 	 * out.
871 	 */
872 	pollwakeup(&cmp->cm_pollhead, POLLERR);
873 
874 	/*
875 	 * If we've been asked to reset the card before handing it off, schedule
876 	 * that. Otherwise, allow the next entry in the queue to get woken up
877 	 * and given access to the card.
878 	 */
879 	if ((cmp->cm_flags & CCID_MINOR_F_TXN_RESET) != 0) {
880 		slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET;
881 		ccid_worker_request(ccid);
882 		cmp->cm_flags &= ~CCID_MINOR_F_TXN_RESET;
883 	} else {
884 		ccid_slot_excl_maybe_signal(slot);
885 	}
886 }
887 
888 static int
ccid_slot_excl_req(ccid_slot_t * slot,ccid_minor_t * cmp,boolean_t nosleep)889 ccid_slot_excl_req(ccid_slot_t *slot, ccid_minor_t *cmp, boolean_t nosleep)
890 {
891 	VERIFY(MUTEX_HELD(&slot->cs_ccid->ccid_mutex));
892 
893 	if (slot->cs_excl_minor == cmp) {
894 		VERIFY((cmp->cm_flags & CCID_MINOR_F_HAS_EXCL) != 0);
895 		return (EEXIST);
896 	}
897 
898 	if ((cmp->cm_flags & CCID_MINOR_F_WAITING) != 0) {
899 		return (EINPROGRESS);
900 	}
901 
902 	/*
903 	 * If we were asked to try and fail quickly, do that before the main
904 	 * loop.
905 	 */
906 	if (nosleep && slot->cs_excl_minor != NULL &&
907 	    (slot->cs_flags & CCID_SLOT_F_NOEXCL_MASK) == 0) {
908 		return (EBUSY);
909 	}
910 
911 	/*
912 	 * Mark that we're waiting in case we race with another thread trying to
913 	 * claim exclusive access for this. Insert ourselves on the wait list.
914 	 * If for some reason we get a signal, then we can't know for certain if
915 	 * we had a signal / cv race. In such a case, we always wake up the
916 	 * next person in the queue (potentially spuriously).
917 	 */
918 	cmp->cm_flags |= CCID_MINOR_F_WAITING;
919 	list_insert_tail(&slot->cs_excl_waiters, cmp);
920 	while (slot->cs_excl_minor != NULL ||
921 	    (slot->cs_flags & CCID_SLOT_F_NOEXCL_MASK) != 0) {
922 		if (cv_wait_sig(&cmp->cm_excl_cv, &slot->cs_ccid->ccid_mutex) ==
923 		    0) {
924 			/*
925 			 * Remove ourselves from the list and try to signal the
926 			 * next thread.
927 			 */
928 			list_remove(&slot->cs_excl_waiters, cmp);
929 			cmp->cm_flags &= ~CCID_MINOR_F_WAITING;
930 			ccid_slot_excl_maybe_signal(slot);
931 			return (EINTR);
932 		}
933 
934 		/*
935 		 * Check if the reader is going away. If so, then we're done
936 		 * here.
937 		 */
938 		if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) {
939 			list_remove(&slot->cs_excl_waiters, cmp);
940 			cmp->cm_flags &= ~CCID_MINOR_F_WAITING;
941 			return (ENODEV);
942 		}
943 	}
944 
945 	VERIFY0(slot->cs_flags & CCID_SLOT_F_NOEXCL_MASK);
946 	list_remove(&slot->cs_excl_waiters, cmp);
947 
948 	cmp->cm_flags &= ~CCID_MINOR_F_WAITING;
949 	cmp->cm_flags |= CCID_MINOR_F_HAS_EXCL;
950 	slot->cs_excl_minor = cmp;
951 	return (0);
952 }
953 
954 /*
955  * Check whether or not we're in a state that we can signal a POLLIN. To be able
956  * to signal a POLLIN (meaning that we can read) the following must be true:
957  *
958  *   o There is a client that has an exclusive hold open
959  *   o There is a data which is readable by the client (an I/O is done).
960  *
961  * Unlike with pollout, we don't care about the state of the ICC.
962  */
963 static void
ccid_slot_pollin_signal(ccid_slot_t * slot)964 ccid_slot_pollin_signal(ccid_slot_t *slot)
965 {
966 	ccid_t *ccid = slot->cs_ccid;
967 	ccid_minor_t *cmp = slot->cs_excl_minor;
968 
969 	if (cmp == NULL)
970 		return;
971 
972 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
973 
974 	if ((slot->cs_io.ci_flags & CCID_IO_F_DONE) == 0)
975 		return;
976 
977 	pollwakeup(&cmp->cm_pollhead, POLLIN | POLLRDNORM);
978 }
979 
980 /*
981  * Check whether or not we're in a state that we can signal a POLLOUT. To be
982  * able to signal a POLLOUT (meaning that we can write) the following must be
983  * true:
984  *
985  *   o There is a minor which has an exclusive hold on the device
986  *   o There is no outstanding I/O activity going on, meaning that there is no
987  *     operation in progress and any write data has been consumed.
988  *   o There is an ICC present
989  *   o There is no outstanding I/O cleanup being done, whether a T=1 abort, a
990  *     warm reset, or something else.
991  */
992 static void
ccid_slot_pollout_signal(ccid_slot_t * slot)993 ccid_slot_pollout_signal(ccid_slot_t *slot)
994 {
995 	ccid_t *ccid = slot->cs_ccid;
996 	ccid_minor_t *cmp = slot->cs_excl_minor;
997 
998 	if (cmp == NULL)
999 		return;
1000 
1001 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
1002 
1003 	if ((slot->cs_io.ci_flags & CCID_IO_F_POLLOUT_FLAGS) != 0 ||
1004 	    (slot->cs_flags & CCID_SLOT_F_ACTIVE) == 0 ||
1005 	    (ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0 ||
1006 	    (slot->cs_flags & CCID_SLOT_F_NEED_IO_TEARDOWN) != 0)
1007 		return;
1008 
1009 	pollwakeup(&cmp->cm_pollhead, POLLOUT);
1010 }
1011 
1012 static void
ccid_slot_io_teardown_done(ccid_slot_t * slot)1013 ccid_slot_io_teardown_done(ccid_slot_t *slot)
1014 {
1015 	ccid_t *ccid = slot->cs_ccid;
1016 
1017 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
1018 	slot->cs_flags &= ~CCID_SLOT_F_NEED_IO_TEARDOWN;
1019 	cv_broadcast(&slot->cs_io.ci_cv);
1020 
1021 	ccid_slot_pollout_signal(slot);
1022 }
1023 
1024 /*
1025  * This will probably need to change when we start doing TPDU processing.
1026  */
1027 static size_t
ccid_command_resp_length(ccid_command_t * cc)1028 ccid_command_resp_length(ccid_command_t *cc)
1029 {
1030 	uint32_t len;
1031 	const ccid_header_t *cch;
1032 
1033 	VERIFY3P(cc, !=, NULL);
1034 	VERIFY3P(cc->cc_response, !=, NULL);
1035 
1036 	/*
1037 	 * Fetch out an arbitrarily aligned LE uint32_t value from the header.
1038 	 */
1039 	cch = (ccid_header_t *)cc->cc_response->b_rptr;
1040 	bcopy(&cch->ch_length, &len, sizeof (len));
1041 	len = LE_32(len);
1042 	return (len);
1043 }
1044 
1045 static uint8_t
ccid_command_resp_param2(ccid_command_t * cc)1046 ccid_command_resp_param2(ccid_command_t *cc)
1047 {
1048 	const ccid_header_t *cch;
1049 	uint8_t val;
1050 
1051 	VERIFY3P(cc, !=, NULL);
1052 	VERIFY3P(cc->cc_response, !=, NULL);
1053 
1054 	cch = (ccid_header_t *)cc->cc_response->b_rptr;
1055 	bcopy(&cch->ch_param2, &val, sizeof (val));
1056 	return (val);
1057 }
1058 
1059 /*
1060  * Complete a single command. The way that a command completes depends on the
1061  * kind of command that occurs. If this command is flagged as a user command,
1062  * that implies that it must be handled in a different way from administrative
1063  * commands. User commands are placed into the minor to consume via a read(9E).
1064  * Non-user commands are placed into a completion queue and must be picked up
1065  * via the ccid_command_poll() interface.
1066  */
1067 static void
ccid_command_complete(ccid_command_t * cc)1068 ccid_command_complete(ccid_command_t *cc)
1069 {
1070 	ccid_t *ccid = cc->cc_ccid;
1071 
1072 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
1073 	cc->cc_completion_time = gethrtime();
1074 	list_remove(&ccid->ccid_command_queue, cc);
1075 
1076 	if (cc->cc_flags & CCID_COMMAND_F_USER) {
1077 		ccid_slot_t *slot;
1078 
1079 		slot = &ccid->ccid_slots[cc->cc_slot];
1080 		ASSERT3P(slot->cs_icc.icc_complete, !=, NULL);
1081 		slot->cs_icc.icc_complete(ccid, slot, cc);
1082 	} else {
1083 		list_insert_tail(&ccid->ccid_complete_queue, cc);
1084 		cv_broadcast(&cc->cc_cv);
1085 	}
1086 
1087 	/*
1088 	 * Finally, we also need to kick off the next command.
1089 	 */
1090 	ccid_command_dispatch(ccid);
1091 }
1092 
1093 static void
ccid_command_state_transition(ccid_command_t * cc,ccid_command_state_t state)1094 ccid_command_state_transition(ccid_command_t *cc, ccid_command_state_t state)
1095 {
1096 	VERIFY(MUTEX_HELD(&cc->cc_ccid->ccid_mutex));
1097 
1098 	cc->cc_state = state;
1099 	cv_broadcast(&cc->cc_cv);
1100 }
1101 
1102 static void
ccid_command_transport_error(ccid_command_t * cc,int usb_status,usb_cr_t cr)1103 ccid_command_transport_error(ccid_command_t *cc, int usb_status, usb_cr_t cr)
1104 {
1105 	VERIFY(MUTEX_HELD(&cc->cc_ccid->ccid_mutex));
1106 
1107 	ccid_command_state_transition(cc, CCID_COMMAND_TRANSPORT_ERROR);
1108 	cc->cc_usb = usb_status;
1109 	cc->cc_usbcr = cr;
1110 	cc->cc_response = NULL;
1111 
1112 	ccid_command_complete(cc);
1113 }
1114 
1115 static void
ccid_command_status_decode(ccid_command_t * cc,ccid_reply_command_status_t * comp,ccid_reply_icc_status_t * iccp,ccid_command_err_t * errp)1116 ccid_command_status_decode(ccid_command_t *cc,
1117     ccid_reply_command_status_t *comp, ccid_reply_icc_status_t *iccp,
1118     ccid_command_err_t *errp)
1119 {
1120 	ccid_header_t cch;
1121 	size_t mblen;
1122 
1123 	VERIFY3S(cc->cc_state, ==, CCID_COMMAND_COMPLETE);
1124 	VERIFY3P(cc->cc_response, !=, NULL);
1125 	mblen = msgsize(cc->cc_response);
1126 	VERIFY3U(mblen, >=, sizeof (cch));
1127 
1128 	bcopy(cc->cc_response->b_rptr, &cch, sizeof (cch));
1129 	if (comp != NULL) {
1130 		*comp = CCID_REPLY_STATUS(cch.ch_param0);
1131 	}
1132 
1133 	if (iccp != NULL) {
1134 		*iccp = CCID_REPLY_ICC(cch.ch_param0);
1135 	}
1136 
1137 	if (errp != NULL) {
1138 		*errp = cch.ch_param1;
1139 	}
1140 }
1141 
1142 static void
ccid_reply_bulk_cb(usb_pipe_handle_t ph,usb_bulk_req_t * ubrp)1143 ccid_reply_bulk_cb(usb_pipe_handle_t ph, usb_bulk_req_t *ubrp)
1144 {
1145 	size_t mlen;
1146 	ccid_t *ccid;
1147 	ccid_slot_t *slot;
1148 	ccid_header_t cch;
1149 	ccid_command_t *cc;
1150 
1151 	boolean_t header_valid = B_FALSE;
1152 
1153 	VERIFY(ubrp->bulk_data != NULL);
1154 	mlen = msgsize(ubrp->bulk_data);
1155 	ccid = (ccid_t *)ubrp->bulk_client_private;
1156 	mutex_enter(&ccid->ccid_mutex);
1157 
1158 	/*
1159 	 * Before we do anything else, we should mark that this Bulk-IN request
1160 	 * is no longer being dispatched.
1161 	 */
1162 	VERIFY3P(ubrp, ==, ccid->ccid_bulkin_dispatched);
1163 	ccid->ccid_bulkin_dispatched = NULL;
1164 
1165 	if ((cc = list_head(&ccid->ccid_command_queue)) == NULL) {
1166 		/*
1167 		 * This is certainly an odd case. This means that we got some
1168 		 * response but there are no entries in the queue. Go ahead and
1169 		 * free this. We're done here.
1170 		 */
1171 		mutex_exit(&ccid->ccid_mutex);
1172 		usb_free_bulk_req(ubrp);
1173 		return;
1174 	}
1175 
1176 	if (mlen >= sizeof (ccid_header_t)) {
1177 		bcopy(ubrp->bulk_data->b_rptr, &cch, sizeof (cch));
1178 		header_valid = B_TRUE;
1179 	}
1180 
1181 	/*
1182 	 * If the current command isn't in the replying state, then something is
1183 	 * clearly wrong and this probably isn't intended for the current
1184 	 * command. That said, if we have enough bytes, let's check the sequence
1185 	 * number as that might be indicative of a bug otherwise.
1186 	 */
1187 	if (cc->cc_state != CCID_COMMAND_REPLYING) {
1188 		if (header_valid) {
1189 			VERIFY3S(cch.ch_seq, !=, cc->cc_seq);
1190 		}
1191 		mutex_exit(&ccid->ccid_mutex);
1192 		usb_free_bulk_req(ubrp);
1193 		return;
1194 	}
1195 
1196 	/*
1197 	 * CCID section 6.2.7 says that if we get a short or zero length packet,
1198 	 * then we need to treat that as though the running command was aborted
1199 	 * for some reason. However, section 3.1.3 talks about sending zero
1200 	 * length packets on general principle.  To further complicate things,
1201 	 * we don't have the sequence number.
1202 	 *
1203 	 * If we have an outstanding command still, then we opt to treat the
1204 	 * zero length packet as an abort.
1205 	 */
1206 	if (!header_valid) {
1207 		ccid_command_state_transition(cc, CCID_COMMAND_CCID_ABORTED);
1208 		ccid_command_complete(cc);
1209 		mutex_exit(&ccid->ccid_mutex);
1210 		usb_free_bulk_req(ubrp);
1211 		return;
1212 	}
1213 
1214 	slot = &ccid->ccid_slots[cc->cc_slot];
1215 
1216 	/*
1217 	 * If the sequence or slot number don't match the head of the list or
1218 	 * the response type is unexpected for this command then we should be
1219 	 * very suspect of the hardware at this point. At a minimum we should
1220 	 * fail this command and issue a reset.
1221 	 */
1222 	if (cch.ch_seq != cc->cc_seq ||
1223 	    cch.ch_slot != cc->cc_slot ||
1224 	    cch.ch_mtype != cc->cc_rtype) {
1225 		ccid_command_state_transition(cc, CCID_COMMAND_CCID_ABORTED);
1226 		ccid_command_complete(cc);
1227 		slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET;
1228 		ccid_worker_request(ccid);
1229 		mutex_exit(&ccid->ccid_mutex);
1230 		usb_free_bulk_req(ubrp);
1231 		return;
1232 	}
1233 
1234 	/*
1235 	 * Check that we have all the bytes that we were told we'd have. If we
1236 	 * don't, simulate this as an aborted command and issue a reset.
1237 	 */
1238 	if (LE_32(cch.ch_length) + sizeof (ccid_header_t) > mlen) {
1239 		ccid_command_state_transition(cc, CCID_COMMAND_CCID_ABORTED);
1240 		ccid_command_complete(cc);
1241 		slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET;
1242 		ccid_worker_request(ccid);
1243 		mutex_exit(&ccid->ccid_mutex);
1244 		usb_free_bulk_req(ubrp);
1245 		return;
1246 	}
1247 
1248 	/*
1249 	 * This response is for us. Before we complete the command check to see
1250 	 * what the state of the command is. If the command indicates that more
1251 	 * time has been requested, then we need to schedule a new Bulk-IN
1252 	 * request.
1253 	 */
1254 	if (CCID_REPLY_STATUS(cch.ch_param0) == CCID_REPLY_STATUS_MORE_TIME) {
1255 		int ret;
1256 
1257 		ret = ccid_bulkin_schedule(ccid);
1258 		if (ret != USB_SUCCESS) {
1259 			ccid_command_transport_error(cc, ret, USB_CR_OK);
1260 			slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET;
1261 			ccid_worker_request(ccid);
1262 		}
1263 		mutex_exit(&ccid->ccid_mutex);
1264 		usb_free_bulk_req(ubrp);
1265 		return;
1266 	}
1267 
1268 	/*
1269 	 * Take the message block from the Bulk-IN request and store it on the
1270 	 * command. We want this regardless if it succeeded, failed, or we have
1271 	 * some unexpected status value.
1272 	 */
1273 	cc->cc_response = ubrp->bulk_data;
1274 	ubrp->bulk_data = NULL;
1275 	ccid_command_state_transition(cc, CCID_COMMAND_COMPLETE);
1276 	ccid_command_complete(cc);
1277 	mutex_exit(&ccid->ccid_mutex);
1278 	usb_free_bulk_req(ubrp);
1279 }
1280 
1281 static void
ccid_reply_bulk_exc_cb(usb_pipe_handle_t ph,usb_bulk_req_t * ubrp)1282 ccid_reply_bulk_exc_cb(usb_pipe_handle_t ph, usb_bulk_req_t *ubrp)
1283 {
1284 	ccid_t *ccid;
1285 	ccid_command_t *cc;
1286 
1287 	ccid = (ccid_t *)ubrp->bulk_client_private;
1288 	mutex_enter(&ccid->ccid_mutex);
1289 
1290 	/*
1291 	 * Before we do anything else, we should mark that this Bulk-IN request
1292 	 * is no longer being dispatched.
1293 	 */
1294 	VERIFY3P(ubrp, ==, ccid->ccid_bulkin_dispatched);
1295 	ccid->ccid_bulkin_dispatched = NULL;
1296 
1297 	/*
1298 	 * While there are many different reasons that the Bulk-IN request could
1299 	 * have failed, each of these are treated as a transport error. If we
1300 	 * have a dispatched command, then we treat this as corresponding to
1301 	 * that command. Otherwise, we drop this.
1302 	 */
1303 	if ((cc = list_head(&ccid->ccid_command_queue)) != NULL) {
1304 		if (cc->cc_state == CCID_COMMAND_REPLYING) {
1305 			ccid_command_transport_error(cc, USB_SUCCESS,
1306 			    ubrp->bulk_completion_reason);
1307 		}
1308 	}
1309 	mutex_exit(&ccid->ccid_mutex);
1310 	usb_free_bulk_req(ubrp);
1311 }
1312 
1313 /*
1314  * Fill the Bulk-IN cache. If we do not entirely fill this, that's fine. If
1315  * there are no scheduled resources then we'll deal with that when we actually
1316  * get there.
1317  */
1318 static void
ccid_bulkin_cache_refresh(ccid_t * ccid)1319 ccid_bulkin_cache_refresh(ccid_t *ccid)
1320 {
1321 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
1322 	while (ccid->ccid_bulkin_alloced < CCID_BULK_NALLOCED) {
1323 		usb_bulk_req_t *ubrp;
1324 
1325 		if ((ubrp = usb_alloc_bulk_req(ccid->ccid_dip,
1326 		    ccid->ccid_bufsize, 0)) == NULL)
1327 			return;
1328 
1329 		ubrp->bulk_len = ccid->ccid_bufsize;
1330 		ubrp->bulk_timeout = CCID_BULK_IN_TIMEOUT;
1331 		ubrp->bulk_client_private = (usb_opaque_t)ccid;
1332 		ubrp->bulk_attributes = USB_ATTRS_SHORT_XFER_OK |
1333 		    USB_ATTRS_AUTOCLEARING;
1334 		ubrp->bulk_cb = ccid_reply_bulk_cb;
1335 		ubrp->bulk_exc_cb = ccid_reply_bulk_exc_cb;
1336 
1337 		ccid->ccid_bulkin_cache[ccid->ccid_bulkin_alloced] = ubrp;
1338 		ccid->ccid_bulkin_alloced++;
1339 	}
1340 
1341 }
1342 
1343 static usb_bulk_req_t *
ccid_bulkin_cache_get(ccid_t * ccid)1344 ccid_bulkin_cache_get(ccid_t *ccid)
1345 {
1346 	usb_bulk_req_t *ubrp;
1347 
1348 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
1349 
1350 	if (ccid->ccid_bulkin_alloced == 0) {
1351 		ccid_bulkin_cache_refresh(ccid);
1352 		if (ccid->ccid_bulkin_alloced == 0)
1353 			return (NULL);
1354 	}
1355 
1356 	ccid->ccid_bulkin_alloced--;
1357 	ubrp = ccid->ccid_bulkin_cache[ccid->ccid_bulkin_alloced];
1358 	VERIFY3P(ubrp, !=, NULL);
1359 	ccid->ccid_bulkin_cache[ccid->ccid_bulkin_alloced] = NULL;
1360 
1361 	return (ubrp);
1362 }
1363 
1364 /*
1365  * Attempt to schedule a Bulk-In request. Note that only one should ever be
1366  * scheduled at any time.
1367  */
1368 static int
ccid_bulkin_schedule(ccid_t * ccid)1369 ccid_bulkin_schedule(ccid_t *ccid)
1370 {
1371 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
1372 	if (ccid->ccid_bulkin_dispatched == NULL) {
1373 		usb_bulk_req_t *ubrp;
1374 		int ret;
1375 
1376 		ubrp = ccid_bulkin_cache_get(ccid);
1377 		if (ubrp == NULL) {
1378 			return (USB_NO_RESOURCES);
1379 		}
1380 
1381 		if ((ret = usb_pipe_bulk_xfer(ccid->ccid_bulkin_pipe, ubrp,
1382 		    0)) != USB_SUCCESS) {
1383 			ccid_error(ccid,
1384 			    "!failed to schedule Bulk-In response: %d", ret);
1385 			usb_free_bulk_req(ubrp);
1386 			return (ret);
1387 		}
1388 
1389 		ccid->ccid_bulkin_dispatched = ubrp;
1390 	}
1391 
1392 	return (USB_SUCCESS);
1393 }
1394 
1395 /*
1396  * Make sure that the head of the queue has been dispatched. If a dispatch to
1397  * the device fails, fail the command and try the next one.
1398  */
1399 static void
ccid_command_dispatch(ccid_t * ccid)1400 ccid_command_dispatch(ccid_t *ccid)
1401 {
1402 	ccid_command_t *cc;
1403 
1404 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
1405 	while ((cc = list_head(&ccid->ccid_command_queue)) != NULL) {
1406 		int ret;
1407 
1408 		if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0)
1409 			return;
1410 
1411 		/*
1412 		 * Head of the queue is already being processed. We're done
1413 		 * here.
1414 		 */
1415 		if (cc->cc_state > CCID_COMMAND_QUEUED) {
1416 			return;
1417 		}
1418 
1419 		/*
1420 		 * Mark the command as being dispatched to the device. This
1421 		 * prevents anyone else from getting in and confusing things.
1422 		 */
1423 		ccid_command_state_transition(cc, CCID_COMMAND_DISPATCHED);
1424 		cc->cc_dispatch_time = gethrtime();
1425 
1426 		/*
1427 		 * Drop the global lock while we schedule the USB I/O.
1428 		 */
1429 		mutex_exit(&ccid->ccid_mutex);
1430 
1431 		ret = usb_pipe_bulk_xfer(ccid->ccid_bulkout_pipe, cc->cc_ubrp,
1432 		    0);
1433 		mutex_enter(&ccid->ccid_mutex);
1434 		if (ret != USB_SUCCESS) {
1435 			/*
1436 			 * We don't need to free the usb_bulk_req_t here as it
1437 			 * will be taken care of when the command itself is
1438 			 * freed.
1439 			 */
1440 			ccid_error(ccid, "!Bulk pipe dispatch failed: %d\n",
1441 			    ret);
1442 			ccid_command_transport_error(cc, ret, USB_CR_OK);
1443 		}
1444 	}
1445 }
1446 
1447 static int
ccid_command_queue(ccid_t * ccid,ccid_command_t * cc)1448 ccid_command_queue(ccid_t *ccid, ccid_command_t *cc)
1449 {
1450 	id_t seq;
1451 	ccid_header_t *cchead;
1452 
1453 	seq = id_alloc_nosleep(ccid->ccid_seqs);
1454 	if (seq == -1)
1455 		return (ENOMEM);
1456 	cc->cc_seq = seq;
1457 	VERIFY3U(seq, <=, UINT8_MAX);
1458 	cchead = (void *)cc->cc_ubrp->bulk_data->b_rptr;
1459 	cchead->ch_seq = (uint8_t)seq;
1460 
1461 	mutex_enter(&ccid->ccid_mutex);
1462 	/*
1463 	 * Take a shot at filling up our reply cache while we're submitting this
1464 	 * command.
1465 	 */
1466 	ccid_bulkin_cache_refresh(ccid);
1467 	list_insert_tail(&ccid->ccid_command_queue, cc);
1468 	ccid_command_state_transition(cc, CCID_COMMAND_QUEUED);
1469 	cc->cc_queue_time = gethrtime();
1470 	ccid_command_dispatch(ccid);
1471 	mutex_exit(&ccid->ccid_mutex);
1472 
1473 	return (0);
1474 }
1475 
1476 /*
1477  * Normal callback for Bulk-Out requests which represents commands issued to the
1478  * device.
1479  */
1480 static void
ccid_dispatch_bulk_cb(usb_pipe_handle_t ph,usb_bulk_req_t * ubrp)1481 ccid_dispatch_bulk_cb(usb_pipe_handle_t ph, usb_bulk_req_t *ubrp)
1482 {
1483 	int ret;
1484 	ccid_command_t *cc = (void *)ubrp->bulk_client_private;
1485 	ccid_t *ccid = cc->cc_ccid;
1486 
1487 	mutex_enter(&ccid->ccid_mutex);
1488 	VERIFY3S(cc->cc_state, ==, CCID_COMMAND_DISPATCHED);
1489 	ccid_command_state_transition(cc, CCID_COMMAND_REPLYING);
1490 	cc->cc_dispatch_cb_time = gethrtime();
1491 
1492 	/*
1493 	 * Since we have successfully sent the command, give it a Bulk-In
1494 	 * response to reply to us with. If that fails, we'll note a transport
1495 	 * error which will kick off the next command if needed.
1496 	 */
1497 	ret = ccid_bulkin_schedule(ccid);
1498 	if (ret != USB_SUCCESS) {
1499 		ccid_command_transport_error(cc, ret, USB_CR_OK);
1500 	}
1501 	mutex_exit(&ccid->ccid_mutex);
1502 }
1503 
1504 /*
1505  * Exception callback for the Bulk-Out requests which represent commands issued
1506  * to the device.
1507  */
1508 static void
ccid_dispatch_bulk_exc_cb(usb_pipe_handle_t ph,usb_bulk_req_t * ubrp)1509 ccid_dispatch_bulk_exc_cb(usb_pipe_handle_t ph, usb_bulk_req_t *ubrp)
1510 {
1511 	ccid_command_t *cc = (void *)ubrp->bulk_client_private;
1512 	ccid_t *ccid = cc->cc_ccid;
1513 
1514 	mutex_enter(&ccid->ccid_mutex);
1515 	ccid_command_transport_error(cc, USB_SUCCESS,
1516 	    ubrp->bulk_completion_reason);
1517 	mutex_exit(&ccid->ccid_mutex);
1518 }
1519 
1520 static void
ccid_command_free(ccid_command_t * cc)1521 ccid_command_free(ccid_command_t *cc)
1522 {
1523 	VERIFY0(list_link_active(&cc->cc_list_node));
1524 	VERIFY(cc->cc_state == CCID_COMMAND_ALLOCATED ||
1525 	    cc->cc_state >= CCID_COMMAND_COMPLETE);
1526 
1527 	if (cc->cc_response != NULL) {
1528 		freemsgchain(cc->cc_response);
1529 		cc->cc_response = NULL;
1530 	}
1531 
1532 	if (cc->cc_ubrp != NULL) {
1533 		usb_free_bulk_req(cc->cc_ubrp);
1534 		cc->cc_ubrp = NULL;
1535 	}
1536 
1537 	if (cc->cc_seq != 0) {
1538 		id_free(cc->cc_ccid->ccid_seqs, cc->cc_seq);
1539 		cc->cc_seq = 0;
1540 	}
1541 
1542 	cv_destroy(&cc->cc_cv);
1543 	kmem_free(cc, sizeof (ccid_command_t));
1544 }
1545 
1546 /*
1547  * Copy len bytes of data from buf into the allocated message block.
1548  */
1549 static void
ccid_command_bcopy(ccid_command_t * cc,const void * buf,size_t len)1550 ccid_command_bcopy(ccid_command_t *cc, const void *buf, size_t len)
1551 {
1552 	size_t mlen;
1553 
1554 	mlen = msgsize(cc->cc_ubrp->bulk_data);
1555 	VERIFY3U(mlen + len, >=, len);
1556 	VERIFY3U(mlen + len, >=, mlen);
1557 	mlen += len;
1558 	VERIFY3U(mlen, <=, cc->cc_ubrp->bulk_len);
1559 
1560 	bcopy(buf, cc->cc_ubrp->bulk_data->b_wptr, len);
1561 	cc->cc_ubrp->bulk_data->b_wptr += len;
1562 }
1563 
1564 /*
1565  * Allocate a command of a specific size and parameters. This will allocate a
1566  * USB bulk transfer that the caller will copy data to.
1567  */
1568 static int
ccid_command_alloc(ccid_t * ccid,ccid_slot_t * slot,boolean_t block,mblk_t * datamp,size_t datasz,uint8_t mtype,uint8_t param0,uint8_t param1,uint8_t param2,ccid_command_t ** ccp)1569 ccid_command_alloc(ccid_t *ccid, ccid_slot_t *slot, boolean_t block,
1570     mblk_t *datamp, size_t datasz, uint8_t mtype, uint8_t param0,
1571     uint8_t param1, uint8_t param2, ccid_command_t **ccp)
1572 {
1573 	size_t allocsz;
1574 	int kmflag, usbflag;
1575 	ccid_command_t *cc;
1576 	ccid_header_t *cchead;
1577 	ccid_response_code_t rtype;
1578 
1579 	switch (mtype) {
1580 	case CCID_REQUEST_POWER_ON:
1581 	case CCID_REQUEST_POWER_OFF:
1582 	case CCID_REQUEST_SLOT_STATUS:
1583 	case CCID_REQUEST_GET_PARAMS:
1584 	case CCID_REQUEST_RESET_PARAMS:
1585 	case CCID_REQUEST_ICC_CLOCK:
1586 	case CCID_REQUEST_T0APDU:
1587 	case CCID_REQUEST_MECHANICAL:
1588 	case CCID_REQEUST_ABORT:
1589 		if (datasz != 0)
1590 			return (EINVAL);
1591 		break;
1592 	case CCID_REQUEST_TRANSFER_BLOCK:
1593 	case CCID_REQUEST_ESCAPE:
1594 	case CCID_REQUEST_SECURE:
1595 	case CCID_REQUEST_SET_PARAMS:
1596 	case CCID_REQUEST_DATA_CLOCK:
1597 		break;
1598 	default:
1599 		return (EINVAL);
1600 	}
1601 
1602 	switch (mtype) {
1603 	case CCID_REQUEST_POWER_ON:
1604 	case CCID_REQUEST_SECURE:
1605 	case CCID_REQUEST_TRANSFER_BLOCK:
1606 		rtype = CCID_RESPONSE_DATA_BLOCK;
1607 		break;
1608 
1609 	case CCID_REQUEST_POWER_OFF:
1610 	case CCID_REQUEST_SLOT_STATUS:
1611 	case CCID_REQUEST_ICC_CLOCK:
1612 	case CCID_REQUEST_T0APDU:
1613 	case CCID_REQUEST_MECHANICAL:
1614 	case CCID_REQEUST_ABORT:
1615 		rtype = CCID_RESPONSE_SLOT_STATUS;
1616 		break;
1617 
1618 	case CCID_REQUEST_GET_PARAMS:
1619 	case CCID_REQUEST_RESET_PARAMS:
1620 	case CCID_REQUEST_SET_PARAMS:
1621 		rtype = CCID_RESPONSE_PARAMETERS;
1622 		break;
1623 
1624 	case CCID_REQUEST_ESCAPE:
1625 		rtype = CCID_RESPONSE_ESCAPE;
1626 		break;
1627 
1628 	case CCID_REQUEST_DATA_CLOCK:
1629 		rtype = CCID_RESPONSE_DATA_CLOCK;
1630 		break;
1631 	default:
1632 		return (EINVAL);
1633 	}
1634 
1635 	if (block) {
1636 		kmflag = KM_SLEEP;
1637 		usbflag = USB_FLAGS_SLEEP;
1638 	} else {
1639 		kmflag = KM_NOSLEEP | KM_NORMALPRI;
1640 		usbflag = 0;
1641 	}
1642 
1643 	if (datasz + sizeof (ccid_header_t) < datasz)
1644 		return (EINVAL);
1645 	if (datasz + sizeof (ccid_header_t) > ccid->ccid_bufsize)
1646 		return (EINVAL);
1647 
1648 	cc = kmem_zalloc(sizeof (ccid_command_t), kmflag);
1649 	if (cc == NULL)
1650 		return (ENOMEM);
1651 
1652 	allocsz = datasz + sizeof (ccid_header_t);
1653 	if (datamp == NULL) {
1654 		cc->cc_ubrp = usb_alloc_bulk_req(ccid->ccid_dip, allocsz,
1655 		    usbflag);
1656 	} else {
1657 		cc->cc_ubrp = usb_alloc_bulk_req(ccid->ccid_dip, 0, usbflag);
1658 	}
1659 	if (cc->cc_ubrp == NULL) {
1660 		kmem_free(cc, sizeof (ccid_command_t));
1661 		return (ENOMEM);
1662 	}
1663 
1664 	list_link_init(&cc->cc_list_node);
1665 	cv_init(&cc->cc_cv, NULL, CV_DRIVER, NULL);
1666 	cc->cc_mtype = mtype;
1667 	cc->cc_rtype = rtype;
1668 	cc->cc_slot = slot->cs_slotno;
1669 	cc->cc_reqlen = datasz;
1670 	cc->cc_ccid = ccid;
1671 	cc->cc_state = CCID_COMMAND_ALLOCATED;
1672 
1673 	/*
1674 	 * Fill in bulk request attributes. Note that short transfers out
1675 	 * are not OK.
1676 	 */
1677 	if (datamp != NULL) {
1678 		cc->cc_ubrp->bulk_data = datamp;
1679 	}
1680 	cc->cc_ubrp->bulk_len = allocsz;
1681 	cc->cc_ubrp->bulk_timeout = CCID_BULK_OUT_TIMEOUT;
1682 	cc->cc_ubrp->bulk_client_private = (usb_opaque_t)cc;
1683 	cc->cc_ubrp->bulk_attributes = USB_ATTRS_AUTOCLEARING;
1684 	cc->cc_ubrp->bulk_cb = ccid_dispatch_bulk_cb;
1685 	cc->cc_ubrp->bulk_exc_cb = ccid_dispatch_bulk_exc_cb;
1686 
1687 	/*
1688 	 * Fill in the command header. We fill in everything except the sequence
1689 	 * number, which is done by the actual dispatch code.
1690 	 */
1691 	cchead = (void *)cc->cc_ubrp->bulk_data->b_rptr;
1692 	cchead->ch_mtype = mtype;
1693 	cchead->ch_length = LE_32(datasz);
1694 	cchead->ch_slot = slot->cs_slotno;
1695 	cchead->ch_seq = 0;
1696 	cchead->ch_param0 = param0;
1697 	cchead->ch_param1 = param1;
1698 	cchead->ch_param2 = param2;
1699 	cc->cc_ubrp->bulk_data->b_wptr += sizeof (ccid_header_t);
1700 	*ccp = cc;
1701 
1702 	return (0);
1703 }
1704 
1705 /*
1706  * The rest of the stack is in charge of timing out commands and potentially
1707  * aborting them. At this point in time, there's no specific timeout aspect
1708  * here.
1709  */
1710 static void
ccid_command_poll(ccid_t * ccid,ccid_command_t * cc)1711 ccid_command_poll(ccid_t *ccid, ccid_command_t *cc)
1712 {
1713 	VERIFY0(cc->cc_flags & CCID_COMMAND_F_USER);
1714 
1715 	mutex_enter(&ccid->ccid_mutex);
1716 	while ((cc->cc_state < CCID_COMMAND_COMPLETE) &&
1717 	    (ccid->ccid_flags & CCID_F_DEV_GONE_MASK) == 0) {
1718 		cv_wait(&cc->cc_cv, &ccid->ccid_mutex);
1719 	}
1720 
1721 	/*
1722 	 * Treat this as a consumption and remove it from the completion list.
1723 	 */
1724 #ifdef DEBUG
1725 	ccid_command_t *check;
1726 	for (check = list_head(&ccid->ccid_complete_queue); check != NULL;
1727 	    check = list_next(&ccid->ccid_complete_queue, check)) {
1728 		if (cc == check)
1729 			break;
1730 	}
1731 	ASSERT3P(check, !=, NULL);
1732 #endif
1733 	VERIFY(list_link_active(&cc->cc_list_node));
1734 	list_remove(&ccid->ccid_complete_queue, cc);
1735 	mutex_exit(&ccid->ccid_mutex);
1736 }
1737 
1738 static int
ccid_command_power_off(ccid_t * ccid,ccid_slot_t * cs)1739 ccid_command_power_off(ccid_t *ccid, ccid_slot_t *cs)
1740 {
1741 	int ret;
1742 	ccid_command_t *cc;
1743 	ccid_reply_icc_status_t cis;
1744 	ccid_reply_command_status_t crs;
1745 
1746 	if ((ret = ccid_command_alloc(ccid, cs, B_TRUE, NULL, 0,
1747 	    CCID_REQUEST_POWER_OFF, 0, 0, 0, &cc)) != 0) {
1748 		return (ret);
1749 	}
1750 
1751 	if ((ret = ccid_command_queue(ccid, cc)) != 0) {
1752 		ccid_command_free(cc);
1753 		return (ret);
1754 	}
1755 
1756 	ccid_command_poll(ccid, cc);
1757 
1758 	if (cc->cc_state != CCID_COMMAND_COMPLETE) {
1759 		ret = EIO;
1760 		goto done;
1761 	}
1762 
1763 	ccid_command_status_decode(cc, &crs, &cis, NULL);
1764 	if (crs == CCID_REPLY_STATUS_FAILED) {
1765 		if (cis == CCID_REPLY_ICC_MISSING) {
1766 			ret = ENXIO;
1767 		} else {
1768 			ret = EIO;
1769 		}
1770 	} else {
1771 		ret = 0;
1772 	}
1773 done:
1774 	ccid_command_free(cc);
1775 	return (ret);
1776 }
1777 
1778 static int
ccid_command_power_on(ccid_t * ccid,ccid_slot_t * cs,ccid_class_voltage_t volt,mblk_t ** atrp)1779 ccid_command_power_on(ccid_t *ccid, ccid_slot_t *cs, ccid_class_voltage_t volt,
1780     mblk_t **atrp)
1781 {
1782 	int ret;
1783 	ccid_command_t *cc;
1784 	ccid_reply_command_status_t crs;
1785 	ccid_reply_icc_status_t cis;
1786 	ccid_command_err_t cce;
1787 
1788 	if (atrp == NULL)
1789 		return (EINVAL);
1790 
1791 	*atrp = NULL;
1792 
1793 	switch (volt) {
1794 	case CCID_CLASS_VOLT_AUTO:
1795 	case CCID_CLASS_VOLT_5_0:
1796 	case CCID_CLASS_VOLT_3_0:
1797 	case CCID_CLASS_VOLT_1_8:
1798 		break;
1799 	default:
1800 		return (EINVAL);
1801 	}
1802 
1803 	if ((ret = ccid_command_alloc(ccid, cs, B_TRUE, NULL, 0,
1804 	    CCID_REQUEST_POWER_ON, volt, 0, 0, &cc)) != 0) {
1805 		return (ret);
1806 	}
1807 
1808 	if ((ret = ccid_command_queue(ccid, cc)) != 0) {
1809 		ccid_command_free(cc);
1810 		return (ret);
1811 	}
1812 
1813 	ccid_command_poll(ccid, cc);
1814 
1815 	if (cc->cc_state != CCID_COMMAND_COMPLETE) {
1816 		ret = EIO;
1817 		goto done;
1818 	}
1819 
1820 	/*
1821 	 * Look for a few specific errors here:
1822 	 *
1823 	 * - ICC_MUTE via a few potential ways
1824 	 * - Bad voltage
1825 	 */
1826 	ccid_command_status_decode(cc, &crs, &cis, &cce);
1827 	if (crs == CCID_REPLY_STATUS_FAILED) {
1828 		if (cis == CCID_REPLY_ICC_MISSING) {
1829 			ret = ENXIO;
1830 		} else if (cis == CCID_REPLY_ICC_INACTIVE &&
1831 		    cce == 7) {
1832 			/*
1833 			 * This means that byte 7 was invalid. In other words,
1834 			 * that the voltage wasn't correct. See Table 6.1-2
1835 			 * 'Errors' in the CCID r1.1.0 spec.
1836 			 */
1837 			ret = ENOTSUP;
1838 		} else {
1839 			ret = EIO;
1840 		}
1841 	} else {
1842 		size_t len;
1843 
1844 		len = ccid_command_resp_length(cc);
1845 		if (len == 0) {
1846 			ret = EINVAL;
1847 			goto done;
1848 		}
1849 
1850 #ifdef	DEBUG
1851 		/*
1852 		 * This should have already been checked by the response
1853 		 * framework, but sanity check this again.
1854 		 */
1855 		size_t mlen = msgsize(cc->cc_response);
1856 		VERIFY3U(mlen, >=, len + sizeof (ccid_header_t));
1857 #endif
1858 
1859 		/*
1860 		 * Munge the message block to have the ATR. We want to make sure
1861 		 * that the write pointer is set to the maximum length that we
1862 		 * got back from the driver (the message block could strictly
1863 		 * speaking be larger, because we got a larger transfer for some
1864 		 * reason).
1865 		 */
1866 		cc->cc_response->b_rptr += sizeof (ccid_header_t);
1867 		cc->cc_response->b_wptr = cc->cc_response->b_rptr + len;
1868 		*atrp = cc->cc_response;
1869 		cc->cc_response = NULL;
1870 		ret = 0;
1871 	}
1872 
1873 done:
1874 	ccid_command_free(cc);
1875 	return (ret);
1876 }
1877 
1878 static int
ccid_command_get_parameters(ccid_t * ccid,ccid_slot_t * slot,atr_protocol_t * protp,ccid_params_t * paramsp)1879 ccid_command_get_parameters(ccid_t *ccid, ccid_slot_t *slot,
1880     atr_protocol_t *protp, ccid_params_t *paramsp)
1881 {
1882 	int ret;
1883 	uint8_t prot;
1884 	size_t mlen;
1885 	ccid_command_t *cc;
1886 	ccid_reply_command_status_t crs;
1887 	ccid_reply_icc_status_t cis;
1888 	const void *cpbuf;
1889 
1890 	if ((ret = ccid_command_alloc(ccid, slot, B_TRUE, NULL, 0,
1891 	    CCID_REQUEST_GET_PARAMS, 0, 0, 0, &cc)) != 0) {
1892 		return (ret);
1893 	}
1894 
1895 	if ((ret = ccid_command_queue(ccid, cc)) != 0)
1896 		goto done;
1897 
1898 	ccid_command_poll(ccid, cc);
1899 
1900 	if (cc->cc_state != CCID_COMMAND_COMPLETE) {
1901 		ret = EIO;
1902 		goto done;
1903 	}
1904 
1905 	ccid_command_status_decode(cc, &crs, &cis, NULL);
1906 	if (crs != CCID_REPLY_STATUS_COMPLETE) {
1907 		if (cis == CCID_REPLY_ICC_MISSING) {
1908 			ret = ENXIO;
1909 		} else {
1910 			ret = EIO;
1911 		}
1912 		goto done;
1913 	}
1914 
1915 	/*
1916 	 * The protocol is in ch_param2 of the header.
1917 	 */
1918 	prot = ccid_command_resp_param2(cc);
1919 	mlen = ccid_command_resp_length(cc);
1920 	cpbuf = cc->cc_response->b_rptr + sizeof (ccid_header_t);
1921 
1922 	ret = 0;
1923 	switch (prot) {
1924 	case 0:
1925 		if (mlen < sizeof (ccid_params_t0_t)) {
1926 			ret = EOVERFLOW;
1927 			goto done;
1928 		}
1929 		*protp = ATR_P_T0;
1930 		bcopy(cpbuf, &paramsp->ccp_t0, sizeof (ccid_params_t0_t));
1931 		break;
1932 	case 1:
1933 		if (mlen < sizeof (ccid_params_t1_t)) {
1934 			ret = EOVERFLOW;
1935 			goto done;
1936 		}
1937 		*protp = ATR_P_T1;
1938 		bcopy(cpbuf, &paramsp->ccp_t1, sizeof (ccid_params_t1_t));
1939 		break;
1940 	default:
1941 		ret = ECHRNG;
1942 		break;
1943 	}
1944 
1945 done:
1946 	ccid_command_free(cc);
1947 	return (ret);
1948 }
1949 
1950 static void
ccid_hw_error(ccid_t * ccid,ccid_intr_hwerr_t * hwerr)1951 ccid_hw_error(ccid_t *ccid, ccid_intr_hwerr_t *hwerr)
1952 {
1953 	ccid_slot_t *slot;
1954 
1955 	/* Make sure the slot number is within range. */
1956 	if (hwerr->cih_slot >= ccid->ccid_nslots) {
1957 		ccid->ccid_stats.cst_intr_inval++;
1958 		return;
1959 	}
1960 
1961 	slot = &ccid->ccid_slots[hwerr->cih_slot];
1962 
1963 	/* The only error condition defined by the spec is overcurrent. */
1964 	if (hwerr->cih_code != CCID_INTR_HWERR_OVERCURRENT) {
1965 		ccid->ccid_stats.cst_intr_inval++;
1966 		return;
1967 	}
1968 
1969 	/*
1970 	 * The worker thread will take care of this situation.
1971 	 */
1972 	slot->cs_flags |= CCID_SLOT_F_INTR_OVERCURRENT;
1973 	ccid_worker_request(ccid);
1974 }
1975 
1976 static void
ccid_intr_pipe_cb(usb_pipe_handle_t ph,usb_intr_req_t * uirp)1977 ccid_intr_pipe_cb(usb_pipe_handle_t ph, usb_intr_req_t *uirp)
1978 {
1979 	mblk_t *mp;
1980 	size_t msglen, explen;
1981 	uint_t i;
1982 	boolean_t change;
1983 	ccid_intr_hwerr_t ccid_hwerr;
1984 	ccid_t *ccid = (ccid_t *)uirp->intr_client_private;
1985 
1986 	mp = uirp->intr_data;
1987 	if (mp == NULL)
1988 		goto done;
1989 
1990 	msglen = msgsize(mp);
1991 	if (msglen == 0)
1992 		goto done;
1993 
1994 	switch (mp->b_rptr[0]) {
1995 	case CCID_INTR_CODE_SLOT_CHANGE:
1996 		mutex_enter(&ccid->ccid_mutex);
1997 		ccid->ccid_stats.cst_intr_slot_change++;
1998 
1999 		explen = 1 + ((2 * ccid->ccid_nslots + (NBBY-1)) / NBBY);
2000 		if (msglen < explen) {
2001 			ccid->ccid_stats.cst_intr_inval++;
2002 			mutex_exit(&ccid->ccid_mutex);
2003 			goto done;
2004 		}
2005 
2006 		change = B_FALSE;
2007 		for (i = 0; i < ccid->ccid_nslots; i++) {
2008 			uint_t byte = (i * 2 / NBBY) + 1;
2009 			uint_t shift = i * 2 % NBBY;
2010 			uint_t present = 1 << shift;
2011 			uint_t delta = 2 << shift;
2012 
2013 			if (mp->b_rptr[byte] & delta) {
2014 				ccid_slot_t *slot = &ccid->ccid_slots[i];
2015 
2016 				slot->cs_flags &= ~CCID_SLOT_F_INTR_MASK;
2017 				slot->cs_flags |= CCID_SLOT_F_CHANGED;
2018 				if (mp->b_rptr[byte] & present) {
2019 					slot->cs_flags |= CCID_SLOT_F_INTR_ADD;
2020 				} else {
2021 					slot->cs_flags |= CCID_SLOT_F_INTR_GONE;
2022 				}
2023 				change = B_TRUE;
2024 			}
2025 		}
2026 
2027 		if (change) {
2028 			ccid_worker_request(ccid);
2029 		}
2030 		mutex_exit(&ccid->ccid_mutex);
2031 		break;
2032 	case CCID_INTR_CODE_HW_ERROR:
2033 		mutex_enter(&ccid->ccid_mutex);
2034 		ccid->ccid_stats.cst_intr_hwerr++;
2035 
2036 		if (msglen < sizeof (ccid_intr_hwerr_t)) {
2037 			ccid->ccid_stats.cst_intr_inval++;
2038 			mutex_exit(&ccid->ccid_mutex);
2039 			goto done;
2040 		}
2041 
2042 		bcopy(mp->b_rptr, &ccid_hwerr, sizeof (ccid_intr_hwerr_t));
2043 		ccid_hw_error(ccid, &ccid_hwerr);
2044 
2045 		mutex_exit(&ccid->ccid_mutex);
2046 		break;
2047 	default:
2048 		mutex_enter(&ccid->ccid_mutex);
2049 		ccid->ccid_stats.cst_intr_unknown++;
2050 		mutex_exit(&ccid->ccid_mutex);
2051 		break;
2052 	}
2053 
2054 done:
2055 	usb_free_intr_req(uirp);
2056 }
2057 
2058 static void
ccid_intr_pipe_except_cb(usb_pipe_handle_t ph,usb_intr_req_t * uirp)2059 ccid_intr_pipe_except_cb(usb_pipe_handle_t ph, usb_intr_req_t *uirp)
2060 {
2061 	ccid_t *ccid = (ccid_t *)uirp->intr_client_private;
2062 
2063 	ccid->ccid_stats.cst_intr_errs++;
2064 	switch (uirp->intr_completion_reason) {
2065 	case USB_CR_PIPE_RESET:
2066 	case USB_CR_NO_RESOURCES:
2067 		ccid->ccid_stats.cst_intr_restart++;
2068 		ccid_intr_poll_init(ccid);
2069 		break;
2070 	default:
2071 		break;
2072 	}
2073 	usb_free_intr_req(uirp);
2074 }
2075 
2076 /*
2077  * Clean up all the state associated with this slot and its ICC.
2078  */
2079 static void
ccid_slot_teardown(ccid_t * ccid,ccid_slot_t * slot,boolean_t signal)2080 ccid_slot_teardown(ccid_t *ccid, ccid_slot_t *slot, boolean_t signal)
2081 {
2082 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2083 
2084 	if (slot->cs_icc.icc_fini != NULL) {
2085 		slot->cs_icc.icc_fini(ccid, slot);
2086 	}
2087 
2088 	atr_data_reset(slot->cs_icc.icc_atr_data);
2089 	slot->cs_icc.icc_protocols = ATR_P_NONE;
2090 	slot->cs_icc.icc_cur_protocol = ATR_P_NONE;
2091 	slot->cs_icc.icc_init = NULL;
2092 	slot->cs_icc.icc_tx = NULL;
2093 	slot->cs_icc.icc_complete = NULL;
2094 	slot->cs_icc.icc_teardown = NULL;
2095 	slot->cs_icc.icc_fini = NULL;
2096 
2097 	slot->cs_voltage = 0;
2098 	freemsgchain(slot->cs_atr);
2099 	slot->cs_atr = NULL;
2100 
2101 	if (signal && slot->cs_excl_minor != NULL) {
2102 		pollwakeup(&slot->cs_excl_minor->cm_pollhead, POLLHUP);
2103 	}
2104 }
2105 
2106 /*
2107  * Wait for teardown of outstanding user I/O.
2108  */
2109 static void
ccid_slot_io_teardown(ccid_t * ccid,ccid_slot_t * slot)2110 ccid_slot_io_teardown(ccid_t *ccid, ccid_slot_t *slot)
2111 {
2112 	/*
2113 	 * If there is outstanding user I/O, then we need to go ahead and take
2114 	 * care of that. Once this function returns, the user I/O will have been
2115 	 * dealt with; however, before we can tear down things, we need to make
2116 	 * sure that the logical I/O has been completed.
2117 	 */
2118 	if (slot->cs_icc.icc_teardown != NULL) {
2119 		slot->cs_icc.icc_teardown(ccid, slot, ENXIO);
2120 	}
2121 
2122 	while ((slot->cs_flags & CCID_SLOT_F_NEED_IO_TEARDOWN) != 0) {
2123 		cv_wait(&slot->cs_io.ci_cv, &ccid->ccid_mutex);
2124 	}
2125 }
2126 
2127 /*
2128  * The given CCID slot has been inactivated. Clean up.
2129  */
2130 static void
ccid_slot_inactive(ccid_t * ccid,ccid_slot_t * slot)2131 ccid_slot_inactive(ccid_t *ccid, ccid_slot_t *slot)
2132 {
2133 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2134 
2135 	slot->cs_flags &= ~CCID_SLOT_F_ACTIVE;
2136 
2137 	ccid_slot_io_teardown(ccid, slot);
2138 
2139 	/*
2140 	 * Now that we've finished completely waiting for the logical I/O to be
2141 	 * torn down, it's safe for us to proceed with the rest of the needed
2142 	 * tear down.
2143 	 */
2144 	ccid_slot_teardown(ccid, slot, B_TRUE);
2145 }
2146 
2147 /*
2148  * The given CCID slot has been removed. Clean up.
2149  */
2150 static void
ccid_slot_removed(ccid_t * ccid,ccid_slot_t * slot,boolean_t notify)2151 ccid_slot_removed(ccid_t *ccid, ccid_slot_t *slot, boolean_t notify)
2152 {
2153 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2154 	if ((slot->cs_flags & CCID_SLOT_F_PRESENT) == 0) {
2155 		VERIFY0(slot->cs_flags & CCID_SLOT_F_ACTIVE);
2156 		return;
2157 	}
2158 
2159 	/*
2160 	 * This slot is gone, mark the flags accordingly.
2161 	 */
2162 	slot->cs_flags &= ~CCID_SLOT_F_PRESENT;
2163 
2164 	ccid_slot_inactive(ccid, slot);
2165 }
2166 
2167 static void
ccid_slot_setup_functions(ccid_t * ccid,ccid_slot_t * slot)2168 ccid_slot_setup_functions(ccid_t *ccid, ccid_slot_t *slot)
2169 {
2170 	uint_t bits = CCID_CLASS_F_SHORT_APDU_XCHG | CCID_CLASS_F_EXT_APDU_XCHG;
2171 
2172 	slot->cs_icc.icc_init = NULL;
2173 	slot->cs_icc.icc_tx = NULL;
2174 	slot->cs_icc.icc_complete = NULL;
2175 	slot->cs_icc.icc_teardown = NULL;
2176 	slot->cs_icc.icc_fini = NULL;
2177 
2178 	switch (ccid->ccid_class.ccd_dwFeatures & bits) {
2179 	case CCID_CLASS_F_SHORT_APDU_XCHG:
2180 	case CCID_CLASS_F_EXT_APDU_XCHG:
2181 		/*
2182 		 * Readers with extended APDU support always also support
2183 		 * short APDUs. We only ever use short APDUs.
2184 		 */
2185 		slot->cs_icc.icc_tx = ccid_write_apdu;
2186 		slot->cs_icc.icc_complete = ccid_complete_apdu;
2187 		slot->cs_icc.icc_teardown = ccid_teardown_apdu;
2188 		break;
2189 	default:
2190 		break;
2191 	}
2192 
2193 	/*
2194 	 * When we don't have a supported tx function, we don't want to end
2195 	 * up blocking attach. It's important we attach so that users can try
2196 	 * and determine information about the ICC and reader.
2197 	 */
2198 	if (slot->cs_icc.icc_tx == NULL) {
2199 		ccid_error(ccid, "!CCID does not support I/O transfers to ICC");
2200 	}
2201 }
2202 
2203 /*
2204  * We have an ICC present in a slot. We require that the reader does all
2205  * protocol and parameter related initializations for us. Just parse the ATR
2206  * for our own use and use GET_PARAMS to query the parameters the reader set
2207  * up for us.
2208  */
2209 static boolean_t
ccid_slot_params_init(ccid_t * ccid,ccid_slot_t * slot,mblk_t * atr)2210 ccid_slot_params_init(ccid_t *ccid, ccid_slot_t *slot, mblk_t *atr)
2211 {
2212 	int ret;
2213 	atr_parsecode_t p;
2214 	atr_protocol_t prot;
2215 	atr_data_t *data;
2216 
2217 	/*
2218 	 * Use the slot's atr data structure. This is only used when we're in
2219 	 * the worker context, so it should be safe to access in a lockless
2220 	 * fashion.
2221 	 */
2222 	data = slot->cs_icc.icc_atr_data;
2223 	atr_data_reset(data);
2224 	if ((p = atr_parse(atr->b_rptr, msgsize(atr), data)) != ATR_CODE_OK) {
2225 		ccid_error(ccid, "!failed to parse ATR data from slot %d: %s",
2226 		    slot->cs_slotno, atr_strerror(p));
2227 		return (B_FALSE);
2228 	}
2229 
2230 	if ((ret = ccid_command_get_parameters(ccid, slot, &prot,
2231 	    &slot->cs_icc.icc_params)) != 0) {
2232 		ccid_error(ccid, "!failed to get parameters for slot %u: %d",
2233 		    slot->cs_slotno, ret);
2234 		return (B_FALSE);
2235 	}
2236 
2237 	slot->cs_icc.icc_protocols = atr_supported_protocols(data);
2238 	slot->cs_icc.icc_cur_protocol = prot;
2239 
2240 	if ((ccid->ccid_flags & (CCID_F_NEEDS_PPS | CCID_F_NEEDS_PARAMS |
2241 	    CCID_F_NEEDS_DATAFREQ)) != 0) {
2242 		ccid_error(ccid, "!CCID reader does not support required "
2243 		    "protocol/parameter setup automation");
2244 		return (B_FALSE);
2245 	}
2246 
2247 	return (B_TRUE);
2248 }
2249 
2250 /*
2251  * Set up the ICC function parameters and initialize the ICC engine.
2252  */
2253 static boolean_t
ccid_slot_prot_init(ccid_t * ccid,ccid_slot_t * slot)2254 ccid_slot_prot_init(ccid_t *ccid, ccid_slot_t *slot)
2255 {
2256 	ccid_slot_setup_functions(ccid, slot);
2257 
2258 	if (slot->cs_icc.icc_init != NULL) {
2259 		slot->cs_icc.icc_init(ccid, slot);
2260 	}
2261 
2262 	return (B_TRUE);
2263 }
2264 
2265 static int
ccid_slot_power_on(ccid_t * ccid,ccid_slot_t * slot,ccid_class_voltage_t volts,mblk_t ** atr)2266 ccid_slot_power_on(ccid_t *ccid, ccid_slot_t *slot, ccid_class_voltage_t volts,
2267     mblk_t **atr)
2268 {
2269 	int ret;
2270 
2271 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2272 
2273 	mutex_exit(&ccid->ccid_mutex);
2274 	if ((ret = ccid_command_power_on(ccid, slot, volts, atr)) != 0) {
2275 		/*
2276 		 * If we got ENXIO, then we know that there is no ICC
2277 		 * present. This could happen for a number of reasons.
2278 		 * For example, we could have just started up and no
2279 		 * card was plugged in (we default to assuming that one
2280 		 * is). Also, some readers won't really tell us that
2281 		 * nothing is there until after the power on fails,
2282 		 * hence why we don't bother with doing a status check
2283 		 * and just try to power on.
2284 		 */
2285 		if (ret == ENXIO) {
2286 			mutex_enter(&ccid->ccid_mutex);
2287 			slot->cs_flags &= ~CCID_SLOT_F_PRESENT;
2288 			return (ret);
2289 		}
2290 
2291 		/*
2292 		 * If we fail to power off the card, check to make sure
2293 		 * it hasn't been removed.
2294 		 */
2295 		if (ccid_command_power_off(ccid, slot) == ENXIO) {
2296 			mutex_enter(&ccid->ccid_mutex);
2297 			slot->cs_flags &= ~CCID_SLOT_F_PRESENT;
2298 			return (ENXIO);
2299 		}
2300 
2301 		mutex_enter(&ccid->ccid_mutex);
2302 		return (ret);
2303 	}
2304 
2305 	if (!ccid_slot_params_init(ccid, slot, *atr)) {
2306 		ccid_error(ccid, "!failed to set slot paramters for ICC");
2307 		mutex_enter(&ccid->ccid_mutex);
2308 		return (ENOTSUP);
2309 	}
2310 
2311 	if (!ccid_slot_prot_init(ccid, slot)) {
2312 		ccid_error(ccid, "!failed to setup protocol for ICC");
2313 		mutex_enter(&ccid->ccid_mutex);
2314 		return (ENOTSUP);
2315 	}
2316 
2317 	mutex_enter(&ccid->ccid_mutex);
2318 	return (0);
2319 }
2320 
2321 static int
ccid_slot_power_off(ccid_t * ccid,ccid_slot_t * slot)2322 ccid_slot_power_off(ccid_t *ccid, ccid_slot_t *slot)
2323 {
2324 	int ret;
2325 
2326 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2327 
2328 	ccid_slot_io_teardown(ccid, slot);
2329 
2330 	/*
2331 	 * Now that we've finished completely waiting for the logical I/O to be
2332 	 * torn down, try and power off the ICC.
2333 	 */
2334 	mutex_exit(&ccid->ccid_mutex);
2335 	ret = ccid_command_power_off(ccid, slot);
2336 	mutex_enter(&ccid->ccid_mutex);
2337 
2338 	if (ret != 0)
2339 		return (ret);
2340 
2341 	ccid_slot_inactive(ccid, slot);
2342 
2343 	return (ret);
2344 }
2345 
2346 static int
ccid_slot_inserted(ccid_t * ccid,ccid_slot_t * slot)2347 ccid_slot_inserted(ccid_t *ccid, ccid_slot_t *slot)
2348 {
2349 	uint_t nvolts = 4;
2350 	uint_t cvolt = 0;
2351 	mblk_t *atr = NULL;
2352 	ccid_class_voltage_t volts[4] = { CCID_CLASS_VOLT_AUTO,
2353 	    CCID_CLASS_VOLT_5_0, CCID_CLASS_VOLT_3_0, CCID_CLASS_VOLT_1_8 };
2354 
2355 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2356 	if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) {
2357 		return (0);
2358 	}
2359 
2360 	if ((slot->cs_flags & CCID_SLOT_F_ACTIVE) != 0) {
2361 		return (0);
2362 	}
2363 
2364 	slot->cs_flags |= CCID_SLOT_F_PRESENT;
2365 
2366 	/*
2367 	 * Now, we need to activate this ccid device before we can do anything
2368 	 * with it. First, power on the device. There are two hardware features
2369 	 * which may be at play. There may be automatic voltage detection and
2370 	 * automatic activation on insertion. In theory, when either of those
2371 	 * are present, we should always try to use the auto voltage.
2372 	 *
2373 	 * What's less clear in the specification is if the Auto-Voltage
2374 	 * property is present is if we should try manual voltages or not. For
2375 	 * the moment we do.
2376 	 */
2377 	if ((ccid->ccid_class.ccd_dwFeatures &
2378 	    (CCID_CLASS_F_AUTO_ICC_ACTIVATE | CCID_CLASS_F_AUTO_ICC_VOLTAGE)) ==
2379 	    0) {
2380 		/* Skip auto-voltage */
2381 		cvolt++;
2382 	}
2383 
2384 	for (; cvolt < nvolts; cvolt++) {
2385 		int ret;
2386 
2387 		if (volts[cvolt] != CCID_CLASS_VOLT_AUTO &&
2388 		    (ccid->ccid_class.ccd_bVoltageSupport & volts[cvolt]) ==
2389 		    0) {
2390 			continue;
2391 		}
2392 
2393 		ret = ccid_slot_power_on(ccid, slot, volts[cvolt], &atr);
2394 		if (ret != 0) {
2395 			freemsg(atr);
2396 			atr = NULL;
2397 			continue;
2398 		}
2399 
2400 		break;
2401 	}
2402 
2403 	if (cvolt >= nvolts) {
2404 		ccid_error(ccid, "!failed to activate and power on ICC, no "
2405 		    "supported voltages found");
2406 		goto notsup;
2407 	}
2408 
2409 	slot->cs_voltage = volts[cvolt];
2410 	slot->cs_atr = atr;
2411 	slot->cs_flags |= CCID_SLOT_F_ACTIVE;
2412 
2413 	ccid_slot_pollout_signal(slot);
2414 
2415 	return (0);
2416 
2417 notsup:
2418 	freemsg(atr);
2419 	ccid_slot_teardown(ccid, slot, B_FALSE);
2420 	return (ENOTSUP);
2421 }
2422 
2423 static int
ccid_slot_warm_reset(ccid_t * ccid,ccid_slot_t * slot)2424 ccid_slot_warm_reset(ccid_t *ccid, ccid_slot_t *slot)
2425 {
2426 	int ret;
2427 	mblk_t *atr;
2428 	ccid_class_voltage_t voltage;
2429 
2430 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2431 
2432 	ccid_slot_io_teardown(ccid, slot);
2433 
2434 	voltage = slot->cs_voltage;
2435 
2436 	ccid_slot_teardown(ccid, slot, B_FALSE);
2437 
2438 	ret = ccid_slot_power_on(ccid, slot, voltage, &atr);
2439 	if (ret != 0) {
2440 		freemsg(atr);
2441 		return (ret);
2442 	}
2443 
2444 	slot->cs_voltage = voltage;
2445 	slot->cs_atr = atr;
2446 
2447 	return (ret);
2448 }
2449 
2450 static boolean_t
ccid_slot_reset(ccid_t * ccid,ccid_slot_t * slot)2451 ccid_slot_reset(ccid_t *ccid, ccid_slot_t *slot)
2452 {
2453 	int ret;
2454 
2455 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2456 	VERIFY(slot->cs_flags & CCID_SLOT_F_NEED_TXN_RESET);
2457 	VERIFY(ccid->ccid_flags & CCID_F_WORKER_RUNNING);
2458 
2459 	if (ccid->ccid_flags & CCID_F_DEV_GONE_MASK)
2460 		return (B_TRUE);
2461 
2462 	/*
2463 	 * Power off the ICC. This will wait for logical I/O if needed.
2464 	 */
2465 	ret = ccid_slot_power_off(ccid, slot);
2466 
2467 	/*
2468 	 * If we failed to power off the ICC because the ICC is removed, then
2469 	 * just return that we failed, so that we can let the next lap clean
2470 	 * things up by noting that the ICC has been removed.
2471 	 */
2472 	if (ret != 0 && ret == ENXIO) {
2473 		return (B_FALSE);
2474 	}
2475 
2476 	if (ret != 0) {
2477 		ccid_error(ccid, "!failed to reset slot %d for next txn: %d; "
2478 		    "taking another lap", slot->cs_slotno, ret);
2479 		return (B_FALSE);
2480 	}
2481 
2482 	/*
2483 	 * Mimic a slot insertion to power this back on. Don't worry about
2484 	 * success or failure, because as far as we care for resetting it, we've
2485 	 * done our duty once we've powered it off successfully.
2486 	 */
2487 	(void) ccid_slot_inserted(ccid, slot);
2488 
2489 	return (B_TRUE);
2490 }
2491 
2492 /*
2493  * We've been asked to perform some amount of work on the various slots that we
2494  * have. This may be because the slot needs to be reset due to the completion of
2495  * a transaction or it may be because an ICC inside of the slot has been
2496  * removed.
2497  */
2498 static void
ccid_worker(void * arg)2499 ccid_worker(void *arg)
2500 {
2501 	uint_t i;
2502 	ccid_t *ccid = arg;
2503 
2504 	mutex_enter(&ccid->ccid_mutex);
2505 	ccid->ccid_stats.cst_ndiscover++;
2506 	ccid->ccid_stats.cst_lastdiscover = gethrtime();
2507 	ccid->ccid_flags |= CCID_F_WORKER_RUNNING;
2508 	ccid->ccid_flags &= ~CCID_F_WORKER_REQUESTED;
2509 
2510 	for (i = 0; i < ccid->ccid_nslots; i++) {
2511 		ccid_slot_t *slot = &ccid->ccid_slots[i];
2512 		uint_t flags;
2513 
2514 		VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2515 
2516 		if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) {
2517 			ccid->ccid_flags &= ~CCID_F_WORKER_MASK;
2518 			mutex_exit(&ccid->ccid_mutex);
2519 			return;
2520 		}
2521 
2522 		/*
2523 		 * Snapshot the flags before we start processing the worker. At
2524 		 * this time we clear out all of the change flags as we'll be
2525 		 * operating on the device. We do not clear the
2526 		 * CCID_SLOT_F_NEED_TXN_RESET flag, as we want to make sure that
2527 		 * this is maintained until we're done here.
2528 		 */
2529 		flags = slot->cs_flags & CCID_SLOT_F_WORK_MASK;
2530 		slot->cs_flags &= ~CCID_SLOT_F_INTR_MASK;
2531 
2532 		if ((flags & CCID_SLOT_F_INTR_OVERCURRENT) != 0) {
2533 			ccid_slot_inactive(ccid, slot);
2534 		}
2535 
2536 		if ((flags & CCID_SLOT_F_CHANGED) != 0) {
2537 			if (flags & CCID_SLOT_F_INTR_GONE) {
2538 				ccid_slot_removed(ccid, slot, B_TRUE);
2539 			} else {
2540 				(void) ccid_slot_inserted(ccid, slot);
2541 				if ((slot->cs_flags & CCID_SLOT_F_ACTIVE) !=
2542 				    0) {
2543 					ccid_slot_excl_maybe_signal(slot);
2544 				}
2545 			}
2546 			VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2547 		}
2548 
2549 		if ((flags & CCID_SLOT_F_NEED_TXN_RESET) != 0) {
2550 			/*
2551 			 * If the CCID_SLOT_F_PRESENT flag is set, then we
2552 			 * should attempt to power off and power on the ICC in
2553 			 * an attempt to reset it. If this fails, trigger
2554 			 * another worker that needs to operate.
2555 			 */
2556 			if ((slot->cs_flags & CCID_SLOT_F_PRESENT) != 0) {
2557 				if (!ccid_slot_reset(ccid, slot)) {
2558 					ccid_worker_request(ccid);
2559 					continue;
2560 				}
2561 			}
2562 
2563 			VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2564 			slot->cs_flags &= ~CCID_SLOT_F_NEED_TXN_RESET;
2565 			/*
2566 			 * Try to signal the next thread waiting for exclusive
2567 			 * access.
2568 			 */
2569 			ccid_slot_excl_maybe_signal(slot);
2570 		}
2571 	}
2572 
2573 	/*
2574 	 * If we have a request to operate again, delay before we consider this,
2575 	 * to make sure we don't do too much work ourselves.
2576 	 */
2577 	if ((ccid->ccid_flags & CCID_F_WORKER_REQUESTED) != 0) {
2578 		mutex_exit(&ccid->ccid_mutex);
2579 		delay(drv_usectohz(1000) * 10);
2580 		mutex_enter(&ccid->ccid_mutex);
2581 	}
2582 
2583 	ccid->ccid_flags &= ~CCID_F_WORKER_RUNNING;
2584 	if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) {
2585 		ccid->ccid_flags &= ~CCID_F_WORKER_REQUESTED;
2586 		mutex_exit(&ccid->ccid_mutex);
2587 		return;
2588 	}
2589 
2590 	if ((ccid->ccid_flags & CCID_F_WORKER_REQUESTED) != 0) {
2591 		(void) ddi_taskq_dispatch(ccid->ccid_taskq, ccid_worker, ccid,
2592 		    DDI_SLEEP);
2593 	}
2594 	mutex_exit(&ccid->ccid_mutex);
2595 }
2596 
2597 static void
ccid_worker_request(ccid_t * ccid)2598 ccid_worker_request(ccid_t *ccid)
2599 {
2600 	boolean_t run;
2601 
2602 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
2603 	if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) {
2604 		return;
2605 	}
2606 
2607 	run = (ccid->ccid_flags & CCID_F_WORKER_MASK) == 0;
2608 	ccid->ccid_flags |= CCID_F_WORKER_REQUESTED;
2609 	if (run) {
2610 		mutex_exit(&ccid->ccid_mutex);
2611 		(void) ddi_taskq_dispatch(ccid->ccid_taskq, ccid_worker, ccid,
2612 		    DDI_SLEEP);
2613 		mutex_enter(&ccid->ccid_mutex);
2614 	}
2615 }
2616 
2617 static void
ccid_intr_restart_timeout(void * arg)2618 ccid_intr_restart_timeout(void *arg)
2619 {
2620 	ccid_t *ccid = arg;
2621 
2622 	mutex_enter(&ccid->ccid_mutex);
2623 	if ((ccid->ccid_flags & CCID_F_DEV_GONE_MASK) != 0) {
2624 		ccid->ccid_poll_timeout = NULL;
2625 		mutex_exit(&ccid->ccid_mutex);
2626 	}
2627 	mutex_exit(&ccid->ccid_mutex);
2628 
2629 	ccid_intr_poll_init(ccid);
2630 }
2631 
2632 /*
2633  * Search for the current class descriptor from the configuration cloud and
2634  * parse it for our use. We do this by first finding the current interface
2635  * descriptor and expecting it to be one of the next descriptors.
2636  */
2637 static boolean_t
ccid_parse_class_desc(ccid_t * ccid)2638 ccid_parse_class_desc(ccid_t *ccid)
2639 {
2640 	uint_t i;
2641 	size_t len, tlen;
2642 	usb_client_dev_data_t *dp;
2643 	usb_alt_if_data_t *alt;
2644 
2645 	/*
2646 	 * Establish the target length we're looking for from usb_parse_data().
2647 	 * Note that we cannot use the sizeof (ccid_class_descr_t) for this
2648 	 * because that function does not know how to account for the padding at
2649 	 * the end of the target structure (which is reasonble). So we manually
2650 	 * figure out the number of bytes it should in theory write.
2651 	 */
2652 	tlen = offsetof(ccid_class_descr_t, ccd_bMaxCCIDBusySlots) +
2653 	    sizeof (ccid->ccid_class.ccd_bMaxCCIDBusySlots);
2654 	dp = ccid->ccid_dev_data;
2655 	alt = &dp->dev_curr_cfg->cfg_if[dp->dev_curr_if].if_alt[0];
2656 	for (i = 0; i < alt->altif_n_cvs; i++) {
2657 		usb_cvs_data_t *cvs = &alt->altif_cvs[i];
2658 		if (cvs->cvs_buf == NULL)
2659 			continue;
2660 		if (cvs->cvs_buf_len != CCID_DESCR_LENGTH)
2661 			continue;
2662 		if (cvs->cvs_buf[1] != CCID_DESCR_TYPE)
2663 			continue;
2664 		if ((len = usb_parse_data("ccscc3lcllc5lccscc", cvs->cvs_buf,
2665 		    cvs->cvs_buf_len, &ccid->ccid_class,
2666 		    sizeof (ccid->ccid_class))) >= tlen) {
2667 			return (B_TRUE);
2668 		}
2669 		ccid_error(ccid, "!failed to parse CCID class descriptor from "
2670 		    "cvs %u, expected %lu bytes, received %lu", i, tlen, len);
2671 	}
2672 
2673 	ccid_error(ccid, "!failed to find matching CCID class descriptor");
2674 	return (B_FALSE);
2675 }
2676 
2677 /*
2678  * Verify whether or not we can support this CCID reader.
2679  */
2680 static boolean_t
ccid_supported(ccid_t * ccid)2681 ccid_supported(ccid_t *ccid)
2682 {
2683 	usb_client_dev_data_t *dp;
2684 	usb_alt_if_data_t *alt;
2685 	ccid_class_features_t feat;
2686 	uint_t bits;
2687 	uint16_t ver = ccid->ccid_class.ccd_bcdCCID;
2688 
2689 	if (CCID_VERSION_MAJOR(ver) != CCID_VERSION_ONE) {
2690 		ccid_error(ccid, "!refusing to attach to CCID with unsupported "
2691 		    "version %x.%2x", CCID_VERSION_MAJOR(ver),
2692 		    CCID_VERSION_MINOR(ver));
2693 		return (B_FALSE);
2694 	}
2695 
2696 	/*
2697 	 * Check the number of endpoints. This should have either two or three.
2698 	 * If three, that means we should expect an interrupt-IN endpoint.
2699 	 * Otherwise, we shouldn't. Any other value indicates something weird
2700 	 * that we should ignore.
2701 	 */
2702 	dp = ccid->ccid_dev_data;
2703 	alt = &dp->dev_curr_cfg->cfg_if[dp->dev_curr_if].if_alt[0];
2704 	switch (alt->altif_descr.bNumEndpoints) {
2705 	case 2:
2706 		ccid->ccid_flags &= ~CCID_F_HAS_INTR;
2707 		break;
2708 	case 3:
2709 		ccid->ccid_flags |= CCID_F_HAS_INTR;
2710 		break;
2711 	default:
2712 		ccid_error(ccid, "!refusing to attach to CCID with unsupported "
2713 		    "number of endpoints: %d", alt->altif_descr.bNumEndpoints);
2714 		return (B_FALSE);
2715 	}
2716 
2717 	/*
2718 	 * Try and determine the appropriate buffer size. This can be a little
2719 	 * tricky. The class descriptor tells us the maximum size that the
2720 	 * reader accepts. While it may be tempting to try and use a larger
2721 	 * value such as the maximum size, the readers really don't like
2722 	 * receiving bulk transfers that large. However, there are also reports
2723 	 * of readers that will overwrite to a fixed minimum size. Until we see
2724 	 * such a thing in the wild there's probably no point in trying to deal
2725 	 * with it here.
2726 	 */
2727 	ccid->ccid_bufsize = ccid->ccid_class.ccd_dwMaxCCIDMessageLength;
2728 	if (ccid->ccid_bufsize < CCID_MIN_MESSAGE_LENGTH) {
2729 		ccid_error(ccid, "!CCID reader maximum CCID message length (%u)"
2730 		    " is less than minimum packet length (%u)",
2731 		    ccid->ccid_bufsize, CCID_MIN_MESSAGE_LENGTH);
2732 		return (B_FALSE);
2733 	}
2734 
2735 	/*
2736 	 * At this time, we do not require that the system have automatic ICC
2737 	 * activation or automatic ICC voltage. These are handled automatically
2738 	 * by the system.
2739 	 */
2740 	feat = ccid->ccid_class.ccd_dwFeatures;
2741 
2742 	/*
2743 	 * Check the number of data rates that are supported by the reader. If
2744 	 * the reader has a non-zero value and we don't support automatic
2745 	 * negotiation then warn about that.
2746 	 */
2747 	if (ccid->ccid_class.ccd_bNumDataRatesSupported != 0 &&
2748 	    (feat & CCID_CLASS_F_AUTO_BAUD) == 0) {
2749 		ccid_error(ccid, "!CCID reader only supports fixed clock rates,"
2750 		    " data will be limited to default values");
2751 	}
2752 
2753 	/*
2754 	 * Check which automatic features the reader provides and which features
2755 	 * it does not. Missing features will require additional work before a
2756 	 * card can be activated. Note, this also applies to APDU based readers
2757 	 * which may need to have various aspects of the device negotiated.
2758 	 */
2759 
2760 	/*
2761 	 * The footnote for these two bits in CCID r1.1.0 indicates that
2762 	 * when neither are missing we have to do the PPS negotiation
2763 	 * ourselves.
2764 	 */
2765 	bits = CCID_CLASS_F_AUTO_PARAM_NEG | CCID_CLASS_F_AUTO_PPS;
2766 	if ((feat & bits) == 0) {
2767 		ccid->ccid_flags |= CCID_F_NEEDS_PPS;
2768 	}
2769 
2770 	if ((feat & CCID_CLASS_F_AUTO_PARAM_NEG) == 0) {
2771 		ccid->ccid_flags |= CCID_F_NEEDS_PARAMS;
2772 	}
2773 
2774 	bits = CCID_CLASS_F_AUTO_BAUD | CCID_CLASS_F_AUTO_ICC_CLOCK;
2775 	if ((feat & bits) != bits) {
2776 		ccid->ccid_flags |= CCID_F_NEEDS_DATAFREQ;
2777 	}
2778 
2779 	return (B_TRUE);
2780 }
2781 
2782 static boolean_t
ccid_open_pipes(ccid_t * ccid)2783 ccid_open_pipes(ccid_t *ccid)
2784 {
2785 	int ret;
2786 	usb_ep_data_t *ep;
2787 	usb_client_dev_data_t *data;
2788 	usb_pipe_policy_t policy;
2789 
2790 	data = ccid->ccid_dev_data;
2791 
2792 	/*
2793 	 * First fill all the descriptors.
2794 	 */
2795 	ep = usb_lookup_ep_data(ccid->ccid_dip, data, data->dev_curr_if, 0, 0,
2796 	    USB_EP_ATTR_BULK, USB_EP_DIR_IN);
2797 	if (ep == NULL) {
2798 		ccid_error(ccid, "!failed to find CCID Bulk-IN endpoint");
2799 		return (B_FALSE);
2800 	}
2801 
2802 	if ((ret = usb_ep_xdescr_fill(USB_EP_XDESCR_CURRENT_VERSION,
2803 	    ccid->ccid_dip, ep, &ccid->ccid_bulkin_xdesc)) != USB_SUCCESS) {
2804 		ccid_error(ccid, "!failed to fill Bulk-IN xdescr: %d", ret);
2805 		return (B_FALSE);
2806 	}
2807 
2808 	ep = usb_lookup_ep_data(ccid->ccid_dip, data, data->dev_curr_if, 0, 0,
2809 	    USB_EP_ATTR_BULK, USB_EP_DIR_OUT);
2810 	if (ep == NULL) {
2811 		ccid_error(ccid, "!failed to find CCID Bulk-OUT endpoint");
2812 		return (B_FALSE);
2813 	}
2814 
2815 	if ((ret = usb_ep_xdescr_fill(USB_EP_XDESCR_CURRENT_VERSION,
2816 	    ccid->ccid_dip, ep, &ccid->ccid_bulkout_xdesc)) != USB_SUCCESS) {
2817 		ccid_error(ccid, "!failed to fill Bulk-OUT xdescr: %d", ret);
2818 		return (B_FALSE);
2819 	}
2820 
2821 	if (ccid->ccid_flags & CCID_F_HAS_INTR) {
2822 		ep = usb_lookup_ep_data(ccid->ccid_dip, data, data->dev_curr_if,
2823 		    0, 0, USB_EP_ATTR_INTR, USB_EP_DIR_IN);
2824 		if (ep == NULL) {
2825 			ccid_error(ccid, "!failed to find CCID Intr-IN "
2826 			    "endpoint");
2827 			return (B_FALSE);
2828 		}
2829 
2830 		if ((ret = usb_ep_xdescr_fill(USB_EP_XDESCR_CURRENT_VERSION,
2831 		    ccid->ccid_dip, ep, &ccid->ccid_intrin_xdesc)) !=
2832 		    USB_SUCCESS) {
2833 			ccid_error(ccid, "!failed to fill Intr-OUT xdescr: %d",
2834 			    ret);
2835 			return (B_FALSE);
2836 		}
2837 	}
2838 
2839 	/*
2840 	 * Now open up the pipes.
2841 	 */
2842 	bzero(&policy, sizeof (policy));
2843 	policy.pp_max_async_reqs = CCID_NUM_ASYNC_REQS;
2844 
2845 	if ((ret = usb_pipe_xopen(ccid->ccid_dip, &ccid->ccid_bulkin_xdesc,
2846 	    &policy, USB_FLAGS_SLEEP, &ccid->ccid_bulkin_pipe)) !=
2847 	    USB_SUCCESS) {
2848 		ccid_error(ccid, "!failed to open Bulk-IN pipe: %d\n", ret);
2849 		return (B_FALSE);
2850 	}
2851 
2852 	if ((ret = usb_pipe_xopen(ccid->ccid_dip, &ccid->ccid_bulkout_xdesc,
2853 	    &policy, USB_FLAGS_SLEEP, &ccid->ccid_bulkout_pipe)) !=
2854 	    USB_SUCCESS) {
2855 		ccid_error(ccid, "!failed to open Bulk-OUT pipe: %d\n", ret);
2856 		usb_pipe_close(ccid->ccid_dip, ccid->ccid_bulkin_pipe,
2857 		    USB_FLAGS_SLEEP, NULL, NULL);
2858 		ccid->ccid_bulkin_pipe = NULL;
2859 		return (B_FALSE);
2860 	}
2861 
2862 	if (ccid->ccid_flags & CCID_F_HAS_INTR) {
2863 		if ((ret = usb_pipe_xopen(ccid->ccid_dip,
2864 		    &ccid->ccid_intrin_xdesc, &policy, USB_FLAGS_SLEEP,
2865 		    &ccid->ccid_intrin_pipe)) != USB_SUCCESS) {
2866 			ccid_error(ccid, "!failed to open Intr-IN pipe: %d\n",
2867 			    ret);
2868 			usb_pipe_close(ccid->ccid_dip, ccid->ccid_bulkin_pipe,
2869 			    USB_FLAGS_SLEEP, NULL, NULL);
2870 			ccid->ccid_bulkin_pipe = NULL;
2871 			usb_pipe_close(ccid->ccid_dip, ccid->ccid_bulkout_pipe,
2872 			    USB_FLAGS_SLEEP, NULL, NULL);
2873 			ccid->ccid_bulkout_pipe = NULL;
2874 			return (B_FALSE);
2875 		}
2876 	}
2877 
2878 	ccid->ccid_control_pipe = data->dev_default_ph;
2879 	return (B_TRUE);
2880 }
2881 
2882 static void
ccid_slots_fini(ccid_t * ccid)2883 ccid_slots_fini(ccid_t *ccid)
2884 {
2885 	uint_t i;
2886 
2887 	for (i = 0; i < ccid->ccid_nslots; i++) {
2888 		VERIFY3U(ccid->ccid_slots[i].cs_slotno, ==, i);
2889 
2890 		if (ccid->ccid_slots[i].cs_command != NULL) {
2891 			ccid_command_free(ccid->ccid_slots[i].cs_command);
2892 			ccid->ccid_slots[i].cs_command = NULL;
2893 		}
2894 
2895 		cv_destroy(&ccid->ccid_slots[i].cs_io.ci_cv);
2896 		freemsgchain(ccid->ccid_slots[i].cs_atr);
2897 		atr_data_free(ccid->ccid_slots[i].cs_icc.icc_atr_data);
2898 		list_destroy(&ccid->ccid_slots[i].cs_minors);
2899 		list_destroy(&ccid->ccid_slots[i].cs_excl_waiters);
2900 	}
2901 
2902 	ddi_remove_minor_node(ccid->ccid_dip, NULL);
2903 	kmem_free(ccid->ccid_slots, sizeof (ccid_slot_t) * ccid->ccid_nslots);
2904 	ccid->ccid_nslots = 0;
2905 	ccid->ccid_slots = NULL;
2906 }
2907 
2908 static boolean_t
ccid_slots_init(ccid_t * ccid)2909 ccid_slots_init(ccid_t *ccid)
2910 {
2911 	uint_t i;
2912 
2913 	/*
2914 	 * The class descriptor has the maximum index that one can index into.
2915 	 * We therefore have to add one to determine the actual number of slots
2916 	 * that exist.
2917 	 */
2918 	ccid->ccid_nslots = ccid->ccid_class.ccd_bMaxSlotIndex + 1;
2919 	ccid->ccid_slots = kmem_zalloc(sizeof (ccid_slot_t) * ccid->ccid_nslots,
2920 	    KM_SLEEP);
2921 	for (i = 0; i < ccid->ccid_nslots; i++) {
2922 		ccid_slot_t *slot = &ccid->ccid_slots[i];
2923 
2924 		/*
2925 		 * We initialize every possible slot as having changed to make
2926 		 * sure that we have a chance to discover it. See the slot
2927 		 * detection section in the big theory statement for more info.
2928 		 */
2929 		slot->cs_flags |= CCID_SLOT_F_CHANGED;
2930 		slot->cs_slotno = i;
2931 		slot->cs_ccid = ccid;
2932 		slot->cs_icc.icc_atr_data = atr_data_alloc();
2933 		slot->cs_idx.cmi_minor = CCID_MINOR_INVALID;
2934 		slot->cs_idx.cmi_isslot = B_TRUE;
2935 		slot->cs_idx.cmi_data.cmi_slot = slot;
2936 		cv_init(&slot->cs_io.ci_cv, NULL, CV_DRIVER, NULL);
2937 		list_create(&slot->cs_minors, sizeof (ccid_minor_t),
2938 		    offsetof(ccid_minor_t, cm_minor_list));
2939 		list_create(&slot->cs_excl_waiters, sizeof (ccid_minor_t),
2940 		    offsetof(ccid_minor_t, cm_excl_list));
2941 	}
2942 
2943 	return (B_TRUE);
2944 }
2945 
2946 static void
ccid_minors_fini(ccid_t * ccid)2947 ccid_minors_fini(ccid_t *ccid)
2948 {
2949 	uint_t i;
2950 
2951 	ddi_remove_minor_node(ccid->ccid_dip, NULL);
2952 	for (i = 0; i < ccid->ccid_nslots; i++) {
2953 		if (ccid->ccid_slots[i].cs_idx.cmi_minor == CCID_MINOR_INVALID)
2954 			continue;
2955 		ccid_minor_idx_free(&ccid->ccid_slots[i].cs_idx);
2956 	}
2957 }
2958 
2959 static boolean_t
ccid_minors_init(ccid_t * ccid)2960 ccid_minors_init(ccid_t *ccid)
2961 {
2962 	uint_t i;
2963 
2964 	for (i = 0; i < ccid->ccid_nslots; i++) {
2965 		char buf[32];
2966 
2967 		(void) ccid_minor_idx_alloc(&ccid->ccid_slots[i].cs_idx,
2968 		    B_TRUE);
2969 
2970 		(void) snprintf(buf, sizeof (buf), "slot%u", i);
2971 		if (ddi_create_minor_node(ccid->ccid_dip, buf, S_IFCHR,
2972 		    ccid->ccid_slots[i].cs_idx.cmi_minor,
2973 		    DDI_NT_CCID_ATTACHMENT_POINT, 0) != DDI_SUCCESS) {
2974 			ccid_minors_fini(ccid);
2975 			return (B_FALSE);
2976 		}
2977 	}
2978 
2979 	return (B_TRUE);
2980 }
2981 
2982 static void
ccid_intr_poll_fini(ccid_t * ccid)2983 ccid_intr_poll_fini(ccid_t *ccid)
2984 {
2985 	if (ccid->ccid_flags & CCID_F_HAS_INTR) {
2986 		timeout_id_t tid;
2987 
2988 		mutex_enter(&ccid->ccid_mutex);
2989 		tid = ccid->ccid_poll_timeout;
2990 		ccid->ccid_poll_timeout = NULL;
2991 		mutex_exit(&ccid->ccid_mutex);
2992 		(void) untimeout(tid);
2993 		usb_pipe_stop_intr_polling(ccid->ccid_intrin_pipe,
2994 		    USB_FLAGS_SLEEP);
2995 	} else {
2996 		VERIFY3P(ccid->ccid_intrin_pipe, ==, NULL);
2997 	}
2998 }
2999 
3000 static void
ccid_intr_poll_init(ccid_t * ccid)3001 ccid_intr_poll_init(ccid_t *ccid)
3002 {
3003 	int ret;
3004 	usb_intr_req_t *uirp;
3005 
3006 	uirp = usb_alloc_intr_req(ccid->ccid_dip, 0, USB_FLAGS_SLEEP);
3007 	uirp->intr_client_private = (usb_opaque_t)ccid;
3008 	uirp->intr_attributes = USB_ATTRS_SHORT_XFER_OK |
3009 	    USB_ATTRS_AUTOCLEARING;
3010 	uirp->intr_len = CCID_INTR_RESPONSE_SIZE;
3011 	uirp->intr_cb = ccid_intr_pipe_cb;
3012 	uirp->intr_exc_cb = ccid_intr_pipe_except_cb;
3013 
3014 	mutex_enter(&ccid->ccid_mutex);
3015 	if (ccid->ccid_flags & CCID_F_DEV_GONE_MASK) {
3016 		mutex_exit(&ccid->ccid_mutex);
3017 		usb_free_intr_req(uirp);
3018 		return;
3019 	}
3020 
3021 	if ((ret = usb_pipe_intr_xfer(ccid->ccid_intrin_pipe, uirp,
3022 	    USB_FLAGS_SLEEP)) != USB_SUCCESS) {
3023 		ccid_error(ccid, "!failed to start polling on CCID Intr-IN "
3024 		    "pipe: %d", ret);
3025 		ccid->ccid_poll_timeout = timeout(ccid_intr_restart_timeout,
3026 		    ccid, drv_usectohz(1000000));
3027 		usb_free_intr_req(uirp);
3028 	}
3029 	mutex_exit(&ccid->ccid_mutex);
3030 }
3031 
3032 static void
ccid_cleanup_bulkin(ccid_t * ccid)3033 ccid_cleanup_bulkin(ccid_t *ccid)
3034 {
3035 	uint_t i;
3036 
3037 	VERIFY3P(ccid->ccid_bulkin_dispatched, ==, NULL);
3038 	for (i = 0; i < ccid->ccid_bulkin_alloced; i++) {
3039 		VERIFY3P(ccid->ccid_bulkin_cache[i], !=, NULL);
3040 		usb_free_bulk_req(ccid->ccid_bulkin_cache[i]);
3041 		ccid->ccid_bulkin_cache[i] = NULL;
3042 	}
3043 
3044 #ifdef	DEBUG
3045 	for (i = 0; i < CCID_BULK_NALLOCED; i++) {
3046 		VERIFY3P(ccid->ccid_bulkin_cache[i], ==, NULL);
3047 	}
3048 #endif
3049 	ccid->ccid_bulkin_alloced = 0;
3050 }
3051 
3052 static int
ccid_disconnect_cb(dev_info_t * dip)3053 ccid_disconnect_cb(dev_info_t *dip)
3054 {
3055 	int inst;
3056 	ccid_t *ccid;
3057 	uint_t i;
3058 
3059 	if (dip == NULL)
3060 		goto done;
3061 
3062 	inst = ddi_get_instance(dip);
3063 	ccid = ddi_get_soft_state(ccid_softstate, inst);
3064 	if (ccid == NULL)
3065 		goto done;
3066 	VERIFY3P(dip, ==, ccid->ccid_dip);
3067 
3068 	mutex_enter(&ccid->ccid_mutex);
3069 	/*
3070 	 * First, set the disconnected flag. This will make sure that anyone
3071 	 * that tries to make additional operations will be kicked out. This
3072 	 * flag is checked by detach and by users.
3073 	 */
3074 	ccid->ccid_flags |= CCID_F_DISCONNECTED;
3075 
3076 	/*
3077 	 * Now, go through any threads that are blocked on a minor for exclusive
3078 	 * access. They should be woken up and they'll fail due to the fact that
3079 	 * we've set the disconnected flag above.
3080 	 */
3081 	for (i = 0; i < ccid->ccid_nslots; i++) {
3082 		ccid_minor_t *cmp;
3083 		ccid_slot_t *slot = &ccid->ccid_slots[i];
3084 
3085 		for (cmp = list_head(&slot->cs_excl_waiters); cmp != NULL;
3086 		    cmp = list_next(&slot->cs_excl_waiters, cmp)) {
3087 			cv_signal(&cmp->cm_excl_cv);
3088 		}
3089 	}
3090 
3091 	/*
3092 	 * Finally, we need to basically wake up anyone blocked in read and make
3093 	 * sure that they don't wait there forever and make sure that anyone
3094 	 * polling gets a POLLHUP. We can't really distinguish between this and
3095 	 * an ICC being removed. It will be discovered when someone tries to do
3096 	 * an operation and they receive an ENODEV. We only need to do this on
3097 	 * minors that have exclusive access. Don't worry about them finishing
3098 	 * up, this'll be done as part of detach.
3099 	 */
3100 	for (i = 0; i < ccid->ccid_nslots; i++) {
3101 		ccid_slot_t *slot = &ccid->ccid_slots[i];
3102 		if (slot->cs_excl_minor == NULL)
3103 			continue;
3104 
3105 		pollwakeup(&slot->cs_excl_minor->cm_pollhead,
3106 		    POLLHUP | POLLERR);
3107 		cv_signal(&slot->cs_excl_minor->cm_read_cv);
3108 	}
3109 
3110 	/*
3111 	 * If there are outstanding commands, they will ultimately be cleaned
3112 	 * up as the USB commands themselves time out. We will get notified
3113 	 * through the various bulk xfer exception callbacks, which will induce
3114 	 * the cleanup through ccid_command_transport_error(). This will also
3115 	 * take care of commands waiting for I/O teardown.
3116 	 */
3117 	mutex_exit(&ccid->ccid_mutex);
3118 
3119 done:
3120 	return (USB_SUCCESS);
3121 }
3122 
3123 static usb_event_t ccid_usb_events = {
3124 	ccid_disconnect_cb,
3125 	NULL,
3126 	NULL,
3127 	NULL
3128 };
3129 
3130 static void
ccid_cleanup(dev_info_t * dip)3131 ccid_cleanup(dev_info_t *dip)
3132 {
3133 	int inst;
3134 	ccid_t *ccid;
3135 
3136 	if (dip == NULL)
3137 		return;
3138 
3139 	inst = ddi_get_instance(dip);
3140 	ccid = ddi_get_soft_state(ccid_softstate, inst);
3141 	if (ccid == NULL)
3142 		return;
3143 	VERIFY3P(dip, ==, ccid->ccid_dip);
3144 
3145 	/*
3146 	 * Make sure we set the detaching flag so anything running in the
3147 	 * background knows to stop.
3148 	 */
3149 	mutex_enter(&ccid->ccid_mutex);
3150 	ccid->ccid_flags |= CCID_F_DETACHING;
3151 	mutex_exit(&ccid->ccid_mutex);
3152 
3153 	if ((ccid->ccid_attach & CCID_ATTACH_MINORS) != 0) {
3154 		ccid_minors_fini(ccid);
3155 		ccid->ccid_attach &= ~CCID_ATTACH_MINORS;
3156 	}
3157 
3158 	if ((ccid->ccid_attach & CCID_ATTACH_INTR_ACTIVE) != 0) {
3159 		ccid_intr_poll_fini(ccid);
3160 		ccid->ccid_attach &= ~CCID_ATTACH_INTR_ACTIVE;
3161 	}
3162 
3163 	/*
3164 	 * At this point, we have shut down the interrupt pipe, the last place
3165 	 * aside from a user that could have kicked off I/O. So finally wait for
3166 	 * any worker threads.
3167 	 */
3168 	if (ccid->ccid_taskq != NULL) {
3169 		ddi_taskq_wait(ccid->ccid_taskq);
3170 		mutex_enter(&ccid->ccid_mutex);
3171 		VERIFY0(ccid->ccid_flags & CCID_F_WORKER_MASK);
3172 		mutex_exit(&ccid->ccid_mutex);
3173 	}
3174 
3175 	if ((ccid->ccid_attach & CCID_ATTACH_HOTPLUG_CB) != 0) {
3176 		usb_unregister_event_cbs(dip, &ccid_usb_events);
3177 		ccid->ccid_attach &= ~CCID_ATTACH_HOTPLUG_CB;
3178 	}
3179 
3180 	if ((ccid->ccid_attach & CCID_ATTACH_SLOTS) != 0) {
3181 		ccid_slots_fini(ccid);
3182 		ccid->ccid_attach &= ~CCID_ATTACH_SLOTS;
3183 	}
3184 
3185 	if ((ccid->ccid_attach & CCID_ATTACH_SEQ_IDS) != 0) {
3186 		id_space_destroy(ccid->ccid_seqs);
3187 		ccid->ccid_seqs = NULL;
3188 		ccid->ccid_attach &= ~CCID_ATTACH_SEQ_IDS;
3189 	}
3190 
3191 	if ((ccid->ccid_attach & CCID_ATTACH_OPEN_PIPES) != 0) {
3192 		usb_pipe_close(dip, ccid->ccid_bulkin_pipe, USB_FLAGS_SLEEP,
3193 		    NULL, NULL);
3194 		ccid->ccid_bulkin_pipe = NULL;
3195 		usb_pipe_close(dip, ccid->ccid_bulkout_pipe, USB_FLAGS_SLEEP,
3196 		    NULL, NULL);
3197 		ccid->ccid_bulkout_pipe = NULL;
3198 		if ((ccid->ccid_flags & CCID_F_HAS_INTR) != 0) {
3199 			usb_pipe_close(dip, ccid->ccid_intrin_pipe,
3200 			    USB_FLAGS_SLEEP, NULL, NULL);
3201 			ccid->ccid_intrin_pipe = NULL;
3202 		} else {
3203 			VERIFY3P(ccid->ccid_intrin_pipe, ==, NULL);
3204 		}
3205 		ccid->ccid_control_pipe = NULL;
3206 		ccid->ccid_attach &= ~CCID_ATTACH_OPEN_PIPES;
3207 	}
3208 
3209 	/*
3210 	 * Now that all of the pipes are closed. If we happened to have any
3211 	 * cached bulk requests, we should free them.
3212 	 */
3213 	ccid_cleanup_bulkin(ccid);
3214 
3215 	if (ccid->ccid_attach & CCID_ATTACH_CMD_LIST) {
3216 		ccid_command_t *cc;
3217 
3218 		while ((cc = list_remove_head(&ccid->ccid_command_queue)) !=
3219 		    NULL) {
3220 			ccid_command_free(cc);
3221 		}
3222 		list_destroy(&ccid->ccid_command_queue);
3223 
3224 		while ((cc = list_remove_head(&ccid->ccid_complete_queue)) !=
3225 		    NULL) {
3226 			ccid_command_free(cc);
3227 		}
3228 		list_destroy(&ccid->ccid_complete_queue);
3229 	}
3230 
3231 	if ((ccid->ccid_attach & CCID_ATTACH_TASKQ) != 0) {
3232 		ddi_taskq_destroy(ccid->ccid_taskq);
3233 		ccid->ccid_taskq = NULL;
3234 		ccid->ccid_attach &= ~CCID_ATTACH_TASKQ;
3235 	}
3236 
3237 	if ((ccid->ccid_attach & CCID_ATTACH_MUTEX_INIT) != 0) {
3238 		mutex_destroy(&ccid->ccid_mutex);
3239 		ccid->ccid_attach &= ~CCID_ATTACH_MUTEX_INIT;
3240 	}
3241 
3242 	if ((ccid->ccid_attach & CCID_ATTACH_USB_CLIENT) != 0) {
3243 		usb_client_detach(dip, ccid->ccid_dev_data);
3244 		ccid->ccid_dev_data = NULL;
3245 		ccid->ccid_attach &= ~CCID_ATTACH_USB_CLIENT;
3246 	}
3247 
3248 	ASSERT0(ccid->ccid_attach);
3249 	ddi_soft_state_free(ccid_softstate, inst);
3250 }
3251 
3252 static int
ccid_attach(dev_info_t * dip,ddi_attach_cmd_t cmd)3253 ccid_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
3254 {
3255 	ccid_t *ccid;
3256 	int inst, ret;
3257 	char buf[64];
3258 
3259 	if (cmd != DDI_ATTACH)
3260 		return (DDI_FAILURE);
3261 
3262 	inst = ddi_get_instance(dip);
3263 	if (ddi_soft_state_zalloc(ccid_softstate, inst) != DDI_SUCCESS) {
3264 		ccid_error(NULL, "!failed to allocate soft state for ccid "
3265 		    "instance %d", inst);
3266 		return (DDI_FAILURE);
3267 	}
3268 
3269 	ccid = ddi_get_soft_state(ccid_softstate, inst);
3270 	ccid->ccid_dip = dip;
3271 
3272 	if ((ret = usb_client_attach(dip, USBDRV_VERSION, 0)) != USB_SUCCESS) {
3273 		ccid_error(ccid, "!failed to attach to usb client: %d", ret);
3274 		goto cleanup;
3275 	}
3276 	ccid->ccid_attach |= CCID_ATTACH_USB_CLIENT;
3277 
3278 	if ((ret = usb_get_dev_data(dip, &ccid->ccid_dev_data, USB_PARSE_LVL_IF,
3279 	    0)) != USB_SUCCESS) {
3280 		ccid_error(ccid, "!failed to get usb device data: %d", ret);
3281 		goto cleanup;
3282 	}
3283 
3284 	mutex_init(&ccid->ccid_mutex, NULL, MUTEX_DRIVER,
3285 	    ccid->ccid_dev_data->dev_iblock_cookie);
3286 	ccid->ccid_attach |= CCID_ATTACH_MUTEX_INIT;
3287 
3288 	(void) snprintf(buf, sizeof (buf), "ccid%d_taskq", inst);
3289 	ccid->ccid_taskq = ddi_taskq_create(dip, buf, 1, TASKQ_DEFAULTPRI, 0);
3290 	if (ccid->ccid_taskq == NULL) {
3291 		ccid_error(ccid, "!failed to create CCID taskq");
3292 		goto cleanup;
3293 	}
3294 	ccid->ccid_attach |= CCID_ATTACH_TASKQ;
3295 
3296 	list_create(&ccid->ccid_command_queue, sizeof (ccid_command_t),
3297 	    offsetof(ccid_command_t, cc_list_node));
3298 	list_create(&ccid->ccid_complete_queue, sizeof (ccid_command_t),
3299 	    offsetof(ccid_command_t, cc_list_node));
3300 
3301 	if (!ccid_parse_class_desc(ccid)) {
3302 		ccid_error(ccid, "!failed to parse CCID class descriptor");
3303 		goto cleanup;
3304 	}
3305 
3306 	if (!ccid_supported(ccid)) {
3307 		ccid_error(ccid,
3308 		    "!CCID reader is not supported, not attaching");
3309 		goto cleanup;
3310 	}
3311 
3312 	if (!ccid_open_pipes(ccid)) {
3313 		ccid_error(ccid, "!failed to open CCID pipes, not attaching");
3314 		goto cleanup;
3315 	}
3316 	ccid->ccid_attach |= CCID_ATTACH_OPEN_PIPES;
3317 
3318 	(void) snprintf(buf, sizeof (buf), "ccid%d_seqs", inst);
3319 	if ((ccid->ccid_seqs = id_space_create(buf, CCID_SEQ_MIN,
3320 	    CCID_SEQ_MAX + 1)) == NULL) {
3321 		ccid_error(ccid, "!failed to create CCID sequence id space");
3322 		goto cleanup;
3323 	}
3324 	ccid->ccid_attach |= CCID_ATTACH_SEQ_IDS;
3325 
3326 	if (!ccid_slots_init(ccid)) {
3327 		ccid_error(ccid, "!failed to initialize CCID slot structures");
3328 		goto cleanup;
3329 	}
3330 	ccid->ccid_attach |= CCID_ATTACH_SLOTS;
3331 
3332 	if (usb_register_event_cbs(dip, &ccid_usb_events, 0) != USB_SUCCESS) {
3333 		ccid_error(ccid, "!failed to register USB hotplug callbacks");
3334 		goto cleanup;
3335 	}
3336 	ccid->ccid_attach |= CCID_ATTACH_HOTPLUG_CB;
3337 
3338 	/*
3339 	 * Before we enable the interrupt pipe, take a shot at priming our
3340 	 * bulkin_cache.
3341 	 */
3342 	mutex_enter(&ccid->ccid_mutex);
3343 	ccid_bulkin_cache_refresh(ccid);
3344 	mutex_exit(&ccid->ccid_mutex);
3345 
3346 	if (ccid->ccid_flags & CCID_F_HAS_INTR) {
3347 		ccid_intr_poll_init(ccid);
3348 	}
3349 	ccid->ccid_attach |= CCID_ATTACH_INTR_ACTIVE;
3350 
3351 	/*
3352 	 * Create minor nodes for each slot.
3353 	 */
3354 	if (!ccid_minors_init(ccid)) {
3355 		ccid_error(ccid, "!failed to create minor nodes");
3356 		goto cleanup;
3357 	}
3358 	ccid->ccid_attach |= CCID_ATTACH_MINORS;
3359 
3360 	mutex_enter(&ccid->ccid_mutex);
3361 	ccid_worker_request(ccid);
3362 	mutex_exit(&ccid->ccid_mutex);
3363 
3364 	return (DDI_SUCCESS);
3365 
3366 cleanup:
3367 	ccid_cleanup(dip);
3368 	return (DDI_FAILURE);
3369 }
3370 
3371 static int
ccid_getinfo(dev_info_t * dip,ddi_info_cmd_t cmd,void * arg,void ** outp)3372 ccid_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **outp)
3373 {
3374 	return (DDI_FAILURE);
3375 }
3376 
3377 static int
ccid_detach(dev_info_t * dip,ddi_detach_cmd_t cmd)3378 ccid_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
3379 {
3380 	int inst;
3381 	ccid_t *ccid;
3382 
3383 	if (cmd != DDI_DETACH)
3384 		return (DDI_FAILURE);
3385 
3386 	inst = ddi_get_instance(dip);
3387 	ccid = ddi_get_soft_state(ccid_softstate, inst);
3388 	VERIFY3P(ccid, !=, NULL);
3389 	VERIFY3P(dip, ==, ccid->ccid_dip);
3390 
3391 	mutex_enter(&ccid->ccid_mutex);
3392 
3393 	/*
3394 	 * If the device hasn't been disconnected from a USB sense, refuse to
3395 	 * detach. Otherwise, there's no way to guarantee that the ccid
3396 	 * driver will be attached when a user hotplugs an ICC.
3397 	 */
3398 	if ((ccid->ccid_flags & CCID_F_DISCONNECTED) == 0) {
3399 		mutex_exit(&ccid->ccid_mutex);
3400 		return (DDI_FAILURE);
3401 	}
3402 
3403 	if (!list_is_empty(&ccid->ccid_command_queue) ||
3404 	    !list_is_empty(&ccid->ccid_complete_queue)) {
3405 		mutex_exit(&ccid->ccid_mutex);
3406 		return (DDI_FAILURE);
3407 	}
3408 	mutex_exit(&ccid->ccid_mutex);
3409 
3410 	ccid_cleanup(dip);
3411 	return (DDI_SUCCESS);
3412 }
3413 
3414 static void
ccid_minor_free(ccid_minor_t * cmp)3415 ccid_minor_free(ccid_minor_t *cmp)
3416 {
3417 	VERIFY3U(cmp->cm_idx.cmi_minor, ==, CCID_MINOR_INVALID);
3418 	crfree(cmp->cm_opener);
3419 	cv_destroy(&cmp->cm_iowait_cv);
3420 	cv_destroy(&cmp->cm_read_cv);
3421 	cv_destroy(&cmp->cm_excl_cv);
3422 	kmem_free(cmp, sizeof (ccid_minor_t));
3423 
3424 }
3425 
3426 static int
ccid_open(dev_t * devp,int flag,int otyp,cred_t * credp)3427 ccid_open(dev_t *devp, int flag, int otyp, cred_t *credp)
3428 {
3429 	ccid_minor_idx_t *idx;
3430 	ccid_minor_t *cmp;
3431 	ccid_slot_t *slot;
3432 
3433 	/*
3434 	 * Always check the zone first, to make sure we lie about it existing.
3435 	 */
3436 	if (crgetzoneid(credp) != GLOBAL_ZONEID)
3437 		return (ENOENT);
3438 
3439 	if ((otyp & (FNDELAY | FEXCL)) != 0)
3440 		return (EINVAL);
3441 
3442 	if (drv_priv(credp) != 0)
3443 		return (EPERM);
3444 
3445 	if (otyp != OTYP_CHR)
3446 		return (ENOTSUP);
3447 
3448 	if ((flag & FREAD) != FREAD)
3449 		return (EINVAL);
3450 
3451 	idx = ccid_minor_find(getminor(*devp));
3452 	if (idx == NULL) {
3453 		return (ENOENT);
3454 	}
3455 
3456 	/*
3457 	 * We don't expect anyone to be able to get a non-slot related minor. If
3458 	 * that somehow happens, guard against it and error out.
3459 	 */
3460 	if (!idx->cmi_isslot) {
3461 		return (ENOENT);
3462 	}
3463 
3464 	slot = idx->cmi_data.cmi_slot;
3465 
3466 	mutex_enter(&slot->cs_ccid->ccid_mutex);
3467 	if ((slot->cs_ccid->ccid_flags & CCID_F_DISCONNECTED) != 0) {
3468 		mutex_exit(&slot->cs_ccid->ccid_mutex);
3469 		return (ENODEV);
3470 	}
3471 	mutex_exit(&slot->cs_ccid->ccid_mutex);
3472 
3473 	cmp = kmem_zalloc(sizeof (ccid_minor_t), KM_SLEEP);
3474 
3475 	cmp->cm_idx.cmi_minor = CCID_MINOR_INVALID;
3476 	cmp->cm_idx.cmi_isslot = B_FALSE;
3477 	cmp->cm_idx.cmi_data.cmi_user = cmp;
3478 	if (!ccid_minor_idx_alloc(&cmp->cm_idx, B_FALSE)) {
3479 		kmem_free(cmp, sizeof (ccid_minor_t));
3480 		return (ENOSPC);
3481 	}
3482 	cv_init(&cmp->cm_excl_cv, NULL, CV_DRIVER, NULL);
3483 	cv_init(&cmp->cm_read_cv, NULL, CV_DRIVER, NULL);
3484 	cv_init(&cmp->cm_iowait_cv, NULL, CV_DRIVER, NULL);
3485 	cmp->cm_opener = crdup(credp);
3486 	cmp->cm_slot = slot;
3487 	*devp = makedevice(getmajor(*devp), cmp->cm_idx.cmi_minor);
3488 
3489 	if ((flag & FWRITE) == FWRITE) {
3490 		cmp->cm_flags |= CCID_MINOR_F_WRITABLE;
3491 	}
3492 
3493 	mutex_enter(&slot->cs_ccid->ccid_mutex);
3494 	list_insert_tail(&slot->cs_minors, cmp);
3495 	mutex_exit(&slot->cs_ccid->ccid_mutex);
3496 
3497 	return (0);
3498 }
3499 
3500 /*
3501  * Copy a command which may have a message block chain out to the user.
3502  */
3503 static int
ccid_read_copyout(struct uio * uiop,const mblk_t * mp)3504 ccid_read_copyout(struct uio *uiop, const mblk_t *mp)
3505 {
3506 	offset_t off;
3507 
3508 	off = uiop->uio_loffset;
3509 	VERIFY3P(mp->b_next, ==, NULL);
3510 
3511 	for (; mp != NULL; mp = mp->b_cont) {
3512 		int ret;
3513 
3514 		if (MBLKL(mp) == 0)
3515 			continue;
3516 
3517 		ret = uiomove(mp->b_rptr, MBLKL(mp), UIO_READ, uiop);
3518 		if (ret != 0) {
3519 			return (EFAULT);
3520 		}
3521 	}
3522 
3523 	uiop->uio_loffset = off;
3524 	return (0);
3525 }
3526 
3527 /*
3528  * Called to indicate that we are ready for a user to consume the I/O.
3529  */
3530 static void
ccid_user_io_done(ccid_t * ccid,ccid_slot_t * slot)3531 ccid_user_io_done(ccid_t *ccid, ccid_slot_t *slot)
3532 {
3533 	ccid_minor_t *cmp;
3534 
3535 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
3536 
3537 	slot->cs_io.ci_flags &= ~CCID_IO_F_IN_PROGRESS;
3538 	slot->cs_io.ci_flags |= CCID_IO_F_DONE;
3539 	cmp = slot->cs_excl_minor;
3540 	if (cmp != NULL) {
3541 		ccid_slot_pollin_signal(slot);
3542 		cv_signal(&cmp->cm_read_cv);
3543 	}
3544 }
3545 
3546 /*
3547  * This is called in a few different sitautions. It's called when an exclusive
3548  * hold is being released by a user on the slot. It's also called when the ICC
3549  * is removed, the reader has been unplugged, or the ICC is being reset. In all
3550  * these cases we need to make sure that I/O is taken care of and we won't be
3551  * leaving behind vestigial garbage.
3552  */
3553 static void
ccid_teardown_apdu(ccid_t * ccid,ccid_slot_t * slot,int error)3554 ccid_teardown_apdu(ccid_t *ccid, ccid_slot_t *slot, int error)
3555 {
3556 
3557 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
3558 
3559 	/*
3560 	 * If no I/O is in progress, then there's nothing to do at our end.
3561 	 */
3562 	if ((slot->cs_io.ci_flags & CCID_IO_F_IN_PROGRESS) == 0) {
3563 		return;
3564 	}
3565 
3566 	slot->cs_io.ci_errno = error;
3567 	ccid_user_io_done(ccid, slot);
3568 
3569 	/*
3570 	 * There is still I/O going on. We need to mark this on the slot such
3571 	 * that no one can gain ownership of it or issue commands. This will
3572 	 * block hand off of a slot.
3573 	 */
3574 	slot->cs_flags |= CCID_SLOT_F_NEED_IO_TEARDOWN;
3575 }
3576 
3577 /*
3578  * This function is called in response to a CCID command completing.
3579  */
3580 static void
ccid_complete_apdu(ccid_t * ccid,ccid_slot_t * slot,ccid_command_t * cc)3581 ccid_complete_apdu(ccid_t *ccid, ccid_slot_t *slot, ccid_command_t *cc)
3582 {
3583 	ccid_reply_command_status_t crs;
3584 	ccid_reply_icc_status_t cis;
3585 	ccid_command_err_t cce;
3586 
3587 	VERIFY(MUTEX_HELD(&ccid->ccid_mutex));
3588 	VERIFY3P(slot->cs_io.ci_command, ==, cc);
3589 
3590 	/*
3591 	 * This completion could be called due to the fact that a user is no
3592 	 * longer present, but we still have outstanding work to do in the
3593 	 * stack. As such, we need to go through and check if the flag was set
3594 	 * on the slot during teardown and if so, clean it up now.
3595 	 */
3596 	if ((slot->cs_flags & CCID_SLOT_F_NEED_IO_TEARDOWN) != 0) {
3597 		ccid_command_free(cc);
3598 		slot->cs_io.ci_command = NULL;
3599 		ccid_slot_io_teardown_done(slot);
3600 		return;
3601 	}
3602 
3603 	/*
3604 	 * Process this command and figure out what we should logically be
3605 	 * returning to the user.
3606 	 */
3607 	if (cc->cc_state != CCID_COMMAND_COMPLETE) {
3608 		slot->cs_io.ci_errno = EIO;
3609 		slot->cs_flags |= CCID_SLOT_F_NEED_TXN_RESET;
3610 		ccid_worker_request(ccid);
3611 		goto consume;
3612 	}
3613 
3614 	ccid_command_status_decode(cc, &crs, &cis, &cce);
3615 	if (crs == CCID_REPLY_STATUS_COMPLETE) {
3616 		mblk_t *mp;
3617 
3618 		mp = cc->cc_response;
3619 		cc->cc_response = NULL;
3620 		mp->b_rptr += sizeof (ccid_header_t);
3621 		slot->cs_io.ci_errno = 0;
3622 		slot->cs_io.ci_data = mp;
3623 	} else if (cis == CCID_REPLY_ICC_MISSING) {
3624 		slot->cs_io.ci_errno = ENXIO;
3625 	} else {
3626 		/*
3627 		 * There are a few more semantic things we can do
3628 		 * with the errors here that we're throwing out and
3629 		 * lumping as EIO. Oh well.
3630 		 */
3631 		slot->cs_io.ci_errno = EIO;
3632 	}
3633 
3634 	/*
3635 	 * Now, we can go ahead and wake up a reader to process this command.
3636 	 */
3637 consume:
3638 	slot->cs_io.ci_command = NULL;
3639 	ccid_command_free(cc);
3640 	ccid_user_io_done(ccid, slot);
3641 }
3642 
3643 /*
3644  * We have the user buffer in the CCID slot. Given that, transform it into
3645<